5 ms·

How did OpenID fail (it's widely used)? How is it complicated for the user? Properly implemented, OpenID looks like this to the user: http://springpadit.com/lo

by TillE 15y ago

How did OpenID fail (it's widely used)? How is it complicated for the user? Properly implemented, OpenID looks like this to the user: http://springpadit.com/login http://springpadit.com/login And something like this for the average developer: https://github.com/omab/django-social-auth https://github.com/omab/django-social-auth

ignifero 15y ago
Do an online poll and ask people "Do you know your openID" vs "Do you know your email". Users are trained to use emails for login, and that's a significant investment already.
- TillE 15y ago
  That was a brief failure of communication when OpenID was new. Have a Google or Yahoo account? Your email address is your OpenID. Of course nobody is going to manually enter an OpenID URL. Why would they need to?
JoshTriplett 15y ago
That site fails terribly at supporting OpenID: it only supports four authentication providers, and doesn't allow a user to enter an arbitrary OpenID URL. "Properly implemented", OpenID looks like http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit : a choice of common OpenID providers to help users who don't understand OpenID, an option to use an arbitrary OpenID, and an option to use a username and password. Properly implemented, BrowserID looks like one big shiny "sign in" button, and yet it still supports any service the user wants to use, and better yet no third-party service at all. Seems like a big improvement to me.
- jancona 15y ago
  Why do you think a "properly implemented" OpenID site should allow the user to use any authentication provider? The relying party site is trusting the OpenID provider to authenticate its users. Wouldn't sites with real security requirements want to vet providers before trusting them?
  - js4all 15y ago
    Exactly right. And all OpenID providers have different attribute exchange protocol extensions. If you use them, you can effectively allow only those you have tested.
- nolliesnom 15y ago
  There are legitimate reasons to whitelist OpenID providers, especially if you are dealing with $$ or want to minimize support costs.
smackfu 15y ago
I don't think it's widely used. The average site that doesn't want to provide their own username is using Facebook nowadays. Stack Overflow etc. seems to be the only bigger site that uses it, and it's kind of a mess over there.
SteveArmstrong 15y ago
I don't see the OpenID here. I see them restricting me to only 4 third-party sites. Since there doing that, using OpenID or using each third party's system makes no difference. OpenID's supposed to be decentralized, but how do I log in with http://stevearm.com http://stevearm.com?

by TillE 15y ago

ignifero 15y ago

Do an online poll and ask people "Do you know your openID" vs "Do you know your email". Users are trained to use emails for login, and that's a significant investment already.

TillE 15y ago
That was a brief failure of communication when OpenID was new. Have a Google or Yahoo account? Your email address is your OpenID. Of course nobody is going to manually enter an OpenID URL. Why would they need to?

JoshTriplett 15y ago

That site fails terribly at supporting OpenID: it only supports four authentication providers, and doesn't allow a user to enter an arbitrary OpenID URL. "Properly implemented", OpenID looks like http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit : a choice of common OpenID providers to help users who don't understand OpenID, an option to use an arbitrary OpenID, and an option to use a username and password. Properly implemented, BrowserID looks like one big shiny "sign in" button, and yet it still supports any service the user wants to use, and better yet no third-party service at all. Seems like a big improvement to me.

jancona 15y ago
Why do you think a "properly implemented" OpenID site should allow the user to use any authentication provider? The relying party site is trusting the OpenID provider to authenticate its users. Wouldn't sites with real security requirements want to vet providers before trusting them?
- js4all 15y ago
  Exactly right. And all OpenID providers have different attribute exchange protocol extensions. If you use them, you can effectively allow only those you have tested.
nolliesnom 15y ago
There are legitimate reasons to whitelist OpenID providers, especially if you are dealing with $$ or want to minimize support costs.

smackfu 15y ago

I don't think it's widely used. The average site that doesn't want to provide their own username is using Facebook nowadays. Stack Overflow etc. seems to be the only bigger site that uses it, and it's kind of a mess over there.

SteveArmstrong 15y ago

I don't see the OpenID here. I see them restricting me to only 4 third-party sites. Since there doing that, using OpenID or using each third party's system makes no difference. OpenID's supposed to be decentralized, but how do I log in with http://stevearm.com http://stevearm.com?