Comment by zaphar | Hacker News Reader

Comment by zaphar | Hacker News Reader

Parent Full thread

I sort of think the problem is that many people have multiple OpenId providers. It sort of reduces half the reason you want to use it. Originally OpenId was a way to have one authentication for multiple services on the net. However when you have a Google Account, A Facebook account, A Twitter account... problems start happening. Which one did you use to login to this service last time?

Part of the problem I think is that the providers don't act as consumers also. If I originally had an open id somewhere then why can't I use it for facebook, Google, Twitter, and whatever else. Each "Provider" that offers a service to me which I want forces me to get yet another OpenId. At this point I think I have rougly 4 different OpenId providers and with Google I have like 4 different id's. This gets unwieldy quick. The technology had promise but the way it was rolled out and adopted by various folks caused it to suck a little.

Now I need an OpenId manager in my browser like I needed a password manager before. How is this better?

"Now I need an OpenId manager in my browser like I needed a password manager before. How is this better?"

What you really need is delegation. In a webpage, place in the <head>:

    <link rel="openid.server" href="openID server URL" />
    <link rel="openid.delegate" href="openID server" />

with appropriate values.

My OpenID is "http://jerf.org". I delegate that to AOL right now, but I can change that to any provider transparently. (The ickiness of using AOL is mitigated by the trivial way in which I can change it; which of the corporate monstrosities auths me isn't very important, and of the various accounts I have they were the first to be a provider.)

Having this implemented by your metaphorical grandmother is obviously a problem.

Edit: And also, I'd observe that this solves your personal OpenID problem. It doesn't do a thing to solve the problem for a site trying to use OpenID, such as the original article author, because telling everyone to delegate like this is a boil-the-ocean solution in the context of cutting down support calls.

This will likely appeal to the identi.ca and diaspora crowd, but will not appeal to the facebook crowd.

there are two problems with OpenID.

  #1 the UX has been killed by committee more than once. ( i should know I worked on it. )
  
  #2 OpenID does not offer value for one, let alone many OpenIDs.

Whether we like it or not. We need to get activitystrea.ms and the browser vendors to probably make some collective bets on identity.

Password managers make some bets on input fields that use the password type to manage login pairs, but I think we need to take this further.

I think we need to start having browsers connect cookies and openid redirect flows to login pairs. I think we can observe openid login flows in the browser and... remember them! I think we can link that to a browser profile, and I think we can pair that to a cookie set. I think smart-identity-browsers can suggest OpenIDs and make OpenID NASCAR obsolete, or at-least auto create a popular field of buttons, rather than making that site specific.

This is probably not enough space to discuss in detail how I think the tech can mature. but i think it's obvious that the future of the web is mobile, and is identity based. these interfaces don't need to get a little bit simpler, they need to get a lot simpler. they need to work on mobile phones.

a lot of the work i have done on OpenID comes to naught when you try to copy that experience for mobile phones.

I find myself uncertain if you are actually replying to me, and if so, if you understand what I mean by delegation. I thought more people knew about this, but in the past few hours I continue to see a lot of comments that leads me to believe this is not common knowledge and that not everybody understood what delegation is.

When I give my open ID to a site (usually blogger.com to make a comment), I actually type in "jerf.org" after the http:// , with nothing else. I do not have a provider set up, which I looked into but is a pain in the bum, and, as it turns out, entirely unnecessary. Instead, the OpenID consumer hits the page I gave (my domain's front page, as it turns out), finds those tags, redirects to "whatever those tags say today", and then I log in that way. When I have successfully logged in with the delegated service, then I have successfully authenticated myself as "http://jerf.org". I say "whatever those tags say today" because if I change those tags on that page to delegate to Google, suddenly I can log in with Google, but I will still be authenticated as "http://jerf.org". If AOL, my current delegate, decides to get out of the OpenID business entirely, one minute with vim on my website allows me to move it somewhere else, again, all along, I'm "http://jerf.org". This layer of indirection solved all the problems I had with the idea.

