What would it take to make OpenID mainstream?

Question

OpenID is a great idea in principle, but the UI and the explanation as to why it is good are currently not tailored for general use -- what do you think it would take to make OpenID work for the general public? Can this be solved with technology, or is the problem so intrinsically hard that we are stuck with difficult explanations/multi-step registration procedures, numerous accounts, or poor security?

Answer 1

I think it'll take a huge buy-in from a site that millions of people use; for example, MySpace is soon supporting OpenID, so now the number of users that OpenID supports has just jumped by a huge amount. If more of the high activity sites on the net follow this lead, there you go!

Answer 2

I think we need to see OpenID offered as a login method more consumer oriented websites. There are a lot of big consumer sites that can be used as OpenID providers, but the only place I recall seeing OpenID available as a login before Stackoverflow is to comment on Blogger. Being a provider is great and all, but it's pretty much invisible to consumers. Seeing an actual place to use OpenID, on the other hand, will probably garner somewhat more interest.

Answer 3

You mean it isn't already? ;)

Obviously a lot of currently-popular applications would need to offer it and make it obvious that it was a good alternative.

If Google and Facebook made it an obvious option, that would help.

Ultimately, user education will really be the thing that does it. I doubt most people would care though...dumb sheeple.

Answer 4

It would certainly help if more OpenID consumers were also OpenID providers. As a developer, I'm comfortable going through a few contortions to figure out that I can create a new ID on openid.org, but the more mainstream consumer could easily be put off by the process.

Answer 5

The fact that big sites will accept OpenID isn't, on it's own, enough to make it mainstream. The closest I've seen so far was having LiveJournal both accept and provide OpenID authentication (which I believe it has been doing for quite some time).

But I think that just accepting OpenID isn't enough. What we really need is more sites like this one that refuse to make their own authentication system, and require OpenID authentication. If the "next big thing" said you have to use your OpenID to log in (with a really simple wizard to set up a new ID with someone else), I believe that it will start the ball properly rolling.

Answer 6

Many of the responses so far seem to boil down to two options:

1. user education, and
2. forcing adoption (lots of sites changing to openid from in-house auth.)

Is that all we can do? What about distributed tools to make it easy for casual users to do openid delegation? (Say, something integrated with OS X / Windows / Ubuntu) Are there technological barriers that make this infeasible?

If client-side (and vendor-issued) applications could let you manage your on-line security preference, then we'd possibly be able to combat some of the risks associated with giving random sites your passwords -- since the "login area" would be some local program sitting in your systray, or what not. Of course, the integration of web apps with the desktop (such as that provided by Chrome) may make such a distinction impossible in practice, so it may be a moot point.

In any case, it seems like there should be something we could do now to make openid more palatable to the general public, and speed adoption in addition to making the system more user friendly.

Answer 7

I don't think it will become mainstream. I think Ted Dziuba gets it right when he says it solves a "problem" that most people don't consider to be worth solving.

http://teddziuba.com/2008/09/openid-is-why-i-hate-the-inter.html

Answer 8

It will have to get a hell of a lot simpler, with easier-to-remember IDs.

Answer 9

As someone who primarily programs web apps in Java, I can't/won't use OpenID because the library support isn't there. JOID and openid4java are the only two that I know of. JOID is apparently not actively maintained, not including really important patches that have been on the mailing list for months; and openid4java requires >40 megabytes of external dependencies, including some that need to go into the endorsed classpath, which is, as one user commented, ridiculous:

Comment by witichis, Apr 28, 2008

46MB download for a simple redirect and de/encryp - are you f****n' drunk?

In my opinion, OpenID is not bad. It consolidates login credentials. It does solve a real problem, while it may not be the optimal solution The only two problems I can see are that you must trust the identity provider not to allow someone else to claim to be you, and that relying parties (web sites you log in to) can collude to link your identity on multiple sites together.

Answer 10

I'd use it if I could do it per-site and aggregate the identity later on my own time and terms. As it is, it's a giant pain in the ass to even find a decent OpenID provider; by decent I mean stackoverflow.com isn't one so I'm not going to bother.

MSN

Answer 11

It will take all the popular sites supporting it and making it transparent to the user.

"You can make a useraccount here, or if you use MySpace, Google Mail, Hotmail, etc then you can sign in using OpenID."

Don't sell it as a new service, sell it as being able to sign in using a different ID from another site.

The issue, however, is that with everyone supporting it each user will now have a myspace id, google id, etc. Now if they sign onto stackoverflow with their myspace id then later with google they may be perplexed that stackoverflow doesn't recognize them.

I wonder if openid has a solution for linking openid accounts so they are one and the same - I doubt the technology allows for it, since they are essentially independant signing authorities. Google would have to share data with Myspace and vice versa to enable that...

Answer 12

Browsers should auto-fill OpenID login boxes so that you don't have to remember your ID.

Answer 13

Web frameworks should come with it as the default, unless you take lots of extra time to configure a simple username/password combination.

Answer 14

ISPs should provide openIds to all their customers that mimic their e-mail addresses. Perhaps openID needs to support automatic translation of [email protected] into http://openid.example.com/foo so that ISPs can easily set this up on a separate server.

Answer 15

It needs to be much simpler: involve less knowledge of the concepts, and require fewer steps - preferably zero. When the technology works with little or no assistance, it'll take off.

The mechanics of OpenID credentials, providers and suppliers shouldn't need to be exposed to the user. People talk about educating the masses of internet users, but that's never going to happen - the masses never stop being stupid. If you want to appeal to the masses, you need to bring the technology down to meet their level instead. When a Google-affiliated site picks up that you're logged into Google and silently uses that account, it works without you ever having to tell it who you are. The fact that OpenID is so clumsy in comparison is why the big providers like Google are still avoiding it, and why the general public won't adopt it.

I think the developers of OpenID messed up when they used a URL rather than an email address for the IDs. People know what email addresses are, they already have one that's associated with them (or can get one easily), and email providers like Google and Microsoft are happy to adopt a role as portals. In fact, an automatic translation from email address to URL is all it would take:

[email protected] -> http://www.example.com/openid/myname

Answer 16

Sites that use OpenID need to put it front and center on the login page. I have seen many sites hide it behind a link under the standard login/registration page like this:

Username:

Password:

or use your OpenID

Answer 17

Make it less open.

i do not want the same identity on multiple sites. i do not want to have to create a flickr account before StackOverflow will let me post. i do not have to have to create a new flickr account for each website that i want to register with.

Answer 18

Choosing a provider needs to be much simpler.

At present there's no way to know how reliable, trustworthy or secure any of them are, or which will still be around in 6 months time.

Answer 19

It won't be mainstream, as it's too much effort and is too confusing for those used to email address and password.

For example:

To login to stackoverflow with Opera I have to click login, select myOpenID from the list, type my username, hit enter, press Ctrl+Enter to autofill the password on the myOpenID site, then press the continue button.

To login into any normal site with Opera I just press Ctrl+Enter to autofill the saved user/pass combo.

Answer 20

Personally I don't think it needs to be mainstream at all, it was an interesting idea, but it is no longer relevant.

When I create a normal login, I type in my username, master password and click on the SuperGenPass bookmarklet. That is it, when I had to sign up to stackoverflow I had to find an openId provider, sign up there (which took forever) login to my website and setup delegation, then add stackoverflow to my list of sites.

And yesterday I couldn't login because I had removed the file from my webhost and they had some security issue.

Conclusion: Fuck openid.