6 ms·

OpenID: Now more powerful and easier to use

120 points by adamhowell 17y ago

mahmud 17y ago
Please upvote to give the standards more exposure. Yahoo, Google and MySpace are supporting the spanking new OpenID OAuth Extension protocol. I have this on my plate at this exact moment, I am not sure how long it will take them to support this, but for now, I found Yahoo's Contacts API to be the easiest, and Facebook's Registration/SSO to be the hardest. This is what my todo list looks like: 1) Visit all these websites: http://knowem.com/ http://knowem.com/ 2) See which ones have authentication API 3) Implement them. 4) ???
- gruseom 17y ago
  5) Profit. You left me no choice.
- dcurtis 17y ago
  Are you sure you want OpenID to get more exposure? It already failed once due to hideously poor execution and terrible usability problems. Attaching oauth doesn't seem to solve any of the big problems. It just masks them behind a protocol that works decently on it's own. The OpenID promise sounds good in a geeky, technical sense, but judging from their past work, I do not trust the OpenID group to build anything remotely viable.
  - jmillikin 17y ago
    OpenID hasn't failed at all -- I've been noticing more and more sites allowing sign-ins using it, and even a few (primarily for tech audiences) which are OpenID-only. Of course, there are a few sites which claim OpenID support but implement it poorly (such as news.yc), but that's not a reflection on the protocol.
    - dcurtis 17y ago
      I do not consider getting a tiny subset of the tech audience using OpenID a case for it being a success. In fact, it did that years ago and has gone nowhere since.
      - jmillikin 17y ago
        OpenID 2, which was the first version intended to be broadly useful outside of LiveJournal, was published less than two years ago. In that time, OpenID has gained support from every major identity provider and most major consumers. Anybody who uses LiveJournal, Wordpress, StackOverflow, or thousands of other sites can use OpenID instead of a traditional login.
        Andys 17y ago
        Reality check: "most" major consumers is going too far
        codemechanic 17y ago
        http://www.codelathe.com/blog/index.php/2009/08/25/announcing-tonido-openid-truly-decentralized-identity-management/ http://www.codelathe.com/blog/index.php/2009/08/25/announcin.... Check out Tonido OpenID. It is a truly a decentralized, private OpenID provider.
      - StrawberryFrog 17y ago
        You're making a case that OpenId hasn't succeeded yet. that's not the same as making a case that it has failed. Of course, success is subjective and relative. I see a little success every time I log in to stackOverflow via OpenId, or get a OpenId guest comment on LiveJournal.
  - mscarborough 17y ago
    Yes, I would like OpenID to get more exposure. Not just because I spent time implementing it for our site the first time around--they addressed the execution and usability problems with this new work, and I think it will be much more useful for non-technical users. The OpenID Foundation folks did not just bolt OAuth onto the side and call it a day. One of the key new features is a protocol that allows the ability to stay on-site within a popup or other login, rather than being redirected to a third party, then back to your intended site. I have not read the code yet to see exactly how it's different, but it seems to strengthen the attribute exchange as well for profile-type information. Most of the OpenID providers I've used are wildly divergent in how (and how many) attributes are exchangeable with the OpenID consuming site. Do you not see these as fruitful improvements to the protocol?
simonw 17y ago
This feels to me like OpenID finally coming of age - the OpenID+OAuth hybrid protocol means you can one-click sign in to a site and simultaneously grant it access to an OAuth protected resource such as your address book. From what I've heard it usability tests extremely well too.
- avibryant 17y ago
  We've been using it for trendly.com and yes, it seems very usable. I didn't know about the popup option, though, I'll have to try that.
Kaizyn 17y ago
OpenID needs to hurry up and die so efforts will not continue to be wasted either pushing for OpenID or trying to support it. That way, work can begin in earnest on the next standard protocol that will replace it.
luigi 17y ago
Once WebFinger is widely supported (that is, using an email address as an OpenID instead of a URL), the OpenStack will be ready for the masses.
- jmillikin 17y ago
  Using an email address for your OpenID is already possible, assuming your provider supports it. I haven't seen any great rush to support email OpenIDs, though, so it could be that most email providers just don't care.
old-gregg 17y ago
