OpenID Fan Club Is Shrinking

A.B. VerHausen writes "Even though there's a whole new Web site devoted to understanding and using OpenID, some companies are dropping the login method altogether. OStatic is reporting that the 'free Web site network Wetpaint announced recently that it will no longer support OpenID as a login option for its wiki, citing low usage and high support costs as reasons.' Apparently, fewer than 200 registered users bothered with OpenID, and the extra QA and development time doesn't make it worthwhile to support. This can't come as welcome news on top of the internal issues the article mentions the OpenID Foundation is having now, too." I've actually been quite happy with OpenID, since I have spawned far too many username/password pairs over the last 20-plus years, but it's a major chicken-and-egg problem. Hopefully someone out there will build a better mousetrap ...

Comments

Local software solution instead

[wealthychef]

Rather than trust an external site with all my security, I use a tool called 1Password for Macintosh (there is a similar tool for windows) that secures my passwords in once place and protects them with a single master password. No OpenID required, just the Mac Keychain.

Re:Local software solution instead

[Anonymous Coward]

Rather than trust an external site with all my security, I use a tool called 1Password for Macintosh (there is a similar tool for windows) that secures my passwords in once place and protects them with a single master password. No OpenID required, just the Mac Keychain.

This works well if your always logging in to websites from YOUR computer... won't Open ID mean users can log in to websites from anywhere (Work, Friends house) and only have to remember the one user/pass pair?

Re:Local software solution instead

[DMUTPeregrine]

KeePass Password Safe is open source, and quite portable. I keep my database on a USB key, which is on my keychain. Anywhere I go I have my passwords AND the executables.

Re:Local software solution instead

[Just Some Guy]

Rather than trust an external site with all my security, I use a tool called 1Password for Macintosh (there is a similar tool for windows) that secures my passwords in once place and protects them with a single master password.

Rather than trust an external site with my security, I use OpenID on my home server that secures my single password in one place and never distributes any of my login information to other servers.

Re:Local software solution instead

[davester666]

It's because everybody wants to be a provider (so they get all your valuable information from you, as well as your surfing habits from other web sites that use OpenID when you sign on using your ID), but pretty much nobody wants to just accept an OpenID login (as they wind up just sending valuable information to another company with no direct benefit to themselves [and they could care less about the customer's convenience]).

Re:Local software solution instead

[Sancho]

Frankly, I don't trust other computers. I try my best not to log on to online services when I'm not using a trusted computer.

I'm sure as hell not going to plug a USB drive with my password database into an untrusted computer.

Re:Local software solution instead

[GooberToo]

And this is exactly why OpenID never caught on. You implemented it the only way it makes sense. For the vast majority of people this is too much. For companies requiring a login, they garner no information about who is visiting their site so they have no incentive.

The combination of the two means no one wants to accept OpenID and it is too painful to truly use securely. Whereby securely means, no user information released.

Re:Local software solution instead

[coaxial]

Just use password gorilla everywhere since it's available on mac, linux, and win32. That's why I have. But in all honesty, I don't really use it. It's frankly too much of a pain to fire up another program,log in, search, copy and paste the login and password, and the close the program. So what do I do use? Unencrypted plain text files named after domains, all stored in a handy directory named dont_look_here .

Seriously.

Re:my fp list is growing!

[sgbett]

I would have beat you if I could have remembered my login details...

a site that uses nothing but OpenID

[marhar]

Stack overflow took an interesting approach, and only uses OpenID. They don't even have a non-OpenID option. Proprietor Jeff Atwood discusses some of the tradeoff at his blog.

Re:a site that uses nothing but OpenID

[Blakey Rat]

Yeah, and it demonstrates the flaws of OpenID quite well, too. The number one feature request for the site, since it opened to the public, was to add a way of "moving" your OpenID to another provider since many OpenID providers are completely unreliable. Instead of fulfilling this feature request, some users recommended creating a OpenID "delegate," which basically means setting up your own website which can switch between different OpenIDs. This process, needless-to-say, is not only extremely complicated and technical, but requires you own a webserver.

They've added in a "feature" where you can add a second OpenID (and have two entirely different logins for a single account! Usability/security nightmare!) Of course, that doesn't help people in the vastly most common case: when their OpenID provider craps out, and they haven't had the foresight to add a "backup" OpenID.

The usability of OpenID is also extremely poor. It took me several tries to get a Yahoo OpenID working. After finding out that the URL example given by StackOverflow's login page was completely wrong, and also discovering that Yahoo keeps OpenID turned off by default until you request it be turned on, my actual OpenID turned out to be something like: my.yahoo.com/asaij223dsdh2q45acsh421qi32h (I don't remember it exactly, it was a giant impossible-to-memorize string.)

Unfortunately, while the site now allows you to move your OpenID and made some other improvements, they still haven't added an option to just eschew OpenID altogether in favor of a simple username/password combo, so I just don't use the site at all. (Rather, I'll use the site, but not any features that require a login.) StackOverflow is free, so they don't care about ad revenue, but I'm sure curious how many users their crappy OpenID requirement is driving away.

