4 ms·

Ask YC: Who uses OpenID?

9 points by manvsmachine 19y ago

With all the talk of open APIs and data portability going on in the news, who here either currently uses or plans to implement OpenID, OAuth, etc; and, for those that don't, why not?

bugmenot 19y ago
I use OpenID and it's frustrating that websites don't accept it. On this website, for example, I was forced to use BugMeNot. Why? I don't like being forced into this position.
- bugmenot 19y ago
  Probably not a good idea... http://www.bugmenot.com/view/news.ycombinator.com http://www.bugmenot.com/view/news.ycombinator.com
  - bugmenot 19y ago
    I'm a buffoon.
    - ivankirigin 19y ago
      I couldn't have said it better myself.
- dcurtis 19y ago
  You were "forced" to use bugmenot? Why not just choose a unique ID? I don't understand some of these people who are hyper-security-conscious to the point of insanity. It affects their enjoyment of the internet.
buss 19y ago
I don't have any plans to ever support it. I think it's an ill-conceived system that teaches users to fall prey to identity theft.
- tlrobinson 19y ago
  How so? I think that users do need to be educated to not enter their passwords until they're redirected to their identity provider (and to confirm their "SiteKey" if the provider supports it). But it hardly "teaches users to fall prey to identity theft". The fact is that most users end up using the same passwords over and over again. Most websites (ecommerce and banks excluded) don't bother using any sort of encryption for logging in at all. OpenID goes a long way to lessen those risks. Additionally, integration into browsers could eliminate the risk of phishing.
  - mechanical_fish 19y ago
    The fact is that most users end up using the same passwords over and over again. I'm not sure, but it may be better to take the chance that the user has only one password, than to give that user an OpenID account and remove all doubt.
    - tlrobinson 19y ago
      That's the point. It's inevitable because we're human, we can't remember hundreds of different passwords. Why not allow the user the connivence of logging in once using a single password, and at the same time improve the overall security? With OpenID, your password is only ever entered in one place: the OpenID provider's login page. When another site wishes to authenticate you it redirects you to your provider where you enter your password then get redirected back to the original site along with a token proving you have authenticated and granted authorization to the site. The most important thing is that you use a provider that you trust. A good OpenID provider can actually help prevent phishing and identity theft. For example, myopenid.com (and probably others) lets you select a personalized image that is displayed whenever you're prompted for your password (much like Bank of America and other banks' "SiteKey") and you're supposed to train yourself to never enter your password unless you see the correct image, to prevent phishing (though most of us are smart enough to look at the URL too). They also provide a comprehensive log of every site which has authenticated using your account, so if your password has been compromised it is very easy to find out. By the way, OpenID doesn't require you authenticate to your provider with a password. It could be done via a SecurID token, or even biometrics. Passwords just happen to be the simplest and most common method.
simonw 19y ago
I've implemented it, and I use it on a handful of sites that support it (various blogs, Highrise, BlinkSale).
nickb 19y ago
From what my friends have experienced with their sites, I'd say you're better off with putting your time in doing something else. OpenID is LONG way off from becoming mainstream. On consumer sites, it's RARELY used, unfortunately.
- dcurtis 19y ago
  I'd say that the lack of OpenID on consumer sites is fortunate, because it would just confuse 95% of people. It confuses some geeky/internet-savvy people too, just because of the horrifically bad implementation and design of the OpenID system.
  - thorax 19y ago
    I really, really, really wish it was better. :(
mechanical_fish 19y ago
I think it's important not to confuse OAuth with OpenID. I think OAuth might be very useful indeed, and I'd like to see it succeed. Tying it to the Titanic will not help. I have finally found one clear use case for OpenID: sending out login passwords to newly hired consultants without using cleartext email. Of course, this isn't the kind of killer app that will make OpenID a household word. Among other things, OpenID is: confusing even to geeks, not especially secure, not solving a particularly important problem, an open-ended set of external dependencies on provider code that you do not control, very poorly branded (because, you know, everyone loves having their ID checked), poorly marketed, and often assumed to be something it isn't. From a site developer's standpoint, OpenID solves the wrong problem. Nobody is avoiding your site because they have to remember a password. That requirement hasn't killed eBay, Gmail, Amazon, PayPal, Facebook, Plentyoffish, HotOrNot, news.yc, or any other site in history. Frankly, if people are avoiding your site, it's probably because it sucks. Spend your time making your site suck less. A good way to make your site suck less is to eliminate the need for signups at all, to delay that need as long as possible, or to get the user so excited about the site that they barely notice the signup process. OpenID doesn't do these things. The problem with signups is not the typing, remembering the passwords, or even securing the passwords -- it's the mental overhead associated with deciding whether or not you want another relationship in your life. Can you trust this new site? Will it waste your time? Will it spam you? Will it hit you up for money, forcing you to feel embarassed as you say no over and over? Will your friends find out that you signed up on the site? Will the site plaster your Amazon purchase history all over the open Internet? Signing up for a site is exactly like making a new friend, and if you think it would be great to automatically be friends with everybody in the world, find a recent multimillion-dollar lottery winner and ask them what that's like. Managing your relationships takes thought, attention, and judgement. Nobody's automated that yet.
- christefano 19y ago
  Well said. Thank you.
- manvsmachine 19y ago
  Point taken. I did not mean to suggest that they are one and the same, just that they are both examples of measures that web services are taking to open their systems up. I agree that OAuth definitely seems to be inherently much more valuable.
tzury 19y ago
As open social will gain more popularity these kind of solutions will be necessary. OpenID is for your users, OAuth is for other sites and services you wish to communicate with, and DataPortability is for the whole thing being portable from one service to another. I don't believe the world will remain in the chaos it is at this moment and a unified open-standardized platform will be a must. Don't look who don't, be a pioneer and implement it. The major players will follow.
buckpost 19y ago
I've got an OpenID account but have rarely used it, probably because there are few places to actually use it.