I don't have "many" OpenIDs, the phrase of yours that led me to wonder if you (and perhaps others) aren't following me here. I have one: http://jerf.org. Of course like everybody else I can't even count the number of accounts I have with various OpenID providers, but I don't care; http://jerf.org is my OpenID, and will be until I no longer have the domain.

I also don't know why it would "appeal" to one of the crowds you listed, but not others. The crowd it "appeals" to is the crowd that has control over a website that includes the ability to set arbitrary tags into the heading of a webpage, rather than a pre-canned HTML template that can't be touched. Unfortunately, rather fewer people have websites with that amount of control than I'd like.

http://jerf.org is my OpenID, and will be until I no longer have the domain.

This is precisely my problem. I don't want to commit to maintaining a webpage at a given domain with a given set of headers for the rest of my life.

Imagine if OpenID had been designed in 1991. Perhaps it would have been called "GopherID". And I might still have my GopherID from 1991, provided I had kept up the Gopher server that was delegating it, and could find another (trustworthy!) person on this Earth who would bother to operate a reliable GopherID server eighteen years after it mattered.

You see the problem? The web is barely old enough to vote. Any identity that ties me to some web standard of 2010 is as ephemeral as the morning dew, eight-track tapes, and the Commodore 64 floppy disk.

Meanwhile, I just visited Slashdot for the first time in years. My user ID is only three digits, but my login still works. It's a username and a password, it's built out of text, the protocol is obvious, and it's going to work as long as Slashdot works.

and it's going to work as long as Slashdot works

This would be true as well if you'd use OpenID. OpenID dies when HTTP web services die, but then Slashdot will die, too.

"If AOL, my current delegate, decides to get out of the OpenID business entirely, one minute with vim on my website allows me to move it somewhere else, again, all along,"

I doubt that. "http://jerf.org is a string that you type into the OpenID box ("endpoint URL"?), not the ID itself. I use Google Apps and set my site up using an X-XRDS-Location header so I can type in "http://id.example.com into the box, but the identity the site gets is something like "http://example.com/openid?id=123456789. This identity will probably change if I switch to using AOL.

So, I just tried this, and it seems the answer is "it depends". AOL actually let me appear as "jerf.org", so it is not unreasonable that I thought this was the case. When I switched to using Yahoo, my OpenID got translated back to their idea of my id when I used it to log in. And I started flipping out, but decided to verify with another source before screaming too much. So I signed up for myOpenID and delegated to them, and once again I could appear as "jerf.org". I verified this using StackOverflow; with Yahoo I ended up on one account consistently, but with myOpenID and AOL I ended up on the "jerf.org" account regardless. I also verified StackOverflow was actually hitting my site on each request and not just caching my page.

So unless I screwed up, it is possible for it to work the way I describe, and it is possible for it to work the way you describe, depending. I'm calmed back down, but in general that's pretty worthless. I can not imagine why it should not always work the way I describe, it's the entire bloody point. Providers shouldn't even be able to screw me over that way.

Not if the provider implements delegation properly. The identity string returned should be http://jerf.org in this case.

The catch, however, is that many providers screw the identity up. For example I set up a page at http://foo.com with necessary headers to delegate to my Google Account. Using the OpenID support on App Engine, I get the federated identity as http://foo.com/openid?id=[SOME RANDOM DIGITS] instead.

The idea of OpenID and delegation is awesome. In reality the millions different implementations fked up the whole thing, not even to mention the control and reliability issues.

Oh by the way, one more thing: if you supply https://foo.com instead of http://foo.com to App Engine you'll get completely different identity back as a result. This is just pure fun.

From what I remember of my OpenID provider search a few months ago, not all providers have chosen to support delegation. Google doesn't support it, but myOpenID does (I went with the latter, then never used it again). But it's not a "screw up", it's a (questionable) policy decision.

You have been bamboozled by OpenID lingo. Don't worry, it happens to the best of us. jerf.org is a User-Supplied Identifier which the Relying Party will perform Discovery on to resolve to an Endpoint URL at the OpenID Provider where the Claimed Identifier, which is possibly an OP-Local Identifier, will be resolved to an Identifier. None of these words mean what you think they mean. Identifiers look like URLs, but aren't, except when they are.

