3 ms·

The fact that Clickpass even exists made me realize openID was DOA. I spent a day implementing openID for the users of my website, because I realized, hey, wha

by KevinMS 15y ago

The fact that Clickpass even exists made me realize openID was DOA. I spent a day implementing openID for the users of my website, because I realized, hey, what a cool idea, a URL can represent a single user on the internet, and that user can authenticate against it universally. The sad truth was that I could not expect a single one of my users to even understand what the hell was going on, because for most test openID accounts I set up on yahoo, etc, I couldn't figure out how to use them. Only the hand-holdy sites exclusively for openid even bothered to tell me what my personal URL was and how to use it. That was when I realized that Clickpass only exists because the implementation of OpenID was a total pooch screw. If the OpenID standard had required it be simple, like the URL must follow this template - google.com/openid/kevinms and yahoo.com/openid/kevinms, and the user just pasted this into the box, I think it might have been a success. But because they didn't, and they convoluted it more with the concept of your "unique identity on the internet", you need third party services, which are unnecessary layers that are completely confusing to the user.

ww520 15y ago
Good feedback on OpenId. What do you think of BrowserId?
justjohn 15y ago
I always thought that the problem with openID is they didn't use email addresses instead of URLs. e.g. use john@example.com and require a certain url template for the endpoint e.g. example.com/openid/john That way I don't have to remember another identifier and we already trust at least part of our identity to our email provider. Not perhaps as open, but much more approachable as a user.
- xp84 15y ago
  Hate that idea. I don't want to have to share my email address, in fact that's a primary reason why I always use my open ID (which is unrelated) when possible. Providing email as a credential creates an implicit, if not explicit, invitation "Here, spam me." This is why I'm generally against using email as an identifier. Other examples that all suck for this reason: Apple IDs. Windows Live ID. Jabber.
  - drivebyacct2 15y ago
    How do people operate in the 21st Century internet treating their email address as private? I've never been reserved about giving out my email address and I've never had a spam or harassment problem. Ever.
    - davidblair 15y ago
      Perception is far more important than reality. When online sales first took off, credit card theft was a huge concern. Even though nothing would go wrong for the vast majority of people fear was enough to make users and vendors go to great lengths to protect data. Not a perfect analogy but conceptually similar.
    - lrobb 15y ago
      Back in "the day", users were bombarded with warnings to never give out their email address, lest something bad happen... at one point in time, if you did post your email publicly, it would quickly become unusable as the spam tools & regulations were way behind the spammers. I'm sure there's still a huge contingent out there afraid of putting their email into the wild.
  - aconbere 15y ago
    This problem is tough to imagine with jabber where you control access through your roster. That is. They would then have to ask you permission to spam you.
  - MattJ100 15y ago
    > Other examples that all suck for this reason: Apple IDs. Windows Live ID. Jabber. Erm, to clarify, Jabber isn't an authentication system. It's a decentralized IM network, structured similarly to email. A user is identified by their username on a given host, just like email. It (sensibly, in my opinion) re-uses the same format for that, user@host (I don't think user!host would be quite as intuitive...). This does not mean a Jabber ID is an email address. It can be, but they are two distinct properties of any given identifier. So saying it 'sucks' because of the format of its identifiers happens to look like an email address, and some services choose to enable both email and IM on the same ID, is stretching it a bit.
- milkmiruku 15y ago
  Webfinger - http://en.wikipedia.org/wiki/Webfinger http://en.wikipedia.org/wiki/Webfinger - was created for e-mail-as-OpenID-login. I don't know why it hasn't taken off though.
- deleted 15y ago
  [deleted]

by KevinMS 15y ago

ww520 15y ago

Good feedback on OpenId. What do you think of BrowserId?

justjohn 15y ago

I always thought that the problem with openID is they didn't use email addresses instead of URLs. e.g. use john@example.com and require a certain url template for the endpoint e.g. example.com/openid/john That way I don't have to remember another identifier and we already trust at least part of our identity to our email provider. Not perhaps as open, but much more approachable as a user.

xp84 15y ago
Hate that idea. I don't want to have to share my email address, in fact that's a primary reason why I always use my open ID (which is unrelated) when possible. Providing email as a credential creates an implicit, if not explicit, invitation "Here, spam me." This is why I'm generally against using email as an identifier. Other examples that all suck for this reason: Apple IDs. Windows Live ID. Jabber.
- drivebyacct2 15y ago
  How do people operate in the 21st Century internet treating their email address as private? I've never been reserved about giving out my email address and I've never had a spam or harassment problem. Ever.
  - davidblair 15y ago
    Perception is far more important than reality. When online sales first took off, credit card theft was a huge concern. Even though nothing would go wrong for the vast majority of people fear was enough to make users and vendors go to great lengths to protect data. Not a perfect analogy but conceptually similar.
  - lrobb 15y ago
    Back in "the day", users were bombarded with warnings to never give out their email address, lest something bad happen... at one point in time, if you did post your email publicly, it would quickly become unusable as the spam tools & regulations were way behind the spammers. I'm sure there's still a huge contingent out there afraid of putting their email into the wild.
- aconbere 15y ago
  This problem is tough to imagine with jabber where you control access through your roster. That is. They would then have to ask you permission to spam you.
- MattJ100 15y ago
  > Other examples that all suck for this reason: Apple IDs. Windows Live ID. Jabber. Erm, to clarify, Jabber isn't an authentication system. It's a decentralized IM network, structured similarly to email. A user is identified by their username on a given host, just like email. It (sensibly, in my opinion) re-uses the same format for that, user@host (I don't think user!host would be quite as intuitive...). This does not mean a Jabber ID is an email address. It can be, but they are two distinct properties of any given identifier. So saying it 'sucks' because of the format of its identifiers happens to look like an email address, and some services choose to enable both email and IM on the same ID, is stretching it a bit.
milkmiruku 15y ago
Webfinger - http://en.wikipedia.org/wiki/Webfinger http://en.wikipedia.org/wiki/Webfinger - was created for e-mail-as-OpenID-login. I don't know why it hasn't taken off though.
deleted 15y ago
[deleted]