Sure, Microsoft sucks and we all hate them, etc, etc, but at least their Passport/LiveID system actually freakin' WORKS. So far I've had nothing but problems from OpenID.

Re:a site that uses nothing but OpenID

[Blakey Rat]

Yes, but the difference is that Passport has worked reliably for years and years now... 10 years, if I'm remembering correctly... and I've yet to flawlessly log in to anything using OpenID even once.

I have to admit, that after typing that post I went back to StackOverflow and they've actually fixed their faulty instructions for how to enter Yahoo IDs. (It used to read: my.yahoo.com/username which never worked, AFAIK. Now it just says to use www.yahoo.com and have Yahoo ask your username, which does appear to work.)

But look at it this way, availability-wise:

If you use OpenID with a delegate, you're dependent on your own web server working, at least one of your OpenID providers working, and StackOverflow working.
If you use OpenID with no delegate, you're dependent on your OpenID provider working, and StackOverflow working.
If they use Passport, they're dependent on Passport.com and StackOverflow.com both being working.

If StackOverflow had their own login, you only have one dependency: itself. Clearly this is the best option if you want to optimize for availability.

And what really makes me bitter here is that the goal isn't to make their website easier or quicker or more available to use, it's just a political campaign to increase the number of people who use some crappy, poorly-designed, technology. OpenID is too crappy to succeed on its own merits, so now we have website "activists" trying to force its use... that's crummy.

Re:a site that uses nothing but OpenID

[Kent Recal]

If you have a better solution, I'd like to know what it is.

Well, I can offer the obvious solution.

Put authentication in the browser. Oh my god, what a novel idea!
Have the user enter his password once, at the beginning of the session, and create a unique token for each site from that.
Submit that token along with every request, in a HTTP-header.

No login required ever. Sites can distinguish users by their tokens (even when they're not "logged in") and a registration merely consists of connecting a token to whatever metadata (a username, address, whatever the user wants to give out to a particular site).

Paranoid users could choose to suppress the token by default and only start submitting it when they hit the "Login" button on their browser chrome - without typing in a username or password ever.

Better yet, add a bit of cryptographic trickery and these tokens can easily be revokable, updateable etc. for the cases where a password is stolen or "lost". And ofcourse browsers could easily store multiple "identities" and provide a dropdown to switch between them on the fly.

It's not rocket science, really. The whole system could be designed and spec'ed out over a weekend and would work better than anything that we had before. No third parties involved and everybody (even the data collectors) happy.

Problem? Oh, right. Getting it into the mainstream browsers... Well, give it another 20 years.

OpenID still exists?

[jandrese]

I remember when this came out. I thought to myself "I'll sign up when I run into a website that needs it." Except for this article, that was the last I'd ever heard of it. I'm amazed it is still around.

Administrator/admin?

[pondermaster]

"I've actually been quite happy with OpenID, since I have spawned far too many username/password pairs over the last 20-plus years" What's wrong with Administrator/admin everywhere? In fact, it works so great that entire Windows networks are known to use it. No problems reported so far.

What bothers me about OpenID.

[WiiVault]

I am not a user so YMMV, but I personally don't like all my eggs in one basket. I use different logins and passwords on most of the sites I visit. I hardly want a security breach on some forum I post to to be able to have access to my email or credit cards site. Centralized is great for some things, but I simply don't trust any company to be as tight with their security as I am with my own. To them a breach is a "whoops, sorry!" to me it could be personally and financially devastating.

Re:What bothers me about OpenID.

[Aladrin]

The idea behind OpenID is that the forum never has your login credentials, they just have the promise of some OpenID server that you are really you. They can never use the information they obtain to log into any other service you use with that login.

You still have to trust that OpenID server with all of your logins, but it's not like you trust every tiny site with them.

Having said that, very few sites I use will take OpenID, and some are providers only... Which is absolutely worthless. I'm waiting for something worthwhile to happen before I jump in, and I bet a lot of other people are, too.

Re:What bothers me about OpenID.

[LingNoi]

The idea is dumb, it does put your eggs all in one basket because once someone has your login credentials they have your whole online identity.

If I found out Richard Stallman's openID usr/pass I could create an account on slashdot and post shit and people would think I am him because I am using his openID identity.

That's what is so damaging about it. Not only does it give a black hat login access to your personal information all over the internet, but it also allows you to create new information under the guise of someone else potentially ruining a person's life.

Re:What bothers me about OpenID.

[roemcke]

You already have all your eggs in one basket. Virtually all online sites will send you new passwords by e-mail if you forget them. If your e-mail account get compromised, an attacker can request and intercept new passwords for any online site he wants to access.

I Wonder Why...

[bradgoodman]

Shrinking support? I wonder why...

Hmmmm...

I checked out the "Explaining OpenID" web site referenced in the article, and it didn't make a whole lot of sense.

It did tell me that my OpenID is: www.google.com/o8/id

I undoubtedly will not remember that, nor do I believe it is even accurate.

