81–90 of 118 posts
Earlier quoted context omitted.
I think Zed Shaw is on this for some time. http://autho.me/
Shouldn't his login page be HTTPS? Or does the cryptography make that redundant?
http://news.ycombinator.com/item?id=2083774 http://www.curated.by/splaice/zed-shaw--dan-kaminsky-talk-ab...
Totally understandable, one of the worst executed visions of all times. I think there's a really huge opportunity in this space, and the first who'll be able to figure out the perfect (and, most importantly, simplest) way to offer a single-sign-on, integrating privacy and security features, will be hugely thanked.
I don't know why this couldn't be done via the normal RFC process. I can imagine a version of this done with something based (very roughly) on DNS.
I use openid not to have a single signon to 37signals apps. I use to to have a single signon period. Not just 37signals but a ton of other apps use it as well (and I wish all of them did). Every time I see a web app supporting openid Im glad that I don't have to invent yet another user/password combo. again. As to failing openid providers I have a good suggestion - use OpenId delegation to have a single openid that y…
The problem is most people don't bother doing this; they just trust every site with the same password. The benefit I see in OpenID is that it is not a secret, and canot be "compromised" (intentionally or not) in the same way as passwords.
(I also am one of the few, it seems, to use OpenID for my 37signals account)
Earlier quoted context omitted.
For most users I talk to, an email address (rather than a URL) is how they think of identifying themself in a cross-system way. Orienting the spec around that would have made a huge difference. Were there HCI experts a big part of the community that put together the vision and architecture? How diverse (tech background, language, age) was the original community? Both of those are areas that could have made a big diff…
Why haven't more people migrated to WebFinger for identity? http://www.readwriteweb.com/archives/google_enables_webfinge... It uses your email address, and seems to offer a good way to get access to an OpenID-like sign in (maybe this is using OpenID or OAuth under the covers?)
Earlier quoted context omitted.
I don't know why this couldn't be done via the normal RFC process. I can imagine a version of this done with something based (very roughly) on DNS.
Oh, yeah. Tie it to email addresses; let any domain publish an SRV record pointing to its ID server. Then all you have to know is your email address, not your OpenID URL.
Earlier quoted context omitted.
I actually like this model too ... you're never going to get everybody to use one provider for storing their identities, because nobody will go and create one unless they absolutely need to. So, it makes sense to go where users are. What I think needs to be done is standardize an api for the sites like twitter, facebook, Google and who-knows-what-in-the-future to use in providing accessing to user information to deve…
> What I think needs to be done is standardize an api for the sites like twitter, facebook, Google and who-knows-what-in-the-future to use in providing accessing to user information to developers It is my understanding that that's pretty much exactly what OpenID is.
I just think Open ID was over elaborate, I'm hoping something simpler could succeed where it has failed. Hope that makes sense.
Earlier quoted context omitted.
"one of the worst executed visions of all times" What could have been done better? I'll tell you what it should look like (the fact that it's impossible is not the point): whenever I land on a site that asks me to login, I get a menu of all my possible accounts, I pick one, and I'm in. End of the story. Kind of like Dropbox being simple and intuitive when everyone else was building overly complex stuff.
Can't be impossible since it was done: http://www.clickpass.com/ Nice implementation, poor sales/marketing.
Most websites simply can't see enough of a bang for an engineering buck they could be spending on something else (i.e. they don't even want to install it, never mind pay for it) and if it's done well consumers don't even see it so there's no money to be had from them either.
I'm sure we could have made it all slicker still but even Facebook login takes some justification and Clickpass didn't deliver anything like the value that that does.
Earlier quoted context omitted.
> What I think needs to be done is standardize an api for the sites like twitter, facebook, Google and who-knows-what-in-the-future to use in providing accessing to user information to developers It is my understanding that that's pretty much exactly what OpenID is.
a. Open ID is a protocol not an api ... I'm talking about something more akin to the old way twitter used to verify twitter logins in their api b. Open ID deals mainly with authentication ... I'm talking about both authenticating and providing access to limited user information ... email, name, phone ... that sort of thing. I just think Open ID was over elaborate, I'm hoping something simpler could succeed where it h…
Now if we could just kill off this facebook/twitter/nextbigthing login nonsense and use email like proper gentlemen things will be just peachy.
Until you change ISPs and your ISP provided email address goes away. Sure you could say use gmail or yahoo mail, and that is obviously just fine until they become "evil" or go out of business. Or heck you get your own domain and want to migrate over to using it for email. I have had a number of email addresses over the years and most of the old ones I have lost access to, how does that work again?
Earlier quoted context omitted.
But the value of OpenID is that it isn't a single system. Anybody can be an OpenID provider, including me with the box sitting in my basement.
I believe that part of that design is what's so confusing to non-technical users. If somebody were to tell them that 'the box in your basement' could be used to verify access to their banking website, you'd completely lose them. Granted, its an implementation they'd likely never encounter, but the fact that its possible just contributes to the noise around OpenID.