Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

37Signals to retire OpenID for logins on May 1

productblog.37signals.com

Post reply on HN
Print view View original

111–118 of 118 posts

Re: 37Signals to retire OpenID for logins on May 1

#111

Post by brlewis »

petenixey wrote: post #87
brlewis wrote: post #55

Earlier quoted context omitted.

Can't be impossible since it was done: http://www.clickpass.com/ Nice implementation, poor sales/marketing.

It's kind of you to say but the reason our sales and marketing was poor was that we couldn't figure out what we were selling or marketing. Try as we might we couldn't figure out who really wanted it and where to make money. Most websites simply can't see enough of a bang for an engineering buck they could be spending on something else (i.e. they don't even want to install it, never mind pay for it) and if it's done w…

For early adopters who try out lots of different sites, Clickpass would be a big win for both the users and the sites. Once the early adopters are doing it, everybody else will see the convenience.

Re: 37Signals to retire OpenID for logins on May 1

#112

Post by jarek »

trustfundbaby wrote: post #96
jarek wrote: post #88

Earlier quoted context omitted.

You think OpenID was over elaborate but want to provide the user's phone number?

You're missing the point. I'm advocating for a general direction ... I don't have specifics.. Its not crazy. Facebook just announced something along those lines today http://marketaire.com/2010/12/23/facebook-registration-tool/

> Its not crazy. Facebook just announced something along those lines today

Yep, and it's not exactly a standardized API, neither would it be easy to move a system built on this to the next greatest thing from Twitter or Google. User data lock-in is nice like that.

Re: 37Signals to retire OpenID for logins on May 1

#113

Post by jarek »

rahoulb wrote: post #107
lukev wrote: post #59

Earlier quoted context omitted.

Not if it provides a significant-enough benefit. How many people had "passwords" as a daily part of their life before 1995 or so? Every technology is new at some point. My thesis is that keys are not that hard and technical people should actually try to push understanding of them into the non-techie realm. If they fail, they fail, but if they succeed, it would make all computing so much more secure. Edit: I should al…

Kids have used passwords in games for years. everyone's seen spy movies. the story of alladin is part of popular culture. but "here is a thing in two parts, one of which you give to everyone but one of which you need to keep absolutely to yourself or you're screwed" doesn't have a common analogy. even the "i give you an open box with a padlock" analogy can feel a bit contrived. However I also feel that there was no c…

Public key = your address. Private key = the key to the front door.

Re: 37Signals to retire OpenID for logins on May 1

#114

Post by jasonjei »

blasdel wrote: post #110
jasonjei wrote: post #38

It's a shame that CAS for multitenant apps never really took off. We have an integrated CAS and OpenID server to handle single-sign on for all our apps, and losing OpenID will mean an additional username/password for our people to remember for Highrise. We are probably going to write our own CRM at this point.

CAS is definitely somewhat less of a clusterfuck than OpenID, and actually gets the SSO cookie-handling part right. But it's still a pile of redirects where the net result is that you can tie a user to their identifier and nothing more — it's mostly useless without implementing it paired with an LDAP/AD backend to get group membership and whatnot. Just not storing a password field in your backend does nothing — you r…

We have the CAS server return a hash in extraAttributes called "MemberOf" that returns every group the user is a member of. I do feel that the next version of CAS should formally address this as part of the main spec. But our MemberOf is paired to AD; but I'm sure it could be configured to work with a non-AD data store.

Re: 37Signals to retire OpenID for logins on May 1

#115

Post by drdaeman »

skomorokh wrote: post #67

I just skimmed the comments thread and have a vague idea of what OpenID is but haven't gotten around to it yet. Sounds great, Yahoo/Google/Facebook take your pick with a button or if you're hacker/paranoid enough to have your own infrastructure the slightly complexity of using a URL? Main complaint seems to be it's URL and not user@host? Couldn't one just add support for user@host into the next iteration of the stand…

37signals do not care about decentralisation. It is as simple as that.

Re: 37Signals to retire OpenID for logins on May 1

#117

Post by bane »

simonw wrote: post #10
stefanobernardi wrote: post #3

Totally understandable, one of the worst executed visions of all times. I think there's a really huge opportunity in this space, and the first who'll be able to figure out the perfect (and, most importantly, simplest) way to offer a single-sign-on, integrating privacy and security features, will be hugely thanked.

"one of the worst executed visions of all times" What could have been done better? I spent a couple of years advocating for OpenID adoption, because I believed that the alternative (one or two companies controlling login for the entire Web, ala Microsoft Passport or Facebook Connect) would be a massive blow to the decentralised nature of the internet. I believed that OpenID's usability issues could be resolved if eno…

As a user, logging in with OpenID is a huge PIA compared to normal login procedures.

Re: 37Signals to retire OpenID for logins on May 1

#118

Post by mgedmin »

cgart wrote: post #109

Indeed, I also think that OpenID is not designed well. I mean, I have tried to implement it already twice. And everytime, I think, I got the idea of OpenID, later I realize, no I still didn't got real wht it tries to do. What is wrong in that a spammer could easily host its own OpenID server and log in with that account on numerous sites. You even can write scripts to do it automatically, so I didn't really get the i…

OpenID doesn't replace user accounts. It replaces account passwords. A site, instead of verifying a user's password, contacts the user's OpenID provider asking them to verify the user's identity.

Instead of using the same username + password combination for all the sites on the Internet (and suffering from Gawker-like incidents), or writing down a bazillion passwords in my keyring, I use my OpenID when I want to comment on random people's blogs or sites like StackOverflow.

Post reply on HN