9 points by manvsmachine 19y ago

With all the talk of open APIs and data portability going on in the news, who here either currently uses or plans to implement OpenID, OAuth, etc; and, for those that don't, why not?

bugmenot 19y ago

I use OpenID and it's frustrating that websites don't accept it. On this website, for example, I was forced to use BugMeNot. Why? I don't like being forced into this position.

bugmenot 19y ago
Probably not a good idea... http://www.bugmenot.com/view/news.ycombinator.com http://www.bugmenot.com/view/news.ycombinator.com
- bugmenot 19y ago
  I'm a buffoon.
  - ivankirigin 19y ago
    I couldn't have said it better myself.
dcurtis 19y ago
You were "forced" to use bugmenot? Why not just choose a unique ID? I don't understand some of these people who are hyper-security-conscious to the point of insanity. It affects their enjoyment of the internet.

buss 19y ago

I don't have any plans to ever support it. I think it's an ill-conceived system that teaches users to fall prey to identity theft.

tlrobinson 19y ago
How so? I think that users do need to be educated to not enter their passwords until they're redirected to their identity provider (and to confirm their "SiteKey" if the provider supports it). But it hardly "teaches users to fall prey to identity theft". The fact is that most users end up using the same passwords over and over again. Most websites (ecommerce and banks excluded) don't bother using any sort of encryption for logging in at all. OpenID goes a long way to lessen those risks. Additionally, integration into browsers could eliminate the risk of phishing.
- mechanical_fish 19y ago
  The fact is that most users end up using the same passwords over and over again. I'm not sure, but it may be better to take the chance that the user has only one password, than to give that user an OpenID account and remove all doubt.
  - tlrobinson 19y ago
    That's the point. It's inevitable because we're human, we can't remember hundreds of different passwords. Why not allow the user the connivence of logging in once using a single password, and at the same time improve the overall security? With OpenID, your password is only ever entered in one place: the OpenID provider's login page. When another site wishes to authenticate you it redirects you to your provider where you enter your password then get redirected back to the original site along with a token proving you have authenticated and granted authorization to the site. The most important thing is that you use a provider that you trust. A good OpenID provider can actually help prevent phishing and identity theft. For example, myopenid.com (and probably others) lets you select a personalized image that is displayed whenever you're prompted for your password (much like Bank of America and other banks' "SiteKey") and you're supposed to train yourself to never enter your password unless you see the correct image, to prevent phishing (though most of us are smart enough to look at the URL too). They also provide a comprehensive log of every site which has authenticated using your account, so if your password has been compromised it is very easy to find out. By the way, OpenID doesn't require you authenticate to your provider with a password. It could be done via a SecurID token, or even biometrics. Passwords just happen to be the simplest and most common method.