Have I mentioned recently that implementing OpenID is a source of endless amusement?

Ugh. I take it that the lesson to take from all this is "stay away". Got it.

> I don't have "many" OpenID... I have one: http://jerf.org

That is itself a problem. Sites and advertisers don't even need sneaky cookie tricks to track you across all the sites you use: you're doing it for them. I really don't want one single identity token for every site on the Internet.

Only when I actually log in, which is... uhhhh... damn near never, actually. The situation has marginally improved, but it's still "everyone" (big and important) wants to be a provider, "nobody" is willing to be a consumer.

Believe me, I'm not claiming OpenID is teh awesome. I'm just saying that certain criticisms can be mitigated if you are in control of a web page. As claims go, this isn't very strong.

"death by committee" is like "death by one thousand knives" i know what a delegated identity is. and if you can show me 10% of facebook users that care, i am interested.

the problem is that so many people want simple these days. in the beginning the internet was for geeks. today the internet needs to be for everyone.

my really smart friends in social games, always get frustrated, because they can never create a game that is fun for them. rather they need to create games for the masses. many of us still enjoy the complexity of supreme commander or civ5, but instead design things like mobsters and farm-ville because that is what people ( on average ) can handle.

OpenID has been designed by way to many smart people for their own needs and does not often times take the simple shortcut. there are people from government institutions at these committee meetings trying to leverage OpenID into a government ready spec.

the OpenID groups should really segment along a few different paths and focus on unique consumer segments like social, fiscal, and real identity.

the other problem is that RP ( relying parties ) otherwise known as the 3rd party site don't like OpenIDs because there is not a guaranteed messaging protocol for communication between end users and the OpenID. RPs have been asking for email address as part of the registration process, and OpenID providers always stand on the legs of privacy when asked for this, but the reality is that relieving email address leaves Providers vulnerable as their motives for OpenID are around engagement numbers.

There are political challenges to overcome with OpenID before it can move forwards. I think that is why Facebook is walking over everyone here. They don't have to deal with those issues.

I actually tried to set that up once and ran into some kind of trouble. I don't remember what exactly. It was a while ago though so it's probably gotten considerably easier to do. But your right this isn't a solution for Grandma or even Mom at this point.

Yep, this is my problem, not that I actually forgot all the logins to my individual OpenID provider accounts and variants (but when that happens once in a while, that's also a clusterfuck...). I have one for my domain with myOpenID, I have at least one each through google, yahoo, facebook, twitter, livejournal... every site offering those logins uses any combination of all of those, and I can't remember which OpenID I need to use with the site.

This is why I can't even remember the last time I posted on Stack Overflow. I once had to email Jeff Atwood because I had managed to create two accounts with two different identities (this was long ago, before you were able to associate multiple OpenID identities to a single user), and to this day I still don't remember which ones work with the user that has the highest reputation. So I don't even bother logging in most of the time, and choose a random login every time I do.

OpenID's biggest end-user benefit was supposed to cut down on the number of disparate accounts people tend to have across multiple websites, and it became moot when everyone and their mother decided that they needed to be the be-all end-all of OpenID providers by turning your login details and identity with that website into an OpenID or OpenID type identity.

Exactly. Each of the big players has incentive to be an OpenID provider (control everyone's logins!) but not be an OpenID receiver (accept AOL's logins? are you kidding?).

Nobody at OpenId seems to have quite thought through the incentives here. Identification is not in fact a technical problem. That's trivial. It's a business/social problem.

The problem is, "How can I make multi-billion dollar companies want to outsource identification to someone else, given that they're reasonably bright and given that every time in the past that someone else has inserted themselves into another's business, things have gone badly for the insertee?"

Businesses look at situations where companies like Ticketmaster and OpenTable have successfully inserted themselves between pre-existing businesses and their customers, and siphoned off a lot of the value of those customers. Then they say, "Gee, maybe I should learn from that and not let someone do that to me." And then the OpenID geeks come calling saying they've got a great solution where all you have to do is outsource your accounts to another multi-billion dollar company and everything will be cool, that other company TOTALLY won't steal your business or anything.

Reply on news.ycombinator.com