Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing BrowserID: A better way to sign in

identity.mozilla.com

Post reply on HN
Print view View original

71–80 of 188 posts

Re: Introducing BrowserID: A better way to sign in

#71

Post by ignifero »

TillE wrote: post #69
SeoxyS wrote: post #52

They seriously need to work on their communication skills. It took me a good 15min to figure out what this thing actually does. And I'm still not sure I got it right. OpenID failed because it was too complicated for mere mortals. This, I fear, may be too confusing. At least form the way it's presented. After reading the protocol spec, I have a somewhat better understanding of this. If I got this right, this is basica…

How did OpenID fail (it's widely used)? How is it complicated for the user? Properly implemented, OpenID looks like this to the user: http://springpadit.com/login And something like this for the average developer: https://github.com/omab/django-social-auth

Do an online poll and ask people "Do you know your openID" vs "Do you know your email". Users are trained to use emails for login, and that's a significant investment already.

Re: Introducing BrowserID: A better way to sign in

#72

Post by stickfigure »

bct wrote: post #55
stickfigure wrote: post #34

One huge problem: Email address != identity. I should be able to change my email address (and/or email hosting provider) without changing my identity on a bazillion sites around the internet. Facebook got this right from the beginning. Google is sort-of getting this, although the chasm between Google Accounts and Google Apps Accounts makes this really messy. Really this product should be called BrowserEmailAddress, n…

> Facebook got this right from the beginning. What a weird double-standard. A feature of email (that you can have several, and you can change which one you use) is a failure, and a failure of Facebook (that it's one site, forever) is a feature? We're all familiar with ways to migrate from one email address to another. If/when you leave Facebook/it disappears, how will you migrate your identity then?

Email is a tool whose value lies primarily in my ability to communicate with other users. Many people (including me) have several email addresses that we use for different purposes. That an email address can be used as an identity is something of an afterthought, and doesn't really fit into the "have multiple email accounts for different communication purposes" paradigm.

My Facebook account is an identity first and foremost. People do not typically have multiple Facebook accounts (a TOS violation). If that account goes away, that identity goes away.

You might make an argument that websites should allow you to aggregate multiple identities (Facebook, Google+, MS, Yahoo, etc) into a single account, or that there should be some sort of an identity provider that creates an aggregate identity across all those services. To an extent some of these websites are already doing something like this peer-to-peer - Facebook is an OpenID consumer, for example. Maybe sometime in the future this will be a big issue. But right now it isn't, and email-as-identity is already an annoying problem.

Re: Introducing BrowserID: A better way to sign in

#73

Post by TillE »

ignifero wrote: post #71
TillE wrote: post #69

Earlier quoted context omitted.

How did OpenID fail (it's widely used)? How is it complicated for the user? Properly implemented, OpenID looks like this to the user: http://springpadit.com/login And something like this for the average developer: https://github.com/omab/django-social-auth

Do an online poll and ask people "Do you know your openID" vs "Do you know your email". Users are trained to use emails for login, and that's a significant investment already.

That was a brief failure of communication when OpenID was new.

Have a Google or Yahoo account? Your email address is your OpenID. Of course nobody is going to manually enter an OpenID URL. Why would they need to?

Re: Introducing BrowserID: A better way to sign in

#74

Post by [deleted] »

stickfigure wrote: post #72
bct wrote: post #55

Earlier quoted context omitted.

> Facebook got this right from the beginning. What a weird double-standard. A feature of email (that you can have several, and you can change which one you use) is a failure, and a failure of Facebook (that it's one site, forever) is a feature? We're all familiar with ways to migrate from one email address to another. If/when you leave Facebook/it disappears, how will you migrate your identity then?

Email is a tool whose value lies primarily in my ability to communicate with other users. Many people (including me) have several email addresses that we use for different purposes. That an email address can be used as an identity is something of an afterthought, and doesn't really fit into the "have multiple email accounts for different communication purposes" paradigm. My Facebook account is an identity first and f…

[deleted]

Re: Introducing BrowserID: A better way to sign in

#75

Post by ignifero »

riffraff wrote: post #70
ignifero wrote: post #50

You can try it live at http://textchannels.com/ . I like it , it's pretty simple and neat. Easier than oauth login.

can you explain why this is easier than oauth?

