Google Adopts, Forks OpenID 1.0

An anonymous reader writes "Right on the heels of Microsoft's adoption of the OpenID protocol by announcing their intention to enable OpenID authentication against all Live IDs, Google has announced their intention to join the growing list of OpenID authentication providers. Except it turns out they're using their own version of OpenID that is incompatible with everyone else. It seems that Google will be using their own 'improved' version of OpenID (based upon research and user feedback of the OpenID system) which isn't backwards compatible with OpenID 1.0/2.0, in hopes of improving end-user experience at the cost of protocol compatibility and complexity."

Comments

Google... learning more from Microsoft everyday

[JCSoRocks]

Substitute Microsoft's name for Google and it'd be just another day in tech. Interesting to see Google doing this though.

Re:Google... learning more from Microsoft everyday

[Johnno74]

Yes, except just yesterday Microsoft joined OpenId, _without_ this sort of stunt.

IMHO, microsoft's behavior in the last few years is to be commended, they are worlds away from where they were 10 years ago.

Sadly, google seems to be heading the other way.

Re:so lets see slashdot bias at work

[Microlith]

Google will be cheered or booed depending on what they do with their changes to OpenID. They could very well turn around and propose it for version two or whatnot of OpenID. After all, if it isn't compatible then what the hell is the point.

Microsoft is hated because they DEFINED "embrace and extend." They regularly use it as a weapon against their competitors. We have yet to see Google use their version of OpenID, much less use it against anyone.

Never mind that OpenID screams "single point of failure" to me.

Stop your complaining

[FooBarWidget]

OpenID usability sucks.

There, I said it. It's true. My computer-illiterate dad just wants to post a comment on a blog, or to login to a new website. You can't possibly expect him to do something as complex as reading up on what OpenID is, signing up for an OpenID account on a totally different website that has got nothing to do with the original website that he was on, and then logging in by entering a long magical URL. People like him - average users - have trouble enough understanding usernames and passwords! The recently published OpenID usability study confirms all the criticism that I've had on OpenID.

While OpenID is technologically sound, its usability is not. If Google's version is more usable, but is still open, then I'd gladly support it even if it's not compatible with the "official" OpenID standard. I don't care whether they're being "nice" or "evil" or whatever, I want better usability because software is supposed to be usable.

Re:Stop your complaining

[FooBarWidget]

"Rubbish. For people like your dad, OpenID is both simple *and* simpler than having to sign up for dozens of sites just to post a comment."

That's true if you count the step. The thing you overlooked is, he doesn't know what OpenID is! Try to explain OpenID to a random person on street. How big is the chance that he understands it and will even care? Have you ever went through an OpenID registration process? There's no way my dad understands that. The barrier to entry for average users is too high.

There's more to usability than simply counting the number of steps.

"Suppose we live in a world where everybody implements OpenID (as a consumer and provider)."

It's useless to speak of such a world. It simply doesn't exist. The hard reality is that OpenID adoption is still low.

"If I "can't possibly expect [your dad] to do something as complex" as that, I weep for your dad - and you, given that you got 50% of your genes from him."

Oh yeah, like launching a personal attack on me will make the usability problems magically go away. If anything, this is a sign of your weakness.

So they're experimenting

[bluefoxlucid]

Google is a research company; they're doing research. They are improving OpenID, in their opinion. Nobody relies on Google OpenID, they haven't stepped up to make an OpenID implementation and then started adding extensions, and finally broken compatibility to force conversion to their special vendor-locked-in crap. They've come out and said, "We are going to implement something new, based on OpenID."

Wait until Google Docs stops exporting to deprecated MS Word 97 format (and ignorers .docx entirely), but does export to Google Document Format for their new Google Desktop Office; then you'll see Microsoft behavior.

Why OpenID fails

[coryking]

I've got one word for you

Meanwhile, in reality, you know that ultimately the URL is the location of your OpenID server, right?

Huh? No seriously. Huh?

OpenID is just so damn unintuitive that nobody really gets it. It is a fucking login. Why can't it be an email address? Why can't it resolve the right place to conduct authentication business via DNS the same way SMTP gets it's MX record based on everything after the @domain.com?