simonw 19y ago

I've implemented it, and I use it on a handful of sites that support it (various blogs, Highrise, BlinkSale).

nickb 19y ago

From what my friends have experienced with their sites, I'd say you're better off with putting your time in doing something else. OpenID is LONG way off from becoming mainstream. On consumer sites, it's RARELY used, unfortunately.

dcurtis 19y ago
I'd say that the lack of OpenID on consumer sites is fortunate, because it would just confuse 95% of people. It confuses some geeky/internet-savvy people too, just because of the horrifically bad implementation and design of the OpenID system.
- thorax 19y ago
  I really, really, really wish it was better. :(

mechanical_fish 19y ago

I think it's important not to confuse OAuth with OpenID. I think OAuth might be very useful indeed, and I'd like to see it succeed. Tying it to the Titanic will not help. I have finally found one clear use case for OpenID: sending out login passwords to newly hired consultants without using cleartext email. Of course, this isn't the kind of killer app that will make OpenID a household word. Among other things, OpenID is: confusing even to geeks, not especially secure, not solving a particularly important problem, an open-ended set of external dependencies on provider code that you do not control, very poorly branded (because, you know, everyone loves having their ID checked), poorly marketed, and often assumed to be something it isn't. From a site developer's standpoint, OpenID solves the wrong problem. Nobody is avoiding your site because they have to remember a password. That requirement hasn't killed eBay, Gmail, Amazon, PayPal, Facebook, Plentyoffish, HotOrNot, news.yc, or any other site in history. Frankly, if people are avoiding your site, it's probably because it sucks. Spend your time making your site suck less. A good way to make your site suck less is to eliminate the need for signups at all, to delay that need as long as possible, or to get the user so excited about the site that they barely notice the signup process. OpenID doesn't do these things. The problem with signups is not the typing, remembering the passwords, or even securing the passwords -- it's the mental overhead associated with deciding whether or not you want another relationship in your life. Can you trust this new site? Will it waste your time? Will it spam you? Will it hit you up for money, forcing you to feel embarassed as you say no over and over? Will your friends find out that you signed up on the site? Will the site plaster your Amazon purchase history all over the open Internet? Signing up for a site is exactly like making a new friend, and if you think it would be great to automatically be friends with everybody in the world, find a recent multimillion-dollar lottery winner and ask them what that's like. Managing your relationships takes thought, attention, and judgement. Nobody's automated that yet.

christefano 19y ago
Well said. Thank you.
manvsmachine 19y ago
Point taken. I did not mean to suggest that they are one and the same, just that they are both examples of measures that web services are taking to open their systems up. I agree that OAuth definitely seems to be inherently much more valuable.

tzury 19y ago

As open social will gain more popularity these kind of solutions will be necessary. OpenID is for your users, OAuth is for other sites and services you wish to communicate with, and DataPortability is for the whole thing being portable from one service to another. I don't believe the world will remain in the chaos it is at this moment and a unified open-standardized platform will be a must. Don't look who don't, be a pioneer and implement it. The major players will follow.

buckpost 19y ago

I've got an OpenID account but have rarely used it, probably because there are few places to actually use it.