Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

37Signals to retire OpenID for logins on May 1

productblog.37signals.com

Post reply on HN
Print view View original

101–110 of 118 posts

Re: 37Signals to retire OpenID for logins on May 1

#101

Post by rsingel »

nika wrote: post #15
msy wrote: post #5

Earlier quoted context omitted.

That particular holy grail is a poisoned chalice and it's claimed plenty of victims, anyone remember Sxip? It's not a technical problem, it's power, control and ownership. Anyone in a position to allow a platform to get serious traction isn't going to give that control up and anyone that isn't can't make a system with enough traction. Then there's issues of trust, delegation and longevity. I'd love someone to do it w…

The department of commerce wants to create such an identity system. I'm not sure I like the idea, but it would be "single sign on". I think it is a safe bet that their intention is to eventually make it mandatory, and they have the "ownership", presumed trust, and longevity, not to mention the ability to pass laws "encouraging" adoption. There are probably better news reports out there, but this is what I found with…

No, the Department of Commerce wants to help create a standard. It's a damn hard task, but even harder when the net's FUD is the feds want to create an identity system. No, no they don't. And their process is pretty great. But they will fail, in no small part due to FUD, and we'll all be using Facebook Login Plus soon and wondering why we never got an open standard.

Re: 37Signals to retire OpenID for logins on May 1

#102

Post by icarus_drowning »

Fice wrote: post #20

What exactly are OpenID usability issues? I personaly prefer to use OpenID where it is available, yet I don't use any login provider but a php script on my own website.

I use a TondioPlug[1] as a provider, and I've never had a problem with it. It is simple to use and doesn't require me to know anything about how OpenID works.

I suspect that until things like a TondioPlug become useful for a lot of people, (if they ever do) asking people to be their own provider will be a lost cause.

[1]http://www.tonidoplug.com/tonido_plug.html

Re: 37Signals to retire OpenID for logins on May 1

#103

Post by tbrownaw »

lukev wrote: post #44

The only ultimate, secure, technically valid solution to single sign-on is 2-way SSL. Unfortunately, for this to work, several things need to happen: 1) Users need to learn what a private key is. 2) Browsers need to provide flexible, intuitive, easy-to-use user key support that's not tucked away in 3 levels of dialogs/tabs. 3) We need good key-management tools so I can log on to sites from internet cafes, etc (perhap…

> We need good key-management tools so I can log on to sites from internet cafes, etc (perhaps a session-lived key cache in the browser, with support for syncing it remotely?)

Giving out your private keys like that (what, you actually trust an internet cafe computer?) is a rather bad idea. Instead have a service that your local client can authenticate to (with a normal password if you trust your client, or rsa keyfob, or application that makes your phone act like a keyfob), that acts vaguely like either ssh-agent (with the connection established in the opposite direction) or a kerberos KDC (which would let you not need to keep track of privkeys).

Re: 37Signals to retire OpenID for logins on May 1

#104

Post by jackolas »

jdp23 wrote: post #25
dhh wrote: post #8

Earlier quoted context omitted.

The key problem didn't come from people NOT using OpenID, but from the people who did. Supporting OpenID is a nightmare. You have different relaying services that go up and down (OpenID's answer is: "use more than one" - ha!), various levels of incompatibility, and a generally user hostile experience. If OpenID usage had been in any serious numbers, our support department would have revolted. If you're trying to buil…

For any individual company, economics favor a proprietary single sign-on (37signals ID). OpenID was not successful in changing that equation. RPX, by contrast, appears to have done so successfully for a lot of people.

http://www.janrain.com/products/engage

Looks like they renamed it... seems proprietary?

Re: 37Signals to retire OpenID for logins on May 1

#105

Post by Duff »

didip wrote: post #37

I never quite get the idea of OpenID. It's like outsourcing the front door of your Italian restaurant business. Furthermore, when using OpenID, users have to remember yet another type of token. As opposed to the ubiquitous email+password.

It's more like a restaurant hiring a third party to handle billing without you needing to collect cash or hold consumer receivables. (ie. credit cards)

Who do you trust more to control who can use your identity? A gossip blog like Gawker Media? Or a place like Google, Verisign, etc who employs real security experts who know what they are doing.

