37Signals to retire OpenID for logins on May 1 • Hacker News Board

Re: 37Signals to retire OpenID for logins on May 1

#41

Post by jarek » Tue, Jan 25, 2011, 5:33 PM UTC

trustfundbaby wrote: post #28

seanalltogether wrote: post #4

"Login with Facebook, Login with Twitter" <- these are your new single sign on providers. I wonder if in the future they'll try to standardize these login providers and the information they share, we can call the new standard Open...something...ID...no...OpenLogin, there we go.

I actually like this model too ... you're never going to get everybody to use one provider for storing their identities, because nobody will go and create one unless they absolutely need to. So, it makes sense to go where users are. What I think needs to be done is standardize an api for the sites like twitter, facebook, Google and who-knows-what-in-the-future to use in providing accessing to user information to deve…

> What I think needs to be done is standardize an api for the sites like twitter, facebook, Google and who-knows-what-in-the-future to use in providing accessing to user information to developers

It is my understanding that that's pretty much exactly what OpenID is.

Re: 37Signals to retire OpenID for logins on May 1

#42

Post by patrickaljord » Tue, Jan 25, 2011, 5:34 PM UTC

riobard wrote: post #30

Fice wrote: post #20

What exactly are OpenID usability issues? I personaly prefer to use OpenID where it is available, yet I don't use any login provider but a php script on my own website.

The problem is that the number of people hosting their own OpenID solutions is, and will be, rather insignificant.

It doesn't matter when yahoo, google, aol and more offer openid, it's just a click on a button, what could be easier than that? I agree that entering a whole URL is horrible though but that's not how I use openid, I just click on the google button and that's it, just like facebook or twitter connect.

Re: 37Signals to retire OpenID for logins on May 1

#43

Post by [deleted] » Tue, Jan 25, 2011, 5:36 PM UTC

dhh wrote: post #14

peregrine wrote: post #12

I think I'm starting to understand 37signals advertising strategy through DHH tweets, that admittedly only works because they have listeners. 1) Tweet negative/positive questions about x. 2) Tweet negative/positive observations about x. 3) Tweet negative/positive observation backed by data about x. 4) Tweet article about how positive/negative x is on blog. 5) Take action about positive/negative x. Usually over the sp…

I wish I could brand that as a fancy marketing scheme, but I think the answer is much simpler. It's simply transparent discovery and thinking. If it happens to work as advertising, that's a positive side-effect, but the main dish is coming to good conclusions. I certainly grew more confident in the decision to dump OpenID after talking with lots and lots of people on Twitter about it. You get to test your ideas, see…

[deleted]

Re: 37Signals to retire OpenID for logins on May 1

#44

Post by lukev » Tue, Jan 25, 2011, 5:38 PM UTC

The only ultimate, secure, technically valid solution to single sign-on is 2-way SSL.

Unfortunately, for this to work, several things need to happen:

1) Users need to learn what a private key is.

2) Browsers need to provide flexible, intuitive, easy-to-use user key support that's not tucked away in 3 levels of dialogs/tabs.

3) We need good key-management tools so I can log on to sites from internet cafes, etc (perhaps a session-lived key cache in the browser, with support for syncing it remotely?)

Re: 37Signals to retire OpenID for logins on May 1

#45

Post by antidaily » Tue, Jan 25, 2011, 5:38 PM UTC

I still like OpenID for smallish projects and blog commenting. While people are ok with creating a username and password for a 37signals product, I doubt they're interested in creating one for something that tell my friends on facebook and twitter what my favorite color is.

Re: 37Signals to retire OpenID for logins on May 1

#46

Post by theBobMcCormick » Tue, Jan 25, 2011, 5:41 PM UTC

patrickaljord wrote: post #42

riobard wrote: post #30

Earlier quoted context omitted.

The problem is that the number of people hosting their own OpenID solutions is, and will be, rather insignificant.

It doesn't matter when yahoo, google, aol and more offer openid, it's just a click on a button, what could be easier than that? I agree that entering a whole URL is horrible though but that's not how I use openid, I just click on the google button and that's it, just like facebook or twitter connect.

StackOverflow is a good example (IMHO) of OpenID login done right. It's so easy to sign up for a StackOverflow account, and I don't have to remember or write down yet another fucking password!

