Slashdot Mirror
OpenID Fan Club Is Shrinking
A.B. VerHausen writes "Even though there's a whole new Web site devoted to understanding and using OpenID, some companies are dropping the login method altogether. OStatic is reporting that the 'free Web site network Wetpaint announced recently that it will no longer support OpenID as a login option for its wiki, citing low usage and high support costs as reasons.' Apparently, fewer than 200 registered users bothered with OpenID, and the extra QA and development time doesn't make it worthwhile to support. This can't come as welcome news on top of the internal issues the article mentions the OpenID Foundation is having now, too." I've actually been quite happy with OpenID, since I have spawned far too many username/password pairs over the last 20-plus years, but it's a major chicken-and-egg problem. Hopefully someone out there will build a better mousetrap ...
Rather than trust an external site with all my security, I use a tool called 1Password for Macintosh (there is a similar tool for windows) that secures my passwords in once place and protects them with a single master password. No OpenID required, just the Mac Keychain.
Currently hooked on AMP
I would have beat you if I could have remembered my login details...
Invaders must die
Stack overflow took an interesting approach, and only uses OpenID. They don't even have a non-OpenID option. Proprietor Jeff Atwood discusses some of the tradeoff at his blog.
It would help if the players actually had spent any effort to make it work. Try using Verisign's site and it is horrible. It times out when validating. The others while rich in graphics are no better, nothing to see here .....
"If the King's English was good enough for Jesus, it's good enough for me!" -- "Ma" Ferguson, Governor of Texas (circa
I remember when this came out. I thought to myself "I'll sign up when I run into a website that needs it." Except for this article, that was the last I'd ever heard of it. I'm amazed it is still around.
I read the internet for the articles.
"I've actually been quite happy with OpenID, since I have spawned far too many username/password pairs over the last 20-plus years" What's wrong with Administrator/admin everywhere? In fact, it works so great that entire Windows networks are known to use it. No problems reported so far.
I am not a user so YMMV, but I personally don't like all my eggs in one basket. I use different logins and passwords on most of the sites I visit. I hardly want a security breach on some forum I post to to be able to have access to my email or credit cards site. Centralized is great for some things, but I simply don't trust any company to be as tight with their security as I am with my own. To them a breach is a "whoops, sorry!" to me it could be personally and financially devastating.
Hmmmm...
I checked out the "Explaining OpenID" web site referenced in the article, and it didn't make a whole lot of sense.
It did tell me that my OpenID is: www.google.com/o8/id
I undoubtedly will not remember that, nor do I believe it is even accurate.
I then read how I could integrate it into my own web site - and despite doing a ton of web development and XML stuff, had no idea what they were talking about - at either a high or low level.
In conclusion - If they want to get users and developers on board with OpenID - their going to have to do a hell of a better job. Either that, I'm just too stupid to understand their "OpenID for Dummies" web site.
Now I'm of course just an engineer and developer - I'm sure users like my parents, grandparents and kids would understand this stuff much better.
Do you see OpenID anywhere on the front page to Facebook?
There's your problem, people don't know that OpenID even exists.
Why make things complicated? Just use X.509.
Just have GETs to "http://anyserver.com/id/Lord Ender" return a certificate (public key) issued to, literally "http://anyserver.com/id/Lord Ender".
I would then have the certificate/keypair installed in my browser. It doesn't matter who it is signed by-it can be self-signed.
When I sign in to a website, I put "http://anyserver.com/id/Lord Ender" as my ID. The website then fetches my certificate from anyserver.com and asks my browser to prove I'm me using the built-in features of SSL. From then on, the web site will know me as "Lord Ender of anyserver.com".
It doesn't get any simpler or easier to implement.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
It might also have to do with the fact, that OpenID was never supposed to be a general login system. At its bones, it's a homepage/URL verification protocol for the blogging community. And it's constrained to that, because URLs (no matter how shortened) are not *common*-user-friendly.
but it's a major chicken-and-egg problem. Hopefully someone out there will build a better mousetrap ...
If it's a chicken-and-egg problem, wouldn't it be better to build a chicken trap, with egg catcher?
I am a web developer by trade, and so far one of the most infuriating things that I have to deal with on a weekly basis is that my customers simply can't bring themselves to care enough to remember their admin logins. Every week I have to unlock a handful of administrators. It doesn't matter if I provided them with a proper password rescue option, it is simply too much for them.
The second big problem is that we have multiple branches of certain products running at the same time, so at any given time one of my customers may have to login into her production, staging or 2-3 development servers, each with its own username and password.
We are a .net shop, so my original idea was to use the new membership and role providers and remove the login mechanism from all sites from a given customer. This works, but it is hard to get all sites in line since there is always something else going on that is more important. They still screw it up, but at least they only have to remember one username and password that works at the same level (production, staging, dev, etc.).
When I heard about OpenID I tried to see if I could implement it in any of our sites that use .net 2.0-style security. I was glad to see that somebody already had thought of this, and I found a ready to run library with a very nice login control for .net that uses OpenID.
