4 ms·

You're not using OpenID if you do this, you're using Google's id. It's fine if that's what you expose by default, but you really do need to give the user a che

You're not using OpenID if you do this, you're using Google's id. It's fine if that's what you expose by default, but you really do need to give the user a checkbox or something so they can input their own if they have one. I have an OpenID I use everywhere, if I come to one of your sites and end up using my google ID instead it will cause me nothing but frustration and end up being less secure. In fact I'd probably not login to your site because of this if I didn't have a compelling reason to do so.

yangman 17y ago
This is still OpenID. Google uses a singular URL for all identities that OpenID consumers use to discover the true user identity, which is unique per user per consumer domain.
- zargon 17y ago
  If it only accepts google logins, then it doesn't matter if google is using openid as the mechanism -- you can't say you use openid logins. It's like if I said that my application supports CSV, but you have to provide it as an Excel file.
nir 17y ago
I'm using Google ID, but the technology that enables this is OpenID. It's just under the hood, which IMHO is where it should be. Most users have no idea what OpenID is, and are confused when they are asked for a URL in order to sign up. Even for an OpenID-savvy user, why would it be frustrating or less secure to login via Google? If someone got my Gmail password, sites like mine would be the least of my worries..
- zargon 17y ago
  Because I don't have a google account. But I do run my own openid provider.
  - nir 17y ago
    I'd say that's an edge case, but still - sites that don't support OpenID would require you to create login. This method basically asks you to create that login with Google instead, is more secure than most of these sites.
- djcapelis 17y ago
  Because my preferred openid provider uses client-side SSL certs to authenticate me, google doesn't. Part of the point of openid is it allows me to implement security procedures you haven't thought of without making me beg every site I use to do things the way I want.

yangman 17y ago

This is still OpenID. Google uses a singular URL for all identities that OpenID consumers use to discover the true user identity, which is unique per user per consumer domain.

zargon 17y ago
If it only accepts google logins, then it doesn't matter if google is using openid as the mechanism -- you can't say you use openid logins. It's like if I said that my application supports CSV, but you have to provide it as an Excel file.

nir 17y ago

I'm using Google ID, but the technology that enables this is OpenID. It's just under the hood, which IMHO is where it should be. Most users have no idea what OpenID is, and are confused when they are asked for a URL in order to sign up. Even for an OpenID-savvy user, why would it be frustrating or less secure to login via Google? If someone got my Gmail password, sites like mine would be the least of my worries..

zargon 17y ago
Because I don't have a google account. But I do run my own openid provider.
- nir 17y ago
  I'd say that's an edge case, but still - sites that don't support OpenID would require you to create login. This method basically asks you to create that login with Google instead, is more secure than most of these sites.
djcapelis 17y ago
Because my preferred openid provider uses client-side SSL certs to authenticate me, google doesn't. Part of the point of openid is it allows me to implement security procedures you haven't thought of without making me beg every site I use to do things the way I want.