Is OpenID Too Confusing?
lifehacker.com
lifehacker.com
This was a huge complaint I had during the stackoverflow beta. Those that are believers in OpenID are zealots. They won't change their opinions no matter how much the general populace hates on it. They likely are public figures (with URL related to their personas - like a website or blog). In this case OpenIDs work beautifully. It's the rest of us that have trouble.
I currently have 4+ OpenIDs and I can never remember URLs or usernames. It inevitably involves me going to my second gmail account and searching for OpenID. Then I choose randomly one of the OpenIDs that show up in the search and use it. That or I end up creating yet another OpenID. So now I spend my time managing OpenIDs instead of user accounts. To me an even bigger waste of time. Meta-account management. And god forbid you start forwarding or attaching one OpenID to another one... that'll REALLY hose things with whichever account you are logging in as. Sites rarely allow the user to tie all those IDs together to a single account - which would at least simplify things a bit. To me this is wayyyy too complicated for average end users. Maybe if it were designed into everyone's web-email accounts and things could be managed there. I've attempted using the Yahoo OpenID and always run into problems with that too.
When I've asked my tech-savvy non-developer friends - none of them even know what it is. I've rarely heard positive feedback outside of people in the tech industry. But then again I haven't gone looking for it.
The compromise between being decentralized and centralized in my opinion is what causes so many problems. There is no one place to go get an openid (try explaining that to the average user). There is no standardized way to get one (every third party site is a little different). And it adds an extra level of indirection - with no perceived benefits to the end user. There are a lot of benefits but none that the end user readily cares about.
An interesting article on OpenID from Jeff Atwood: http://www.codinghorror.com/blog/archives/001121.html
I attempted to find the uservoice thread about OpenID in stackoverflow but it's been deleted: http://discuss.joelonsoftware.com/default.asp?joel.3.685860....
I'm not surprised it isn't working so well for you, in that case.
I think some of the centralization/privacy concerns related to OpenID sound like valid points to debate and discuss.
But saying you have too many OpenIDs and that managing them has become a pain is like complaining that you can't remember which of the four wallets you're carrying has your credit card in it, and concluding that wallets suck.
If I could cut back to just one or two accounts I would. But I've found the management tools lacking both on the client website and OpenID side of things.
It doesn't solve a problem for the average user.
They should just give it a better name, like Internet-Wide Identity. OpenID is an implementation (centered) name, not a user (centered) name.
Example: Your base password is "fun" and you're visiting Gmail -- if your hash is taking the first and last letters of the domain then your password is "funGl".
BAM! Single breach problem solved! Picking a unique username is up to you.
Personally, I would love it if almost every site out there would let me log in with an openID. I'm apparently in the minority here, but I'm sick of having to make a new account every time I want to check out some site or forum that looks like it might be interesting.
While there are issues in the implementation, I am very much unconvinced that there is anything particularly more difficult about the concept than that of current logins.
When I ran non techie friends through it, the biggest complaint was usually that there were too many different screens they had to click through, and there was some confusion about where to go to get an openID, but as far as I can see these are all things that can be improved without sacrificing the core concept of OpenID.
The name isn't the problem, the expected action is the problem. People expect to enter a password to log into things.
So while it's true that (short of doing stuff like RSA & PKI in Javascript) you can't fix these problems with browsers as they exist today, that doesn't mean that a solution that ignores the problems is a good idea.
The only thing that I can see which would actually help, without breaking the "install nothing" goal of OpenID or making the existing usage path any more difficult, is to build some sort of OpenIDRequest object into browsers. And you'd want to design an unspoofable credential request window to go with it.
Why can't I do this with every other site? I'd like to be able to go to foobar.com, click on Register and be taken to a Google page where Google says "What nickname do you want foobar.com to see?". The default is my gmail username but I can change it. I'm in. Foobar doesn't see my email address or a password or my address book contacts or anything else. Can people poke holes in this suggestion?
I think Joe the Plumber would love such a scheme.
Things like Google and Facebook are so ubiquitous as to be effectively universal, but OpenID people object to using them as an authentication mechanism on ideological grounds.
They'd rather have a pure solution tomorrow than a good solution today.
And I'm saying that as someone who was semi-active participant in the early design stages of OpenID.
There's the first problem. If your site only accepts OpenID you won't have that problem.
Also, I don't know of a single site that is using an ID selector with history sniffing, which should be a much better UI.
Using and trusting some existing OpenID-provider would be a bigger leap for me - the fact that it is possible, and not terribly complicated, to create and run your own is a big plus in my book.