It wasn't easy, but it was interesting, and within 10 or so hours invested I had:
1. A .net web app that used ANY OpenID instead of the built-in aspnet_* tables hierarchy. .net app that uses the SQL membership/role providers.
2. A recovery page. You type your email address and it emails you a list of any OpenIDs in the system that match that email address.
3. A self-registration page. If you arrive at the web app, and you authenticate through OpenID successfully, and you don't have a local profile, it asks you to fill a quick form.
4. Security roles are used just like any standard
The beauty of it is that I can even run my own OpenID server for my customers. All they would need to remember is that they login by typing a URL like:
userid.ouropenidserver.com
and it would do the rest for them.
One customer, three projects, three environments per project, that's nine login/password pairs that I am expecting them to remember. Instead all they need to remember is the URL and the password. If they lock themselves out, all they need to remember is the email address used to register, which emails them their OpenID URL. If they forget their password, that is handled at the OpenID provider level, not at the end user application.
Even if nobody else in the world uses it, to me it clearly means that I can spend more of my customer's money in building new things instead of on troubleshooting and damage control (even if the two figures are identical, customers will bitch more about paying for repairs than paying for work that can be recognized as new). And it is an easy concept, if they have a Google or AOL account, they already have an OpenID.
Pedro
----
The Insomniac Coder
Authentication on the web is kind of messy and annoying, but OpenID is so too. It just doesn't feel right to be pushed from one server to the next to do authentication, since it leaves the door wide open to phising attacks. Also using URL for authentication just looks ugly.
I personally would prefer something that works on the client side and not on some other third server, i.e. store a GPG public key in your browser and have the browser use that to automatically sign blogposts or whatever to authenticate you. To stop spam one could have third parties sign the GPG key to create a web of trust kind of thing.
So you would have a reusable secure token you use for authentication on all pages, instead of having to come up with new passwords all the time. And it would also keep the third party out of the picture, since the token remains only on your client and never leaves it.
That is half the problem. It isn't an intuitive way of logging into a website. Since the days of timeshare computers, people understand "username / password". Nobody understands "URL => ????".
If you were to ask me to write the OpenID obituary, the biggest reason the protocol failed was the decision to use a URL instead of an email address. Every other failure was secondary to that one.
Effort was never the issue. The issues are:
a) Selfishness. Too many sites allow you to use their database to log into others, but not use others to log into theirs. Seems the big players want to be the ones owning your data, just like MS tried to own logins with its system... whatever that was called.
b) What does OpenID actually gain you? You still have to enter login details. It's just a URL instead of a username. Others have said this above too, but what's needed is something like a wallet: infocard or a keyring manager, which keeps track of all your details on your machine, and extends your single desktop sign-on to websites, so you don't need to log in at all. Most of this tech is available and implemented, with firefox's password memory, and desktops' wallets. Unfortunately, again, people are competing to control this, instead of focusing on an open system. An open, Infocard system for GNOME/KDE and other desktops (all equally supported and native), which presents web logins as "Here's your wallet. Select which ID card you want this site to use" would nail this problem easily.
The Magic URL (which is magic, actually) *IS THE USERNAME AND PASSWORD*. That is the whole point of OpenID. A website leaves the username/password business to some other guy and just trusts the protocol to make sure the Magic-URL is legit.
If you've hacked RMS's OpenID account, you can just go to any OpenID site, even if he never visited it before, and start impersonating him. That is the "benefit" of OpenID! Most of the OpenID authenticated sites out there dont have a concept of "sign up", you just go to the site, plug in your Magic URL and start doing shit. There is no email confirmation step on those site, and if there was, it would kinda defeat the whole purpose of OpenID in the first place.
And if I'm wrong in my interpretation of this, please send me to a URL that actually explains how the damn thing works. Nobody gets it and if the OpenID guys can't explain it clearly, they probably dont get it either.
Lets say I've hacked your OpenID account. Now I can go visit sites like StackOverflow and post as you. Since they dont require email verification when you "sign-up", it doesn't matter if you had an existing account with them before I hacked you. I can go anywere that takes OpenID and "silently" impersonate you regardless of if you used the website before. No email verification means you'd probably never know it either. Well.. until you google "AvitarX" and find yourself posting horse porn on some OpenID site.
Especially since if it were true, sig-less posters would have penises of infinite size...
Yeah, and how is he supposed to decrypt it, in his head? I'm assuming of course, that he's not Bruce Schneier.
I'm surprised that /. geeks actually use specific tools to manage their passwords, when it's so much simpler and quicker with a couple of shell micro-scripts.
Shell scripts are harder to use if you have to cut-and-paste between them and the browser.
You provided a windows batch file as an example... on that terminal, you have to open the console menu and first select mark, then draw a block around the text, and copy the text to the clipboard.
The browser's built-in manager is very easy to use, and as such, is used the most frequently. If that starts to fail or strain, you then switch to the other tools, such as keeping a plaintext file or building a greasemonkey script.