I know very little about OpenID and, lacking knowledge, I've been avoiding it as a user. I've tried reading up on it but the sites/tutorials I looked at were excessively vague, wordy and I got an impression that I don't want to use OpenID for myself. HN audience, however, seems quite favourable to the standard though, so I'm willing to accept that my initial reaction was a wrong one. Can you recommend a good reading on the current state of OpenID, with emphasis on security please? Thanks.
- sp332 17y ago
  The idea of OpenID is that you can use any OpenID provider you want, google or yahoo or facebook or run your own, so security generally depends on which server you choose. There are some brain-dead simple options for end-users. For example, just type your Blogger address (e.g. sep332.blogspot.com), you'll be redirected to log in to your Google account. The server just vouches for your identity.
- ludwig 17y ago
  As a user, I typically love encountering sites that are OpenID enabled (stackoverflow, gitorious, ...) since then I can use my livejournal account to login. This way I don't have to manage yet another username/random-password pair.
  - chrischen 17y ago
    For many of these sites they might as well not have you login at all and allow you to do whatever they let you do with OpenID, since after logging in they only get a unique identifier (not even an email address, am I correct?).
    - ludwig 17y ago
      I see where you're getting at, but I think it's more of an issue of keeping your digital identity intact rather than fragmented over multiple accounts. I can authenticate at a single place, and that server can vouch for me on other sites ("Yeah, he's good to go. He logged in with me. It's him and not some other user."). With some sites you could get away with no login (see 4chan where everyone is anonymous), but for discussion sites that rely on reputation (stackoverflow, reddit, hackernews, etc.) that's not really ideal. Security-wise, you have the added advantage of not having to manage multiple passwords. You could use a single password for all your sites, but then your password exposure would be too high, since a breach in any of those N websites could potentially capture that one password of yours. With OpenID, those sites wouldn't even be getting my password.
aw3c2 17y ago
I do not use OpenID for privacy reasons. All accounts are using different names and I don't sites to know that "this person A" and "that person B" are in fact the same. It's no one's business.
- wmf 17y ago
  This is a solved problem: http://willnorris.com/2009/07/openid-directed-identity-identifier-select http://willnorris.com/2009/07/openid-directed-identity-ident...
- simonw 17y ago
  If you're worried about sites conspiring behind your back to join your identities together, I take it you use a different e-mail address on every site you sign in to as well?
wvenable 17y ago
I'm sorry, I still don't see the advantage of OpenID. Can anyone explain why it's any more convenient than username/password? I still haven't bothered to sign up for StackOverflow because the signup seemed far more complicated than it is for just about any other Web 2.0 site.
- simonw 17y ago
  You don't need to invent a brand new password for each site you sign up for, but it's more secure than reusing the same password on every site. The new OpenID+OAuth hybrid protocol described in the linked article greatly improves convenience by allowing a site you are signing in to to request access to e.g. your contact list at the same time - so two clicks and you're logged in and have granted access to further information. http://trendly.com/ http://trendly.com/ is a great example of this flow in action.
  - wvenable 17y ago
    It sounds like a solution in search of a problem. I don't really need security for my slashdot account or hacker news. Now combining with OAuth is interesting, but I don't have a "contact list" anywhere. I don't really have any information that I need (or want) to share between sites. It's definitely a cool option though, so I won't bemoan it's existence. However, I am annoyed at sites that require OpenID without the standard alternative.
- wmf 17y ago
  You don't have to type your password as often, remember as many passwords (if you would use different ones for different sites), or keep passwords in sync (if you would use the same password at many sites).
  - wvenable 17y ago
    All the sites I visit remember my password. My browser remembers my password on top of that. My browser is synced to all my other browsers, etc. Given the StackOverflow example, it would take exactly 5 seconds to type in my usual username and unsecure password and start using the site. The whole Open ID thing seems like a hell of lot more work.
jongraehl 17y ago
Has anyone seen a site claiming to use OpenID but actually phishing with a redirect to a similar-looking URL (e.g. typo-domains of google/yahoo/etc.) to grab your password? I always check the URL before entering my credentials, but there's always the risk of similar looking glyphs at a different code point (is Unicode allowed in domain names yet?), or just typo-blindness.
deleted 17y ago
[deleted]