IMHO, one of the things they do correctly is that the user doesn't have to remember an OpenID url in most cases, just click on the logo for which of your likely ID providers (Google, Facebook, Yahoo, etc.) that you want to use. What could possibly be easier or friendlier for the end user?

Re: 37Signals to retire OpenID for logins on May 1

#47

Post by psadauskas » Tue, Jan 25, 2011, 5:46 PM UTC

I wrote a blog post[1] last week about a better solution for handling auth. The tldr version is that our user agents need to be doing a better job of managing authorization and multiple accounts for us. I posted it here on HN[2], but didn't get much traction on a Friday afternoon.

[1]: http://blog.theamazingrando.com/the-road-to-better-authoriza... [2]: http://news.ycombinator.com/item?id=2128966

Re: 37Signals to retire OpenID for logins on May 1

#48

Post by mbrubeck » Tue, Jan 25, 2011, 5:48 PM UTC

jacquesm wrote: post #40

alain94040 wrote: post #24

Earlier quoted context omitted.

"one of the worst executed visions of all times" What could have been done better? I'll tell you what it should look like (the fact that it's impossible is not the point): whenever I land on a site that asks me to login, I get a menu of all my possible accounts, I pick one, and I'm in. End of the story. Kind of like Dropbox being simple and intuitive when everyone else was building overly complex stuff.

Ok, it's impossible. Now tell me how you're going to do it anyway and laugh all the way to the bank. The fact that you can conceive of it means that it likely isn't impossible, merely very difficult and possibly non-obvious. But that's how pretty much every real success story starts. You really may be on to something here.

This could be possible if web browsers (not just web sites) were aware of the standard and participated in the UI flow. Mozilla Labs prototyped something along these lines (not targeted for inclusion in Firefox 4, but possibly for the next release):

http://hacks.mozilla.org/2010/04/account-manager-coming-to-f...

Re: 37Signals to retire OpenID for logins on May 1

#49

Post by jokermatt999 » Tue, Jan 25, 2011, 5:48 PM UTC

alain94040 wrote: post #24

simonw wrote: post #10

Earlier quoted context omitted.

"one of the worst executed visions of all times" What could have been done better? I spent a couple of years advocating for OpenID adoption, because I believed that the alternative (one or two companies controlling login for the entire Web, ala Microsoft Passport or Facebook Connect) would be a massive blow to the decentralised nature of the internet. I believed that OpenID's usability issues could be resolved if eno…

"one of the worst executed visions of all times" What could have been done better? I'll tell you what it should look like (the fact that it's impossible is not the point): whenever I land on a site that asks me to login, I get a menu of all my possible accounts, I pick one, and I'm in. End of the story. Kind of like Dropbox being simple and intuitive when everyone else was building overly complex stuff.

Isn't this kind of what Blogspot does? I'm not very firm on the background, but generally when I go to post a comment on a Blogspot/Blooger site, I'm given a choice of either my Google account or OpenID, with openID being a choice of several favicons (Yahoo, Google again, etc).

Re: 37Signals to retire OpenID for logins on May 1

#50

Post by moe » Tue, Jan 25, 2011, 5:53 PM UTC

theBobMcCormick wrote: post #46

patrickaljord wrote: post #42

Earlier quoted context omitted.

It doesn't matter when yahoo, google, aol and more offer openid, it's just a click on a button, what could be easier than that? I agree that entering a whole URL is horrible though but that's not how I use openid, I just click on the google button and that's it, just like facebook or twitter connect.

StackOverflow is a good example (IMHO) of OpenID login done right. It's so easy to sign up for a StackOverflow account, and I don't have to remember or write down yet another fucking password ! IMHO, one of the things they do correctly is that the user doesn't have to remember an OpenID url in most cases, just click on the logo for which of your likely ID providers (Google, Facebook, Yahoo, etc.) that you want to use…

StackOverflow is a good example (IMHO) of OpenID login done right.

The problem is that StackOverflow is also about the only example of OpenID done right, or done at all...

Yes, there are a few others. But at least in my internet usage I hardly ever run into one. I can't remember having used my OpenID for any site other than SO in the past couple years.