Hacker News Reader

Comment by shockie | Hacker News Reader

What's the advantage over openid?

Some people think that using URLs instead of email address in OpenID was a big mistake.

Having in-browser support for this kind of thing seems like a plus, too.

Email addresses are something that people are fairly familiar with when it comes to signing in. Trying to explain why URL's are used instead of email addresses in OpenID is difficult when you are dealing with a non techy user.

To this day I still do not understand how this inane argument happened to be the single thing that killed OpenID. How is ‘cody.my-open-id-provider.com’ more confusing as a login than ‘cody@my-email-provider.com’? Hint: it’s not. I’m not one for conspiracy theories, but the whole URL-versus-email argument against OpenID seemed like the excuse various people used to put a nail in OpenID’s coffin when they didn’t like it for other less defensible reasons.

I'm a reasonably competent web user.

I've implemented OpenID.

I run my own Open ID server.

I've implemented Shibboleth (and lived!).

I know that Yahoo is an open ID provider, and I think Google is too, but when I'm presented with an old-style (URL) OpenId login I don't have a clue what to enter to use either my Yahoo or Google account to login.

Yes, I know that now most login forms provide easy links to use Google or Yahoo to login. The point is that entering the URL is confusing because no one knows what their OpenID url is, and it isn't standardized in anyway.

The situation is so bad that the OpenID providers had to develop a way for users to enter their email addresses, and then the client performs a discovery request to find their URL.

Google/Yahoo/etc. could have given you a memorable OpenID if they wanted.

It's a good point though, the fact that email addresses have to be somewhat memorable/human-readable by nature is a good thing for BrowserID.

What bearing does the fact that Google and Yahoo chose shitty hard-to-remember OpenID URLs have to do with the overall fact that OpenID uses URLs for authentication? That’s like saying using email addresses for authentication is a terrible idea because mail administrators can assign really hard-to-remember email addresses. The solution is simple: set things up so they’re not hard to remember. Again, there is no reason why your OpenID login can’t be ‘name.my-open-id-provider.com’.

I would be willing to bet Google and Yahoo made their OpenID URLs hard to remember because they already had single sign on products that they wanted in the limelight preferentially over OpenID. However, cursory support of OpenID made them both look like supporters of open standards even if their implementation (hard-to-remember URLs) doomed it to underuse.

There seems to be an implied trade-off between a usable system and a distributed system. Most users and most developers at this point will go for usable.

But then, Google, Facebook and Twitter have reduced the friction for identifying all over the internet, so Mozilla is kind of arriving late to the party.

OpenID fundamentally argued that you should trust a third-party authentication service. Not too long ago, Mozilla tried implementing OpenID directly in the browser so you didn't have to trust any third party, but that represented an afterthought in the OpenID ecosystem.

BrowserID, on the other hand, fundamentally uses distributed identity via public/private key crypto, and only involves a (single) third-party service as a crutch to allow browsers without native BrowserID support to handle BrowserID, so that sites can adopt this immediately rather than waiting for browser support.

Reply on news.ycombinator.com