9 ms·

One of the reasons FB and Twitter OAuth became so popular is because they solved a problem for the user (remembering passwords) and also gave the site owner a b

One of the reasons FB and Twitter OAuth became so popular is because they solved a problem for the user (remembering passwords) and also gave the site owner a big carrot (social growth mechanics, more user data). This seems much more one sided -- it's good for the user that doesn't use FB or Twitter but 'meh' for the website. I'm not sure we'll see fast adoption like we have for OAuth.

alberich 14y ago
More power to the user is good. Current IdM solutions leak too much data to the service providers/relying parties. What really sucks about all solutions is that once the data has leaked, you gotta trust the service providers not to sell or give your data away.
- richardw 14y ago
  I've wondered about "data-renting" setups before. For example, rather than giving a company my postal address, give them a token they can send to, and a post fulfilment company delivers to the actual address. If the address moves, the token follows. If I decided to revoke the token, they can't send me mail. Can't do that with all digital data, but you could with e.g. email addresses, cc's, addresses, maybe phone numbers.
  - icebraining 14y ago
    That's been possible with email addresses for decades. "Free email forwarding" returns plenty of services which give you an address that forwards to your own, and which you can revoke at any time. Personally, I just use a catch-all on my domain, but that requires you to have one. Same with credit cards: my bank offers a free service where I can set up as many virtual CCs as I want. Until recently they were single payment only, but now you can choose if it's single or multiple. Forwarding (physical) address exist too, 'though they seem to be mainly targeted at people outside the US who want a address there, and they cost you an extra shipping fee, of course.
callahad 14y ago
One of the biggest wins for sites is that we reduce account creation / sign in friction for your users, so you get an awesome, easy flow through your funnel without having to give up ownership of your user data. We also let you reach many, many more people, since you're not forcing users into joining an anointed social network. Everyone has an email address, and people understand what it means to reveal it. Also, there's no lock-in, because we're not giving you an opaque, one-way identifier for your users. Instead, you always get a verified email address. Want to switch away from Persona? Add a 'password' column to your database and send a few emails. Edit: I should also note that we're really, really easy to implement. Like, roll-your-own-integration in less than 3 hours with zero previous experience easy. I want to see us become the de facto auth solution for weekend projects, but we're also a really nice option to put alongside your social login. If you're already offering Twitter and Facebook, why not provide a vendor-neutral option, too?
- saurik 14y ago
  Wait, it relies on email address? (quickly reads up on it.) ... and it doesn't have user identifiers other than the email address? That is not reasonable: normal people (as in, people who don't know much about what they are doing with computers) tend to have piles and piles of email addresses, none of which hold any canonical weight to them: they have email addresses from ISPs, from schools, from work, and they often have multiple email addresses from sevices like Gmail. If they lose track of one they just get another one (as email addresses aren't even important anyway), and they never remember which one they've used with any given site. I've even seen people purposely get a new email address every now and then as their way of dealing with spam and "people I don't want to talk to anymore". They don't think far ahead, so the notion that their email address from school will be retired a year after they graduate and given to someone else doesn't occur to them (and seemingly didn't occur to you either, as it undermines the argument that it is a reasonable way to do password resets): email addresses are about the worst possible (while still plausible) "unique" identifier you could have come up with. :( (And yes: this is coming from someone who has had a single canonical email address for over 15 years: I also run a popular website frequented by tens of millions of users, many of whom are non-technical customers, and I have had to realize that they are nothing like me.)
zerostar07 14y ago
Many websites just want an identifier, without having to torture the user by asking them to give a password. Facebook and twitter are not a good option for that. I don't want to know my users' facebook details and certainly don't want them to think i'm one of those crappy apps that post on their wall. Twitter is down more often than not as i 've noticed, and again, i dont want users to be uncomfortable about sharing their identity with my website. Plus, twitter and facebook won't be here forever and may be a fad. Imagine if people used their myspace handle to login to their bank account today. And facebook accounts get disabled/hacked much more often than, say, gmail. E-mail is much more signup-and-forget and nobody considers giving their email address a privacy violation. I see lots of complaints here about the technical aspects of browserid, yet i believe it's the most pragmatic approach one can take to rid the web from the dreaded password plague.