I then read how I could integrate it into my own web site - and despite doing a ton of web development and XML stuff, had no idea what they were talking about - at either a high or low level.

In conclusion - If they want to get users and developers on board with OpenID - their going to have to do a hell of a better job. Either that, I'm just too stupid to understand their "OpenID for Dummies" web site.

Now I'm of course just an engineer and developer - I'm sure users like my parents, grandparents and kids would understand this stuff much better.

Re:I Wonder Why...

[truthsearch]

The popular library for PHP is poorly documented. The API has each function documented (phpdoc), but nothing to actually get you started using the API. When we needed to do something other than the rudimentary sample code, it turned into a huge hassle. The API seems far more complicated than it needs to be.

Developers aren't going to adopt it much if they have to keep re-implementing the standard from scratch. OpenID needs to publish a well documented API for each popular language that might need it. That'll get the ball rolling faster.

It Is Not Prominantly Displayed

[phantomcircuit]

Do you see OpenID anywhere on the front page to Facebook?

There's your problem, people don't know that OpenID even exists.

A better mousetrap?

[Anonymous Coward]

but it's a major chicken-and-egg problem. Hopefully someone out there will build a better mousetrap ...

If it's a chicken-and-egg problem, wouldn't it be better to build a chicken trap, with egg catcher?

Obstacles to implementation

[pvera]

I am a web developer by trade, and so far one of the most infuriating things that I have to deal with on a weekly basis is that my customers simply can't bring themselves to care enough to remember their admin logins. Every week I have to unlock a handful of administrators. It doesn't matter if I provided them with a proper password rescue option, it is simply too much for them.

The second big problem is that we have multiple branches of certain products running at the same time, so at any given time one of my customers may have to login into her production, staging or 2-3 development servers, each with its own username and password.

We are a .net shop, so my original idea was to use the new membership and role providers and remove the login mechanism from all sites from a given customer. This works, but it is hard to get all sites in line since there is always something else going on that is more important. They still screw it up, but at least they only have to remember one username and password that works at the same level (production, staging, dev, etc.).

When I heard about OpenID I tried to see if I could implement it in any of our sites that use .net 2.0-style security. I was glad to see that somebody already had thought of this, and I found a ready to run library with a very nice login control for .net that uses OpenID.

It wasn't easy, but it was interesting, and within 10 or so hours invested I had:

1. A .net web app that used ANY OpenID instead of the built-in aspnet_* tables hierarchy.
2. A recovery page. You type your email address and it emails you a list of any OpenIDs in the system that match that email address.
3. A self-registration page. If you arrive at the web app, and you authenticate through OpenID successfully, and you don't have a local profile, it asks you to fill a quick form.
4. Security roles are used just like any standard .net app that uses the SQL membership/role providers.

The beauty of it is that I can even run my own OpenID server for my customers. All they would need to remember is that they login by typing a URL like:

userid.ouropenidserver.com

and it would do the rest for them.

One customer, three projects, three environments per project, that's nine login/password pairs that I am expecting them to remember. Instead all they need to remember is the URL and the password. If they lock themselves out, all they need to remember is the email address used to register, which emails them their OpenID URL. If they forget their password, that is handled at the OpenID provider level, not at the end user application.

Even if nobody else in the world uses it, to me it clearly means that I can spend more of my customer's money in building new things instead of on troubleshooting and damage control (even if the two figures are identical, customers will bitch more about paying for repairs than paying for work that can be recognized as new). And it is an easy concept, if they have a Google or AOL account, they already have an OpenID.

Nobody does

[coryking]

That is half the problem. It isn't an intuitive way of logging into a website. Since the days of timeshare computers, people understand "username / password". Nobody understands "URL => ????".

If you were to ask me to write the OpenID obituary, the biggest reason the protocol failed was the decision to use a URL instead of an email address. Every other failure was secondary to that one.

Um

[coryking]

The Magic URL (which is magic, actually) *IS THE USERNAME AND PASSWORD*. That is the whole point of OpenID. A website leaves the username/password business to some other guy and just trusts the protocol to make sure the Magic-URL is legit.

If you've hacked RMS's OpenID account, you can just go to any OpenID site, even if he never visited it before, and start impersonating him. That is the "benefit" of OpenID! Most of the OpenID authenticated sites out there dont have a concept of "sign up", you just go to the site, plug in your Magic URL and start doing shit. There is no email confirmation step on those site, and if there was, it would kinda defeat the whole purpose of OpenID in the first place.

And if I'm wrong in my interpretation of this, please send me to a URL that actually explains how the damn thing works. Nobody gets it and if the OpenID guys can't explain it clearly, they probably dont get it either.

That is a bug, not a feature

[coryking]

Lets say I've hacked your OpenID account. Now I can go visit sites like StackOverflow and post as you. Since they dont require email verification when you "sign-up", it doesn't matter if you had an existing account with them before I hacked you. I can go anywere that takes OpenID and "silently" impersonate you regardless of if you used the website before. No email verification means you'd probably never know it either. Well.. until you google "AvitarX" and find yourself posting horse porn on some OpenID site.