Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have seen this question on Quora where lots of people seem to agree that OpenID is bad, even going as far as stating that:

OpenID is the worst possible "solution" I have ever seen in my entire life to a problem that most people don't really have

Then I've seen articles and tweets referencing that question saying that OpenID has lost, and Facebook won.

It's sad to read as I quite like the OpenID (or at least idea behind it). I literally hate getting yet another login/password for page (I'll forget it anyway) - it's a pretty serious issue for me and I know lots of people with the same problem. Thus I thought that OpenId is a great solution but I'm not sure anymore.

So the question is should I still bother to implement OpenID or it's not worth it? What is the most robust and convenient (from the user perspective) way to identify and authenticate an user?

share|improve this question
7  
OpenID has its flaws, but since I haven't heard of anything better to replace it, I wouldn't say that it lost. Facebook isn't an alternative for OpenID, since it's centralized and a lot of people simply don't want to have a facebook account. Is it worth the effort? In my subjective opinion, it is. –  Mewp Feb 21 '11 at 12:53
add comment

migrated from stackoverflow.com Feb 21 '11 at 14:01

This question came from our site for professional and enthusiast programmers.

5 Answers

Can't you implement BOTH?

Everyone picks the option based on his preference and paranoia state.

OpenID provide great convenience. It also provide even more massive security risk.

[User risk] What if Facebook/Google/etc. decide your account has been compromised and you need to give your phone number or a passport copy to reenable it? Would you go for it?

[Company risk] What if Facebook/Google/etc. decide to shut down their service or start charging for it? Then as a site owner you're massively screwed.

[Data espionage] Why let them gather the detailed statistics from many consumer site and help them build personal profiles of people? Who knows what they'll do with it? Sell it, use it to adjust their marketing tactics, submit it to CIA?

Man, it's so basic and simple - avoid getting dependent on anybody and decide for yourself what when and if will happen to you.

share|improve this answer
    
I could go and implement both, that's true. I could add support for any OpenID provider via URL, then list 3-4 most popular ones, then add OAuth support for Facebook and Twitter and then add my own old (good?) login/password/email registration/login form for users that don't mind yet another password.The thing is I don't want to scare my users - I just want them to be able to sign in swiftly. As for the security risks mentioned - are these really that massive? –  DoPPler Feb 21 '11 at 14:56
    
The probability of their occurring is not massive, but if they do happen their consequences will be massive. –  user8685 Feb 22 '11 at 19:21
4  
Anyway just keep in mind that many people don't have a Facebook account and won't create it. It is not wise to deny them access. –  user8685 Feb 22 '11 at 19:22
    
Many good points here @Developer Art about not being dependent on a single provider, for business and for an individual. Disqus and Wordpress comment systems have realized that, they give admins (and users) a choice of OpenID, Yahoo, Google, Facebook, Twitter, maybe more. And offer the opportunity to associate ID's but don't require it. 2nd good point: Avoid letting one entity aggregate your information! So true. It may happen anyway. Why make it easier by using same provider every time? Also: all-Facebook, ONLY Facebook world is NOT the solution! Wish I could give you more upvotes. –  Feral Oink Sep 10 '11 at 12:38
add comment

This discussion always comes up due to one largely ignored fact: OpenID was never designed as login protocol. That's a later misattribution.

OpenID was conceived as homepage URL verification service. And for that it was workable. But due to lack of alternatives it was quickly repurposed as general login protocol. Some features were crafted on (simple reg, attribute exchange) to facilitate that better. But at its core OpenID is an URL authority verification scheme.

This is were the usability and implementation blunders come from. The multi login advantage is only of significance to technic-affine users, not a real simplification for ordinary users. (Don't get me started on robustness; just salvaged my Stackoverflow login.)
But still there is no widespread or technically superior alternative (there were some prior OpenID but lacked buzzword and marketing uptake). As an avid open source supporter I would even consider Microsofts Passport or Cardspace whatever thingy over it, but it's currently not an option.