120 points by adamhowell 17y ago

Please upvote to give the standards more exposure. Yahoo, Google and MySpace are supporting the spanking new OpenID OAuth Extension protocol. I have this on my plate at this exact moment, I am not sure how long it will take them to support this, but for now, I found Yahoo's Contacts API to be the easiest, and Facebook's Registration/SSO to be the hardest. This is what my todo list looks like: 1) Visit all these websites: http://knowem.com/ http://knowem.com/ 2) See which ones have authentication API 3) Implement them. 4) ???

gruseom 17y ago
5) Profit. You left me no choice.
dcurtis 17y ago
Are you sure you want OpenID to get more exposure? It already failed once due to hideously poor execution and terrible usability problems. Attaching oauth doesn't seem to solve any of the big problems. It just masks them behind a protocol that works decently on it's own. The OpenID promise sounds good in a geeky, technical sense, but judging from their past work, I do not trust the OpenID group to build anything remotely viable.
- jmillikin 17y ago
  OpenID hasn't failed at all -- I've been noticing more and more sites allowing sign-ins using it, and even a few (primarily for tech audiences) which are OpenID-only. Of course, there are a few sites which claim OpenID support but implement it poorly (such as news.yc), but that's not a reflection on the protocol.
  - dcurtis 17y ago
    I do not consider getting a tiny subset of the tech audience using OpenID a case for it being a success. In fact, it did that years ago and has gone nowhere since.
    - jmillikin 17y ago
      OpenID 2, which was the first version intended to be broadly useful outside of LiveJournal, was published less than two years ago. In that time, OpenID has gained support from every major identity provider and most major consumers. Anybody who uses LiveJournal, Wordpress, StackOverflow, or thousands of other sites can use OpenID instead of a traditional login.
      - Andys 17y ago
        Reality check: "most" major consumers is going too far
      - codemechanic 17y ago
        http://www.codelathe.com/blog/index.php/2009/08/25/announcing-tonido-openid-truly-decentralized-identity-management/ http://www.codelathe.com/blog/index.php/2009/08/25/announcin.... Check out Tonido OpenID. It is a truly a decentralized, private OpenID provider.
    - StrawberryFrog 17y ago
      You're making a case that OpenId hasn't succeeded yet. that's not the same as making a case that it has failed. Of course, success is subjective and relative. I see a little success every time I log in to stackOverflow via OpenId, or get a OpenId guest comment on LiveJournal.
- mscarborough 17y ago
  Yes, I would like OpenID to get more exposure. Not just because I spent time implementing it for our site the first time around--they addressed the execution and usability problems with this new work, and I think it will be much more useful for non-technical users. The OpenID Foundation folks did not just bolt OAuth onto the side and call it a day. One of the key new features is a protocol that allows the ability to stay on-site within a popup or other login, rather than being redirected to a third party, then back to your intended site. I have not read the code yet to see exactly how it's different, but it seems to strengthen the attribute exchange as well for profile-type information. Most of the OpenID providers I've used are wildly divergent in how (and how many) attributes are exchangeable with the OpenID consuming site. Do you not see these as fruitful improvements to the protocol?

simonw 17y ago

This feels to me like OpenID finally coming of age - the OpenID+OAuth hybrid protocol means you can one-click sign in to a site and simultaneously grant it access to an OAuth protected resource such as your address book. From what I've heard it usability tests extremely well too.

avibryant 17y ago
We've been using it for trendly.com and yes, it seems very usable. I didn't know about the popup option, though, I'll have to try that.