Seriously, the more people try to explain it, the more it just makes peoples eyes glaze over. All they see, and all I see, is a fugly looking URL that is supposed to magically authenticate me, only as a web developer, I'm told I can't actually trust the authentication because the protocol wasn't designed for it. Or something. My head spins now.

Re:Why OpenID fails

[coryking]

Because for the average person, it's a lot easier to set up a blog than it is to get their ISP to set up custom DNS records.

There you go again. What the hell are you talking about? Now to log into some stupid site, I have to get a blog too? Huh?

Admit it, the URL thing sucks ass. Email addresses are something we all have, and many websites are using email addresses as your login already. If OpenID did email, even *if* there wasn't any DNS trickery like I suggest, life would have been 100% easier. But no, I'm sure there is some "valid" reason the purity trolls who wrote the spec had against something so simple and logical, so they decided URL's would be best, usability be damned.

Re:Why OpenID fails

[burndive]

Do you already have a Google Account nickname set up and ready to enter into the login field? Did you even know such a thing existed? Does Joe The Plumber (TM) know that?

I do, but then again, I use OpenID the way God intended: I have my blog delegate to a 3rd party that specializes in it (myopenid.com).

My blog URL is exactly what I want to show the world my identity. It's the hub of a significant portion of my public online content.

Why does a blog that I'm commenting on need to know my e-mail address? They might spam me.

An e-mail address is private information. A URL is just as unique, with the added benefit of being public.

Re:How to judge what's going on

[BlueGecko]

I agree with you wholeheartedly that Google's solution is better, Bruce, but...it's not the standard. The proper way to do this, and one I'd have been fine with, would be to support OpenID, plus this alternative that's much easier for the average user to understand. That's not what Google did, and I don't think we're out-of-line for faulting them for it.

Re:Google sees the problem with OpenID 2.0

[Shados]

OpenID 2.0, on the other hand, is a disaster. Its architecture reeks of design-by-committee

Basically all open standards do, or eventually do, which is why many commercial entities decide to roll up their own. Yup, while definately many of the times when Microsoft did something like this WAS out of "evil", a large portion was for the same darn reason as this. There's VERY few open standards that aren't an insane mess of "I'll add your idea if you add mine" crap.

Making Extensions Possible Without Evil

[Bruce Perens]

It's open development if the extension is as open as the original standard. It's not an accepted standard until the standards group accepts the extension.

Is it an Open Standard if you can't extend it openly? I am entirely against closed extensions to open standards, and unnecessarily incompatible extensions, the classical "Embrace, Extend, Extinguish" stuff. But I am equally against standards being a ball and chain that prohibits further innovation. You should be able to produce an extension that you make open on the same terms as the original standard.

It looks to me as if Google is attempting to hit OpenID with a clue stick on a really obvious issue, saying "Normal folks use email addresses to log in, dummies!". And I am being told that what they are doing is really close to OpenID 2.0.

Bruce

Re:How to judge what's going on

[Bruce Perens]

Yet if this was Microsoft, we would be accusing them of "embracing and extending" a protocol to death.

And because Microsoft has a record of doing just that repeatedly, it would be reasonable to do so.

Please don't forget all of the bad practice around approval of Office Open XML, which made a sham of ISO, and their very recent maneuver to take over the OpenDocument standard group at ISO.

At the moment, I am less likely to trust Google regarding democracy and civil liberty issues than I am regarding Open Standards. Because they have a record on that.

But I agree that they screwed up the relationship and PR issues around this move. They should know better.

Bruce

Re:Snarky AC comment

[Bruce Perens]

For single signon to be safe and secure, it seems to me imperative, that the password entry and access approval be done through the browser itself, in a more secure way, rather than through a standard web form, so easily manipulated.

If you want this, you need to go to W3C and start a standards activity. Browser authentication has remained the same, it seems, for a very long time. And if you actually implement it, you find it's lacking. For example, there is no way to log out! Browsers generally send authentication with each request to the site after you sign on.

Bruce