- No need to register your application with browserid.org

- No need to use an oauth library (just 1 GET request)

- Oauth provides access to user data on the provider, while browserID provides no data. Less anxiety for the users.

- No request_token/access_token pairs

- In the future, the user will (hopefully) be able to change his default browserid and as a developer you just don't care.

Re: Introducing BrowserID: A better way to sign in

#76

Post by paulosman »

stickfigure wrote: post #72
bct wrote: post #55

Earlier quoted context omitted.

> Facebook got this right from the beginning. What a weird double-standard. A feature of email (that you can have several, and you can change which one you use) is a failure, and a failure of Facebook (that it's one site, forever) is a feature? We're all familiar with ways to migrate from one email address to another. If/when you leave Facebook/it disappears, how will you migrate your identity then?

Email is a tool whose value lies primarily in my ability to communicate with other users. Many people (including me) have several email addresses that we use for different purposes. That an email address can be used as an identity is something of an afterthought, and doesn't really fit into the "have multiple email accounts for different communication purposes" paradigm. My Facebook account is an identity first and f…

"My Facebook account is an identity first and foremost."

Now imagine 5 years ago you said "My Friendster account is an identity first and foremost."

Re: Introducing BrowserID: A better way to sign in

#78

Post by ignifero »

51Cards wrote: post #47
latchkey wrote: post #33

This is full of fail. Your email address is not your identity. I must be able to change my email address without having to change my identity.

It's not that simple. They authenticate against your Account at Browser ID. I would assume you can go into Browser ID and add / remove email addresses from your account which makes it even easier when you change your email. Now you don't have to visit 20 different sites to update them.

The implementation at browserid.org returns the email only. So there's no way to change the email without visiting all the sites you've registered in using browserid.

Re: Introducing BrowserID: A better way to sign in

#79

Post by stickfigure »

paulosman wrote: post #63
stickfigure wrote: post #44

Earlier quoted context omitted.

Sure, every website can implement this flow, and users could could go to every website they've ever logged into and update their email address... assuming it all works properly even though they might not have access to the old email address anymore. At the very best this technology offers considerably less value to websites and more hassle to users than Facebook or Google. And it's about 5 years too late.

"Sure, every website can implement this flow, and users could could go to every website they've ever logged into and update their email address... assuming it all works properly even though they might not have access to the old email address anymore." And how is this different than the current situation? Nearly all web sites require an email address. With BrowserID, you at some point confirmed ownership of that email…

Fast forward another ten years. Do you really think typical websites will still ask people to create usernames and passwords? I predict that the current trend of "offload that crap to Facebook/Google/BrowserID" will continue. Even BrowserID.org makes that assumption.

The question is whether a BrowserID identity is as useful as one of the established identity providers. You start out with a chicken-and-egg problem; websites won't consume BrowserID if users aren't using it, and users won't use it if websites aren't asking for it. What will overcome this Catch-22? Techwise, the dependence on email seems less compelling than Facebook or Google auth.

Maybe BrowserID can rely on mass distrust of Facebook and Google. I'm not sure that's sufficient though - especially with Google.

Re: Introducing BrowserID: A better way to sign in

#80

Post by riffraff »

ignifero wrote: post #75
riffraff wrote: post #70

Earlier quoted context omitted.

can you explain why this is easier than oauth?

- No need to register your application with browserid.org - No need to use an oauth library (just 1 GET request) - Oauth provides access to user data on the provider, while browserID provides no data. Less anxiety for the users. - No request_token/access_token pairs - In the future, the user will (hopefully) be able to change his default browserid and as a developer you just don't care.

thanks, I thought you meant it was easier _as an end user_ and could not see why.
Post reply on HN