Hacker News Reader

Comment by StavrosK | Hacker News Reader

Come on, we already have a perfectly good protocol for this, OpenID. It's unfortunate how big companies try to lock users in their own authentication services rather than educate them about OpenID (although I think the new JanRain widgets turn OpenID into a "Connect with X" service, which is great).

View on HN

OpenID is not a perfectly good protocol. It is a total mess. Implementing it is an exercise in pulling teeth. Every major implementation was vulnerable to a timing attack until recently, which severely compromised the security of both sites which actually accept OpenID. The user experience is an abomination which requires users understand concepts which strike them like ancient Aramaic. Half of the spec, which you have to implement, is devoted to requirements put there for ideological reasons which no user is actually interested in (delegation). The core use case -- that any site on the website can ask for your holiest of holy credentials and you should just give them out -- appears to be the world's most widespread phishing attack, organized by sleeper agents planted on the spec committee whose dark masters tasked them with undermining everything we have ever taught users about password security.

Delegation is of great interest to anyone who runs their own web site but prefers to not run their own openid server.

(Won't touch the other trolling.)

Yes, but isn't the core use case the same with any third party identification service, such as Facebook Connect or MS Passport or whatever?

Unfortunately, OpenId is too complicated for most folks. paste in your url? c'mon. Even Brad Fitzpatrick realizes this:

http://code.google.com/p/webfinger/

"People have been trying to use URLs as identifiers for people (as OpenID does), as it has great readability/discoverability properties, but this effort has largely failed because of UI/UX design failings, user confusion about URLs, etc."

You don't have to, there are widgets you can use where you just select your provider and enter your username, and everything's done.

good point, looks like stack overflow does this pretty well. there's also https://www.idselector.com and http://wiki.openid.net/Gallery

OpenID integration doesn't create an easy way for end users to share their likes with hundreds of Facebook friends who read newsfeeds on a daily basis, or tell you that 30 of your friends have become members. Love it or loathe it, there's a big value-add for marketers (and depending on the application, possibly also end-users) to Facebook Connect over a simple universal authentication system.

As others have pointed out, OpenID isn't even better than Facebook at what it specialises in: at best OpenID asks the user to remember whether they signed up with their Yahoo ID or their Gmail one and at worst to read a third-party FAQ just to figure out how to log in. Facebook Connect is a big blue button with a recognisable brand, and you're quite possibly already logged in.

If only their API wasn't such a piece of shit...

It's too bad OpenID isn't cool. The Social Network movie is just going to exacerbate people's infatuation with Facebook and social networking in my opinion. This will lead to the common person being even more accepting of Facebook becoming ubiquitous across the internet. The side benefit of the movie though is that I am finding girls are much more into me talking about working as programmer at the bar...

Yeah, I think that's its biggest "failure". Facebook is something everyone knows, so they think "oh, Connect button, cool". It's a shame, really.

Unless someone writes a Facebook <-> OpenID bridge, anyway.

Reply on news.ycombinator.com