alberich 14y ago

More power to the user is good. Current IdM solutions leak too much data to the service providers/relying parties. What really sucks about all solutions is that once the data has leaked, you gotta trust the service providers not to sell or give your data away.

richardw 14y ago
I've wondered about "data-renting" setups before. For example, rather than giving a company my postal address, give them a token they can send to, and a post fulfilment company delivers to the actual address. If the address moves, the token follows. If I decided to revoke the token, they can't send me mail. Can't do that with all digital data, but you could with e.g. email addresses, cc's, addresses, maybe phone numbers.
- icebraining 14y ago
  That's been possible with email addresses for decades. "Free email forwarding" returns plenty of services which give you an address that forwards to your own, and which you can revoke at any time. Personally, I just use a catch-all on my domain, but that requires you to have one. Same with credit cards: my bank offers a free service where I can set up as many virtual CCs as I want. Until recently they were single payment only, but now you can choose if it's single or multiple. Forwarding (physical) address exist too, 'though they seem to be mainly targeted at people outside the US who want a address there, and they cost you an extra shipping fee, of course.

callahad 14y ago

One of the biggest wins for sites is that we reduce account creation / sign in friction for your users, so you get an awesome, easy flow through your funnel without having to give up ownership of your user data. We also let you reach many, many more people, since you're not forcing users into joining an anointed social network. Everyone has an email address, and people understand what it means to reveal it. Also, there's no lock-in, because we're not giving you an opaque, one-way identifier for your users. Instead, you always get a verified email address. Want to switch away from Persona? Add a 'password' column to your database and send a few emails. Edit: I should also note that we're really, really easy to implement. Like, roll-your-own-integration in less than 3 hours with zero previous experience easy. I want to see us become the de facto auth solution for weekend projects, but we're also a really nice option to put alongside your social login. If you're already offering Twitter and Facebook, why not provide a vendor-neutral option, too?

saurik 14y ago
Wait, it relies on email address? (quickly reads up on it.) ... and it doesn't have user identifiers other than the email address? That is not reasonable: normal people (as in, people who don't know much about what they are doing with computers) tend to have piles and piles of email addresses, none of which hold any canonical weight to them: they have email addresses from ISPs, from schools, from work, and they often have multiple email addresses from sevices like Gmail. If they lose track of one they just get another one (as email addresses aren't even important anyway), and they never remember which one they've used with any given site. I've even seen people purposely get a new email address every now and then as their way of dealing with spam and "people I don't want to talk to anymore". They don't think far ahead, so the notion that their email address from school will be retired a year after they graduate and given to someone else doesn't occur to them (and seemingly didn't occur to you either, as it undermines the argument that it is a reasonable way to do password resets): email addresses are about the worst possible (while still plausible) "unique" identifier you could have come up with. :( (And yes: this is coming from someone who has had a single canonical email address for over 15 years: I also run a popular website frequented by tens of millions of users, many of whom are non-technical customers, and I have had to realize that they are nothing like me.)

zerostar07 14y ago

Many websites just want an identifier, without having to torture the user by asking them to give a password. Facebook and twitter are not a good option for that. I don't want to know my users' facebook details and certainly don't want them to think i'm one of those crappy apps that post on their wall. Twitter is down more often than not as i 've noticed, and again, i dont want users to be uncomfortable about sharing their identity with my website. Plus, twitter and facebook won't be here forever and may be a fad. Imagine if people used their myspace handle to login to their bank account today. And facebook accounts get disabled/hacked much more often than, say, gmail. E-mail is much more signup-and-forget and nobody considers giving their email address a privacy violation. I see lots of complaints here about the technical aspects of browserid, yet i believe it's the most pragmatic approach one can take to rid the web from the dreaded password plague.