Facebook Connect - fatal blow for OpenID?
identity20.com
identity20.com
My on-line identity does not need to be a complete, consolidated mirror image of my actual read-world identity for the sake of convenience for myself nor for others.
By default, consolidated identity is the end result.
The reality of OpenID will surely fall short of it's aspirations.
mechanical_fish has a pretty good comment on this:
"You'll have your choice of big corporations to trust with your identity."
I've been expecting OpenID to evolve into this. The whole problem with OpenID from the site owner's standpoint is the dependencies: If you allow anyone to log in from any OpenID provider whatsoever, you're essentially creating an open-ended dependency on thousands of providers across the web. If a provider has a security problem, X% of your users have a security problem; If a provider goes down, X% of your users go down; If a provider offers a bad login experience -- by showing users tons of ads, or trying to lure them to a competitor as they log in -- you've got a bad login experience that you cannot fix except by forcing some users to switch providers.
This solves all that. You get a simple relationship with one provider: Facebook. You get permission to use Facebook's logo on your site, and to use their brand to reassure your users that you know what you're doing. You don't have to temporarily redirect users to another site in that confusing, phisher-esque OpenID way -- the users type their password into your own site, into a page that you design. If Facebook's API starts giving you problems, you send email to a single service department: Facebook's.
Of course, I believe this entire plan got rejected by the market the first time around, when it was called "Microsoft Passport", but perhaps times have changed.
Any plan which involves asking users to build a more complicated mental model of OpenID -- like asking them to understand the notion of multiple IDs aliased to the same account -- is just going to make that fundamental problem worse.
Facebook, meanwhile, has a big blue button that you click and things just magically work.
Also, you'll need the blurb for the Facebook button, too.
And Facebook doesn't ask you for your user name or password - you can't phish if the site doesn't ask it to begin with. It just matches your cookies. If you haven't logged in yet, then you need to go to Facebook and log in first. But most people are logged in constantly, so it works out.
For Facebook, there's a huge userbase that's already there, and already cookie'd up. Because Facebook has such a huge brand name, it can stand alone and work pretty well.
OpenID, first off, has a DISadvantage in how open it is. No single large button will work. (I love the idea of Clickpass, I think that it has a chance to work, but that means yet another branch of the original OpenID concept.) You need either one single field to log in from, or you need multiple buttons, one per service.
From there it's a matter of individual service popularity. And here's from my experience only, so I could be speaking alone, but the services I used didn't remember me and I had to log in each time. I used ClaimID, MyOpenID, and AIM. Same problems with each. And I used OpenID to AVOID multiple logins. Even when I'd logged in for one site, the second one meant entering my log in again, then going to a second page to verify access. That means the log-in process is longer than just using a separate ID for the site. Registration moved slower, too, because first I had to log in, then I had to grant access, then I had to pick a user name - half as many page loads as even registering with a site using email verification. (Sites that used OpenID AND email verification were the last straw.)
So... conceptually, yes. Exact same process. The difference is that with Facebook I need two clicks to log in, no keyboard, and two clicks is fair to me. The same as theoretically entering a user name and password. And registration is faster, and it keeps all my identities together. So Facebook, by being a faceless corporate entity, has a usability edge, and for the majority of users (I'm not a fan of either, mind you), usability is all that matters.
and here: http://wiki.developers.facebook.com/index.php/Facebook_Conne...
Microsoft tried it years ago with Passport. Google has their proprietary one. Now it's Facebook's turn, apparently. At least Yahoo and AOL use OpenID, even if they are only providers and not consumers.
This will not be a fatal blow any more than Microsoft Passport or Google Account Authentication were.
No sane person is going to run their site and say, "Get a Facebook account if you want to sign up for ours." Would you? They'll have an option: Login/register (or login through Facebook) if they really want to support FC.
A noble statement, but it's not one that carries out.