OpenId/Custom Hybrid Authentication - Bad UX?

Hi Guys,

I'm designing a new web application. Some quick points on it:

ASP.NET MVC Web Application
SQL Server 2008
Entity Framework ORM
3 User Roles: Anonymous, Registered, Administrators.
Anonymous users can view stuff, Registered Users can post stuff, Admins can do anything
Heavy social integration with Facebook, Twitter and the like.
I plan to use OpenId for authentication (DotNetOpenAuth)

So, pretty simple right? (famous last words)

Now my question is:

Should i provide OpenId as the only means of authentication, or should i also give the user the option to log in using my own authentication system?

So this is basically a "User Experience" question. Take the example of StackOverflow - you MUST signup with OpenId. It seemed fine to me, but what about the general public? Can i be happy with the fact that a user of my site must have an OpenId account? (or signup for one before using my site)

Is giving the user two options to login bad UX?

I realize this is a partially subjective question, but im just looking for advice on which road to take, some case studies would be helpful.

Thanks.

Any good answer to a subjective question begins with it depends. :-)

I think if your prospective user base is already fairly social-network engaged (as it sounds by your description), it will probably be just fine to have authentication handled by OpenId providers. The important part is providing an easy-to-use login process, and make it obvious that various providers are available for authentication (Yahoo, Google, etc.).

If your prospective user base is going to consist of new or inexperienced Internet users, even a simple OpenId implementation may be too confusing.

I, for one, find it annoying to have to create yet another account every time a visit a new website, and I suspect that more and more users are feeling the same way.

There's a decent set of responses to a similar question at http://ui.stackexchange.com/questions/78

Exactly the answer i was looking for, thanks (+1). I'll also be providing a "Facebook Connect" button. I'll stick with just OpenId. But can i still grab info about the user? My "user" entity will only care about things like name, location, age, etc. When they "signin" with OpenId - does OpenId give me that info? Also - did not even know about ui.stackexchange.com - awesome! =)

RPM1984 2010-09-10 04:11:30

What information you get back from the OpenId provider depends on the provider and the user. You can ask for it in your authentication request, but you may not get it (the user is informed of the information request and can deny it, even while authenticating successfully).

Eric King 2010-09-10 04:34:15

@Eric King - cool, so just like Facebook Connect. (deny/allow info, perms). Thanks dude!

RPM1984 2010-09-10 04:43:12

I'll throw in there that Janrain's research suggests that offering a hybrid login (username+password OR OpenID) gets *worse* login rates than just having one or the other.

Andrew Arnott 2010-09-11 02:46:21

@Andrew, I can believe that.

Eric King 2010-09-11 03:10:06

@Andrew, @Eric King - as can i. However this is a social website, which heavily relies on FB, Twitter, etc. Therefore i will need at LEAST a facebook/twitter login. So its just a matter of whether in addition to a fb/twitter login, do i provide openid/custom or both. tough one. im leaning towards no openid now, as not enough ppl know about it. i can always add it later, but a custom system cant really be added later.

RPM1984 2010-09-14 04:30:30

@RPM1984, you may find this question worthwhile to read my answer to (http://stackoverflow.com/questions/1316983/to-openid-or-not-to-openid-is-it-worth-it/1317446#1317446). Particularly the part about offering OpenID but not telling the user that's what it is. You can capture the best of both worlds (FB + OpenID) while not sacrificing usability IMO.

Andrew Arnott 2010-09-14 14:30:14

@Andrew - an interesting answer, something i will definetely take into consideration/prototype/research. Thanks, +1

RPM1984 2010-09-14 21:54:24

ansaurus

tags:

views:

answers:

OpenId/Custom Hybrid Authentication - Bad UX?

related questions