3 ms·
Most don't. Some do. For those who don't it shouldn't matter whatever they're using (some third party account or a personal certificate or a saved password) to
by drdaeman 13y ago
Most don't. Some do.
For those who don't it shouldn't matter whatever they're using (some third party account or a personal certificate or a saved password) to authenticate. They click "login" and they get what they want.
For a minority of those who do, leasing their identity from a third party probably don't looks like a good idea.
- maxerickson 13y agoSure, but if the question is between medium value sites leaning on sending emails to control accounts and medium value sites leaning on persona for identity assertions, there aren't really any new issues, and all those people get rid of some passwords. It doesn't solve your problems, but it doesn't make them significantly worse and it is a step forward for most people. (I actually think the use of an email address in persona is genius, anybody who wanted valid email addresses would never consume something like OpenID)
- dochtman 13y agoOn the other hand, those people can mostly run their own IdP, so they depend on fewer/more trustable parties (just the DNS registrar, and their colo?), but still get the same user experience. Which I think is an important property: if you can come up with a better or more secure IdP experience, you can enter the ecosystem without the ecosystem (that is, Relying Parties) having to change anything. That's a huge win over the current state of login.