What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

tl;dr:

Why was Open ID chosen as the preferred login provider on Stack Exchange; what are the privacy implications and risks, if any; and why should I care?


I confess I'm a very green newbie. My own teen nerd years were spent with reels of solder, brick-like transformers, chassis punches for octal base triodes and pentodes, argon gas voltage regulator tubes, etc. so I beg for tolerance, but blast away if you must...

Understanding some of what's on the backside of every webpage I visit, I'm concerned about citizens' privacy and resent almost all of them calling my mac to dutifully do gets at 20 different domains to upload js, iframes, .gifs with mile-long hash and every other (multiplying like rabbits) junk to triangulate exactly who I am, what I'm doing and what I'm going to do every second I'm online ..or offline.

Years ago, we all talked about bugging phones, wire-tapping, etc. Everyone considered it despicable to the point of legal limitation and what a dangerous precedent it could set to even worse infringements since mankind has never been 100% benevolent or altruistic. Subjugators and exploiters are integral to our species. No culture is immune from winding up with a Hitler. Our nature hasn't miraculously changed à la Star Trek (Yes, I am.) since 1930 –or 1930 B.C.

I'm not a lawbreaker, not worth handcuffing anyway, nor ashamed of any places I surf, including some fav X sites, but sneakiness and spying gall me just on principle. I find the ubiquity of Google's euphemistic "analytics" js particularly odious as well as the hundreds of other We-catch-em snooping systems proffered by the Finest. Face Book is repugnant to me, even butting into everyone's site by handling their "Comments" feature, Adobe and Apple among them. Honestly, I fear FB could become downright malicious one day if people don't stir from their stupor pretty soon.

I use Firefox, Firebug and NoScript to try to limit or at least view what sites attempt to inculcate my machine up with.

This brings me to OpenId.

Stack Exchange sites are the pits for me to sign on to.

Pages use the term "log in" at one place and "sign in" elsewhere on the same page. Wha?? Am I supposed to know the difference? Enlighten me, please. I receive an email to retrieve my password. It says: Your password is ssssTG. Next line says: Just kidding. Then doesn't give me a password at all, but says to use one of a number of my OpenIDs. I suppose this is funny to insiders? Not me when I can't sign ..or log? on to learn some more.

And why was there a login page with two text boxes then, both email and password??

It seems to me that OpenId just invites cross-pollination of user data. Why does anyone want Face Book nosing in? –Or any other site I'm a member of?

Can someone set me straight here? Am I just an old fogey who has to get over that anyone with an IQ can know everything about me? Are my bank accounts, SSN, etc secure or are they not??

Some of you dudes –ambigender of course– are the geniuses, the cutting edge of programming knowhow today. The gray matter here is astounding and far finer than mine, so you're the ones I want to ask how invasive even Stack Exchange sites are. Are you bothered? Or is creating more sophisticated such technology and exploiting a better thing?

Please, someone do enlighten an old fart why OpenId is used here, is a friend and not a foe, perhaps even in sheep's clothing...

share|improve this question
6  
Didn't you learn how to write a paper? The first paragraph is supposed to hook you into reading the story. You go off talking about "argon gas voltage regulator tubes" and you just totally lost me there. –  animuson Mar 11 '12 at 21:56
1  
The primary intent/purpose of single sign on (SSO) is that you don't have a distributed, distinct user system on each and every site which a specific "individual" (as in, that person) may belong to. It's like a universal ID card, and suffers some of the same pitfalls. I think it's more relevant in corporate intranets and in places where it's useful to share and authenticate a user is a user is a user is this user (such as in a university which offers courses to another university's students). –  Jared Farrish Mar 11 '12 at 21:57
4  
Also, I would see Your Internet Driver's License and OpenID: Does The World Really Need Yet Another Username and Password?, from the site's founder, Jeff Atwood. –  Jared Farrish Mar 11 '12 at 21:59
1  
Trying very hard not to close this as "Not A Real Question". Would you please reduce this to it's most salient points? –  casperOne Mar 11 '12 at 23:31
1  
@casparOne - I think there may be a bit of the crank in this question (sorry, no offense); if you want to boil it down to a useful question, "What are the reasons SO uses OpenID and does it protect my privacy" might suffice, minus the black helicopters. –  Jared Farrish Mar 11 '12 at 23:38
1  
@Mike: please boil this down and remove the ranting. Also, see meta.stackexchange.com/questions/2950/…. Always remember, this is not a discussion forum. –  John Saunders Mar 11 '12 at 23:44
    
Hey if you are that worried about GrabAll and Face(the wall)Book, you should also be using the RequestPolicy extension. It's a pain to tune but it really cuts down on cross-site tracking. –  Awesome Poodles Mar 12 '12 at 4:08
3  
Wow, I can't believe people were so rude to you. And I say that as a big advocate of snarky comments. You were obviously trying to be funny in the first paragraph, which is an excellent strategy for an introduction. And there are some valid concerns here. OpenID hasn't reached universal penetration, so despite its clear advantages in many areas, there are some disadvantages and a lot of confusion. Asking a question about that is perfectly acceptable. –  Cody Gray Mar 12 '12 at 8:03

4 Answers 4

First off: OpenID (and OAuth, which SE uses to support Facebook) is just a way for you to avoid yet another username + password. It does this by letting you say (in effect):

Listen, you don't really need to know who I am. