31–40 of 55 posts
The only thing that makes me use open ID is the fact that I used myopenid to create my account on stackoverflow :/ Now I want and account transfer feature on stackoverflow so that I can attach/shift from myopenid to plain simple gmail id.
I'm a believer.
I used MyOpenID instead of google/yahoo etc since after reading the article about the power of google passwd that was posted here, since I expect MyOpenID to be primarily for trivial logins.
A better question would be, for those of you who implement OpenID, Facebook Connect, etc. What's the customer percent breakdown against doing it the old fashioned (email & password) way?
Well, there should be a breakdown between FB Connect and OpenID. The login flow between those two implementations is drastically different.
I hate OpenID, but I think OAuth is actually a good idea and a workable, practical solution.
I just started using it yesterday, but I'm not quite happy. My reservation is not due to technological reasons, but to bad business models or lack of features. Gravatar support is, for example, a feature I'd like to get from my OpenID provider. After all, my image belongs to my identity. Next, with a single identity comes also privacy concerns. Automatically generated disposable E-Mail addresses for each new sign-up…
Your later concerns are solved by openid delegation. Any uri you own can be made an alias of any openid you want. Thus if you switch openid providers all you need to do is edit a page you own and make it point to a new provider. https://www.myopenid.com/help#own_domain
Earlier quoted context omitted.
Except the phishing aspects make it worse for inexperienced users, since an arbitrary website can redirect to a page that asks for a potentially more sensitive username/password, and that's actually considered normal flow. I don't understand how anyone can promote OpenID in good conscience with this glaring hole in the design. You simply can't rely on user education.
I've been saying this the whole time and nobody seems to view it as a serious problem. Sure, there are users who will use the same username and password on every site, and there's no hope for them. However, there is a class of users who might think with openid they can use the same credentials for their bank as they do for facebook, but not know to check for valid ssl certificates and nefarious proxying. Can someone…
When you 'sign up' you would just provide you public key to the website (upload or url). Then when you were presented with a login, the browser would be sent a data set to sign with your private key and send back to the server you are trying to access (which would then verify with you public key).
Lately I've been thinking that what we really need is something based on PGP/GnuPG. Think about it. If the browser implemented access to your keychain, then you could use your keys as login. When you 'sign up' you would just provide you public key to the website (upload or url). Then when you were presented with a login, the browser would be sent a data set to sign with your private key and send back to the server yo…
My main frustration right now is that, aside from Bouncy Castle, all the libraries I've looked at to do cryptography seem to just be partially implemented wrappers around GnuPG.
I use it if have to. Prefer the choice of selecting different names/passwords for different sites.
I use it (only for StackOverflow) but I don't think it's better or worse than normal logins. Sometimes it's a pain because I always have to do extra clicks to get logged in.