Kaizyn 17y ago

OpenID needs to hurry up and die so efforts will not continue to be wasted either pushing for OpenID or trying to support it. That way, work can begin in earnest on the next standard protocol that will replace it.

luigi 17y ago

Once WebFinger is widely supported (that is, using an email address as an OpenID instead of a URL), the OpenStack will be ready for the masses.

jmillikin 17y ago
Using an email address for your OpenID is already possible, assuming your provider supports it. I haven't seen any great rush to support email OpenIDs, though, so it could be that most email providers just don't care.

old-gregg 17y ago

I know very little about OpenID and, lacking knowledge, I've been avoiding it as a user. I've tried reading up on it but the sites/tutorials I looked at were excessively vague, wordy and I got an impression that I don't want to use OpenID for myself. HN audience, however, seems quite favourable to the standard though, so I'm willing to accept that my initial reaction was a wrong one. Can you recommend a good reading on the current state of OpenID, with emphasis on security please? Thanks.

sp332 17y ago
The idea of OpenID is that you can use any OpenID provider you want, google or yahoo or facebook or run your own, so security generally depends on which server you choose. There are some brain-dead simple options for end-users. For example, just type your Blogger address (e.g. sep332.blogspot.com), you'll be redirected to log in to your Google account. The server just vouches for your identity.
ludwig 17y ago
As a user, I typically love encountering sites that are OpenID enabled (stackoverflow, gitorious, ...) since then I can use my livejournal account to login. This way I don't have to manage yet another username/random-password pair.
- chrischen 17y ago
  For many of these sites they might as well not have you login at all and allow you to do whatever they let you do with OpenID, since after logging in they only get a unique identifier (not even an email address, am I correct?).
  - ludwig 17y ago
    I see where you're getting at, but I think it's more of an issue of keeping your digital identity intact rather than fragmented over multiple accounts. I can authenticate at a single place, and that server can vouch for me on other sites ("Yeah, he's good to go. He logged in with me. It's him and not some other user."). With some sites you could get away with no login (see 4chan where everyone is anonymous), but for discussion sites that rely on reputation (stackoverflow, reddit, hackernews, etc.) that's not really ideal. Security-wise, you have the added advantage of not having to manage multiple passwords. You could use a single password for all your sites, but then your password exposure would be too high, since a breach in any of those N websites could potentially capture that one password of yours. With OpenID, those sites wouldn't even be getting my password.

aw3c2 17y ago

I do not use OpenID for privacy reasons. All accounts are using different names and I don't sites to know that "this person A" and "that person B" are in fact the same. It's no one's business.

wmf 17y ago
This is a solved problem: http://willnorris.com/2009/07/openid-directed-identity-identifier-select http://willnorris.com/2009/07/openid-directed-identity-ident...
simonw 17y ago
If you're worried about sites conspiring behind your back to join your identities together, I take it you use a different e-mail address on every site you sign in to as well?

wvenable 17y ago

I'm sorry, I still don't see the advantage of OpenID. Can anyone explain why it's any more convenient than username/password? I still haven't bothered to sign up for StackOverflow because the signup seemed far more complicated than it is for just about any other Web 2.0 site.

simonw 17y ago
You don't need to invent a brand new password for each site you sign up for, but it's more secure than reusing the same password on every site. The new OpenID+OAuth hybrid protocol described in the linked article greatly improves convenience by allowing a site you are signing in to to request access to e.g. your contact list at the same time - so two clicks and you're logged in and have granted access to further information. http://trendly.com/ http://trendly.com/ is a great example of this flow in action.
- wvenable 17y ago
  It sounds like a solution in search of a problem. I don't really need security for my slashdot account or hacker news. Now combining with OAuth is interesting, but I don't have a "contact list" anywhere. I don't really have any information that I need (or want) to share between sites. It's definitely a cool option though, so I won't bemoan it's existence. However, I am annoyed at sites that require OpenID without the standard alternative.
wmf 17y ago
You don't have to type your password as often, remember as many passwords (if you would use different ones for different sites), or keep passwords in sync (if you would use the same password at many sites).
- wvenable 17y ago
  All the sites I visit remember my password. My browser remembers my password on top of that. My browser is synced to all my other browsers, etc. Given the StackOverflow example, it would take exactly 5 seconds to type in my usual username and unsecure password and start using the site. The whole Open ID thing seems like a hell of lot more work.

jongraehl 17y ago

Has anyone seen a site claiming to use OpenID but actually phishing with a redirect to a similar-looking URL (e.g. typo-domains of google/yahoo/etc.) to grab your password? I always check the URL before entering my credentials, but there's always the risk of similar looking glyphs at a different code point (is Unicode allowed in domain names yet?), or just typo-blindness.

deleted 17y ago

[deleted]