I have a PayPal token so that I can use two-factor authorization for my account. Since Verisign PIP is powering that solution, I also now have a two-factor openid that I can use anywhere. So if I decide that I want to have additional protection for my StackOverflow or Tripit accounts -- I can.

Re: 37Signals to retire OpenID for logins on May 1

#106

Post by [deleted] »

Duff wrote: post #69

I'm surprised that 37signal's thought process is so utterly flawed. Blaming a technology for implementation problems just doesn't make sense. Using this logic, we would have concluded in 1997 that since Geocities pages were ugly and slow, HTTP was a waste of time. StackOverflow demonstrates aptly that OpenID is a technology that can work really well. You just need to: - Funnel users to pervasive, competent providers…

[deleted]

Re: 37Signals to retire OpenID for logins on May 1

#107

Post by rahoulb »

lukev wrote: post #59
eli wrote: post #54

Earlier quoted context omitted.

Anything that starts with, users need to learn seems doomed to fail.

Not if it provides a significant-enough benefit. How many people had "passwords" as a daily part of their life before 1995 or so? Every technology is new at some point. My thesis is that keys are not that hard and technical people should actually try to push understanding of them into the non-techie realm. If they fail, they fail, but if they succeed, it would make all computing so much more secure. Edit: I should al…

Kids have used passwords in games for years. everyone's seen spy movies. the story of alladin is part of popular culture.

but "here is a thing in two parts, one of which you give to everyone but one of which you need to keep absolutely to yourself or you're screwed" doesn't have a common analogy. even the "i give you an open box with a padlock" analogy can feel a bit contrived.

However I also feel that there was no cohesive attempt at building a similar story for OpenID - which is a shame as it could be as simple as "tell us which site you want to log in via and we'll do the rest"

Re: 37Signals to retire OpenID for logins on May 1

#108

Post by noss »

nika wrote: post #15
msy wrote: post #5

Earlier quoted context omitted.

That particular holy grail is a poisoned chalice and it's claimed plenty of victims, anyone remember Sxip? It's not a technical problem, it's power, control and ownership. Anyone in a position to allow a platform to get serious traction isn't going to give that control up and anyone that isn't can't make a system with enough traction. Then there's issues of trust, delegation and longevity. I'd love someone to do it w…

The department of commerce wants to create such an identity system. I'm not sure I like the idea, but it would be "single sign on". I think it is a safe bet that their intention is to eventually make it mandatory, and they have the "ownership", presumed trust, and longevity, not to mention the ability to pass laws "encouraging" adoption. There are probably better news reports out there, but this is what I found with…

I wonder how much different their project is to the bank-id and e-legitimation used in Sweden.

Re: 37Signals to retire OpenID for logins on May 1

#109

Post by cgart »

Indeed, I also think that OpenID is not designed well. I mean, I have tried to implement it already twice. And everytime, I think, I got the idea of OpenID, later I realize, no I still didn't got real wht it tries to do.

What is wrong in that a spammer could easily host its own OpenID server and log in with that account on numerous sites. You even can write scripts to do it automatically, so I didn't really get the idea of OpenID.

I think in the future we get OAuth as the winner. Yes, its main purpose is different, however "signing in" with OAuth is so much easier. Even a simple user can understand how it works. And by implicit use of only specific OAuth providers (where you registered your app), you close the door for "bot"-providers. Of course one can argue, that you can also force to use only specific OpenID providers, but this is not core idea of what OpenID was created for.

Re: 37Signals to retire OpenID for logins on May 1

#110

Post by blasdel »

jasonjei wrote: post #38

It's a shame that CAS for multitenant apps never really took off. We have an integrated CAS and OpenID server to handle single-sign on for all our apps, and losing OpenID will mean an additional username/password for our people to remember for Highrise. We are probably going to write our own CRM at this point.

CAS is definitely somewhat less of a clusterfuck than OpenID, and actually gets the SSO cookie-handling part right.

But it's still a pile of redirects where the net result is that you can tie a user to their identifier and nothing more — it's mostly useless without implementing it paired with an LDAP/AD backend to get group membership and whatnot.

Just not storing a password field in your backend does nothing — you really have to get rid of the per-app account models entirely. WebFinger is a nice step along these lines, but it layers on top of OpenID and even then still doesn't provide the complete picture.

Post reply on HN