Google Goes Renegade, Creates Own OpenID Fork | Hacker News Reader

Google Goes Renegade, Creates Own OpenID Fork

neosmart.net

46 pointsComputerGuru20 comments

I don't think this blogger actually read the post by Google. The neosmart article emphasizes This is a departure from the process outlined in OpenID 1.0. This is because Google is following the OpenID 2.0 protocol which does contain the discovery request and the XRDS document process.

http://openid.net/specs/openid-authentication-2_0.html#disco...

This is not a fork from OpenID. They are simply using the newer protocol.

According to The Next Web (see this post: http://cli.gs/MM0aab ), "Dick Hardt, an important OpenID supporter, also confirms that Google is NOT compatible with OpenID". They link to his comment on TC.

From what I can tell, the goal is to make the experience easier on the user by doing the email domain to URL transparent.

The reality is that users don't know URLs as identification mechanisms. They do know email addresses.

This was always my biggest complaint with OpenID. I'm glad Google did something about it. Perhaps others will follow suit.

Users are comfortable using an e-mail address as an identity. Everyone has an e-mail address. This makes sense to end-users.

E-mail addresses are unique and they accurately identify who someone is. I have no idea why this wasn't the standard in the first place.

For sure. This is a slight change, but a big change for the better. Nobody wants to remember a URL when they already remember their email. This makes perfect sense, and solves the biggest issue with OpenID in a way that looks like it puts it on par with the ease of use for end users of Facebook Connect, for example.

If every service simply required an email address, and the standard provided for a way to find out the access point from the OpenID provider, then we'd be all set and everyone would be able to implement this change.

Contact information should not be an identifier. It's like when a B&M store uses your phone number to ID you. I don't want them calling me and I don't want your website to email me.

The URL is simply a pointer to my identity, which is all I should have to give. The different formats the providers use is what makes it confusing (example.com, username.example.com, example.com/username, and now username@example.com)

If Google had stuck with the standard OpenID implementation, they could've still had the same user experience. http://zain@gmail.com/ is a valid URL, and Google could've used that as the OpenID URL.

Entering http before your email address doesn't make any sense to the average user.

Entering http doesn't make any sense to the average user.

Exactly.

The http:// is not necessarily required, he was just pointing out that it's a valid URI and thus can be used as an OpenID identifier.

It seems most OpenID implementations handle identifiers without the http:// prepended.

how hard would it be to slap "http://" onto the email if it wasnt there? that way you get your email and you dont break the standard. not hard, not hard at all.

Most/all OpenID libraries already seem to handle identifiers without the http://

If the libraries don't already support the "@" syntax, they should.

If Google's way of doing things requires any proprietary changes, I'd say it's unacceptable, but if that's the only change necessary then it seems like a reasonable way of doing things.

This article closes with a meme I'm getting pretty annoyed with.

"Don't be evil" is not the same as "don't do anything that the author disagrees with".

Well this is pretty much the same thing Microsoft does with standards that everyone yells, "Embrace, extend, extinguish!" at...

Not really.

Google's telling you pretty much exactly how to do it yourself. They appear more interested in improving the standard for everyone.

With respect to authentication, this is like Facebook Connect, but with a larger audience.

And it's like OpenID, but without 'send data' and 'server/delegates.'

I really like this.

The implication of division is also a really false one. Last week we had a summit about OpenID usability and Google as well as all the other major players in this space were there. People really want to find a good solution for users. This is not about division at all. People really want to find the same good solution for users to use everywhere.

I find the implication that tech companies are constantly at each other's throats and back stabbing each other like a bunch of Hollywood hussies tiresome. Google have talked about "federated login" for a while and this is them taking it out into the wild.

The exact implementation of Open ID that ends up being used by everyone is going to change over time as we learn what works for users and what doesn't.

I think this is going to be great for OpenID in the long run. Email addresses just make a lot more sense than URLs for logging into sites.

I'd also like to see a credit card (or even PayPal account) attached to an OpenID account so one can also use it to pay for things online with an email address. An email confirmation would occur after each purchase. Thus OpenID becomes a substitute for a CC's number and its other details, which are lodged with the OpenID provider. At present, one can't even sign for an online purchase or show a confirming ID or enter a PIN.

Reply on news.ycombinator.com