Back to your question: Stick to OpenID. For ordinary users make oldschool username/password pairs possible, and OpenID optional. Maybe OpenID3 finds widespread adoption and fixes some of the issues. Or maybe something else comes along. The general idea behind the concept was cool.

share|improve this answer
    
That's an interesting fact, I didn't know that. Thanks for your answer As I've mentioned before I'm afraidn that implementing 'everything' (as per my comment on @DeveloperArt post) will scare off and/or confuse users but perhaps I'm wrong and if done nicely this is the best solution? –  DoPPler Feb 22 '11 at 11:13
add comment

Actually, I think the main problem with OpenID is not the implementation or the user-friendliness of it is bad. Nor do I think it's the security problems with OpenID, per-se. I think the main problem is that it's a solution in search of a problem - a problem which, for most users, is really not a huge deal anyway.

A better solution to the problem of having to remember lots of passwords, etc is to use a password manager application. A password manager will even simplify the registration process for you, as it'll automatically populate all of the common fields (name, etc) and generate a random password automatically. About the only thing you'll have to do, typically, is verify your email address.

share|improve this answer
    
This is very close to what general opinion at Quora seems to be, but I've heard it many times from my both technical and not-so-technical friends that they have an issue with keeping track of multiple passwords so I don't think this is a problem that "doesn't exist" (however it might be less of a nuisance than I make of it). Certainly use of a password manager is some solution (not without flaws of its own), but I'm looking for a technology that I could implement in order to help my visitors get a better sing-in experience. –  DoPPler Feb 22 '11 at 11:05
add comment

The problem with openid, or more general, with having a selection of account providers on the website to login with onto your website, is that users tend to forget which provider they chose before. One day they can use google, next month they can use facebook and three months later maybe twitter. For the website, it will look like three different users. In such a case the users get frustrated, because they can login to your system, but not to the same account as previously.

share|improve this answer
    
Are you certain about that? I wondered the same thing as soon as I first heard of OpenID. I've tried to test myself, see if what you described is true. Sometimes it is, like at StackExchange, with their implementation of OpenID. But other websites DO correctly make the association to past logins, or inquire if I had prior account, and indicate past OpenID provider in a general way. Maybe that's because of a combined OpenID-OAuth sign-in? I don't know. But I agree with you, users DO forget which provider they chose before! It is a real problem. –  Feral Oink Sep 10 '11 at 12:23
add comment

The main problems with OpenID, as I see, are two:

  • A) It's not user-friendly for non-technical guys
  • B) It's not as widely used as the alternatives

On A, for a user seeing a button "login with facebook" is easy and simple to get. Seeing a control with 10 icons (Google, Yahoo, AOL, etc) it's confusing. Even more the fact that the "login" is a URL, something many people don't know it exists as all they do is type a search in Bing/Google and follow the links. I know many people that when they go to Facebook, they search for Facebook in Google and click the link, don't try to explain the concept of domain to them!

On B, Facebook is the standard. It's a bit like PayPal and the alternatives: for an e-commerce PayPal may not be the best option price-wise due to it's charges on transactions, but if they don't use PayPal they are risking many potential clients. About login is the same: Facebook opens your web to 500 million users which are active internet users and tech-savvy enough as to probably 'get' your site. Honestly, why should you spend more time supporting other things? Spend that time developing the product!

Due to B, A becomes worse as the users kind of expect the Facebook login, and Open Id confuses them more.

And I don't start with the issues already discussed in Code Horror about users login in the same site with different Open Id accounts and the issues this may raise...

All in all, I like the idea on Open ID, but (sadly?) Facebook has done it better.

share|improve this answer
3  
I've seen many implementations that are indeed bad. But the implementation here on Stack Exchange is, in my opinion, is pretty good. You could probably go a step further and make the experience very similar to the 'sign in with Facebook' experience (also Google and Yahoo support some sort of OAuth or OpenID/OAuth hybrid). I totally agree with the fact that seeing multiple providers can be misleading and cause some additional issues, but on the other hand that gives your user most flexibility (also I know people who don't use Facebook). –  DoPPler Feb 21 '11 at 15:19
    
The fact that I have to log in every time I go to a different branch of SE makes me feel the implementation is poor. FFS, if I've used my OpenID to register at SO and Prog, why the hell do I have to log in at both in the same visit? This is progress?!? –  Andrew Heath Feb 22 '11 at 5:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.