5 ms·

So this is essentially delegating authentication to the user's Email service. Delegating authentication seems like a good idea: fewer passwords to forget and mo

So this is essentially delegating authentication to the user's Email service. Delegating authentication seems like a good idea: fewer passwords to forget and more conveniene. So why not delegate to a proper authentication service like OpenID? (Seriously, that's a question: Why don't more people use OpenID? Is there something wrong with it?) http://openid.net/get-an-openid/what-is-openid/ http://openid.net/get-an-openid/what-is-openid/

dragonwriter 12y ago
> So this is essentially delegating authentication to the user's Email service. Delegating authentication seems like a good idea: fewer passwords to forget and more conveniene. So why not delegate to a proper authentication service like OpenID? Because the user is more likely to have email than OpenID, so delegating to an option of one or the other is more complex, and delegating to only the latter is limiting your market.
- donniezazen 12y ago
  Anyone who has a Gmail or Facebook account automatically has one. I really like Google+ sign-in on Android.
  - hansrodtang 12y ago
    Facebook and Google both use OAuth 2.0, not OpenID. Google used to support OpenID, but that feature is deprecated. They do seem to moving towards OpenID Connect though, which is just a identity layer on top of OAuth 2.0
- bjackman 12y ago
  But either way the user has to sign up to something. When you delegate to Email you still have to initially create an account with the site's specialised authentication system. You'd just replace that process with creating an OpenID account. But yeah, I guess saying "now go to this 3rd party website and create an OpenID account" is pretty ugly. I wonder if it's possible to have your own "sign up" page that's a proxy for creating an OpenID with a 3rd party provider?
  - giovannibajo1 12y ago
    From an UX standpoint, the problem with OpenID is that users are forced to remember and type URLs as usernames. People are likely to remember their email if they have one, but URLs are disappearing from user interfaces (see Chrome, Safari, Mobile Safari, etc.).
  - pauselaugh 12y ago
    Uh, no. A user probably already has email, thus it usually isn't required. Unlike openID
kbar13 12y ago
Mozilla Persona [0] is a similar system that IMO would work quite well, but unfortunately there is very little adoption. It's kind of weird and sad to think about quality/usability of software versus the adoption of said software. [0] https://www.mozilla.org/en-US/persona/ https://www.mozilla.org/en-US/persona/
- tim333 12y ago
  There was an interesting discussion of the problems of Persona here https://news.ycombinator.com/item?id=7243141 https://news.ycombinator.com/item?id=7243141 (this is kind of in the middle of a conversation but has the first post by Saurik which is the interesting bit)
nly 12y ago
OpenID is basically a permanent man-in-the-middle. It's otherwise great, so long as you don't mind your OpenID identity provider knowing about every site/service you use, and every time you choose to use them. Persona is a big step forward in that regard, but neither get around the fact that, in most cases, users are going to be entrusting control over a bunch of their accounts to a third party.
deleted 12y ago
[deleted]
flavor8 12y ago
OpenID Connect is what you'd want to support, not OpenID 2.0. Google, probably the largest OpenID provider, is shutting down OpenID 2.0 support altogether in a year, and has turned off access to new clients as of this month. Thus, issue 1: access to your app is suddenly reliant on a third party, who can at any point decide to turn that access off. Issue 2: tech-phobic people don't trust OpenID, OAuth, etc. I'm working with a client who wanted "single sign on" with a tolerated competitor in the same space (nonprofit, don't ask); that competitor's tech guy advocated for OpenID, and OpenID became a hard requirement. The problem: the client's membership fought tooth and nail throughout alpha & beta rollouts (change is scary. are we giving google/yahoo our information? we don't understand it. we're not a bank, why do we need tighter authentication? etc) and it was eventually scrapped in favor of a traditional login.

dragonwriter 12y ago

> So this is essentially delegating authentication to the user's Email service. Delegating authentication seems like a good idea: fewer passwords to forget and more conveniene. So why not delegate to a proper authentication service like OpenID? Because the user is more likely to have email than OpenID, so delegating to an option of one or the other is more complex, and delegating to only the latter is limiting your market.

donniezazen 12y ago
Anyone who has a Gmail or Facebook account automatically has one. I really like Google+ sign-in on Android.
- hansrodtang 12y ago
  Facebook and Google both use OAuth 2.0, not OpenID. Google used to support OpenID, but that feature is deprecated. They do seem to moving towards OpenID Connect though, which is just a identity layer on top of OAuth 2.0
bjackman 12y ago
But either way the user has to sign up to something. When you delegate to Email you still have to initially create an account with the site's specialised authentication system. You'd just replace that process with creating an OpenID account. But yeah, I guess saying "now go to this 3rd party website and create an OpenID account" is pretty ugly. I wonder if it's possible to have your own "sign up" page that's a proxy for creating an OpenID with a 3rd party provider?
- giovannibajo1 12y ago
  From an UX standpoint, the problem with OpenID is that users are forced to remember and type URLs as usernames. People are likely to remember their email if they have one, but URLs are disappearing from user interfaces (see Chrome, Safari, Mobile Safari, etc.).
- pauselaugh 12y ago
  Uh, no. A user probably already has email, thus it usually isn't required. Unlike openID

kbar13 12y ago

Mozilla Persona [0] is a similar system that IMO would work quite well, but unfortunately there is very little adoption. It's kind of weird and sad to think about quality/usability of software versus the adoption of said software. [0] https://www.mozilla.org/en-US/persona/ https://www.mozilla.org/en-US/persona/

tim333 12y ago
There was an interesting discussion of the problems of Persona here https://news.ycombinator.com/item?id=7243141 https://news.ycombinator.com/item?id=7243141 (this is kind of in the middle of a conversation but has the first post by Saurik which is the interesting bit)

nly 12y ago

OpenID is basically a permanent man-in-the-middle. It's otherwise great, so long as you don't mind your OpenID identity provider knowing about every site/service you use, and every time you choose to use them. Persona is a big step forward in that regard, but neither get around the fact that, in most cases, users are going to be entrusting control over a bunch of their accounts to a third party.

deleted 12y ago

[deleted]

flavor8 12y ago

OpenID Connect is what you'd want to support, not OpenID 2.0. Google, probably the largest OpenID provider, is shutting down OpenID 2.0 support altogether in a year, and has turned off access to new clients as of this month. Thus, issue 1: access to your app is suddenly reliant on a third party, who can at any point decide to turn that access off. Issue 2: tech-phobic people don't trust OpenID, OAuth, etc. I'm working with a client who wanted "single sign on" with a tolerated competitor in the same space (nonprofit, don't ask); that competitor's tech guy advocated for OpenID, and OpenID became a hard requirement. The problem: the client's membership fought tooth and nail throughout alpha & beta rollouts (change is scary. are we giving google/yahoo our information? we don't understand it. we're not a bank, why do we need tighter authentication? etc) and it was eventually scrapped in favor of a traditional login.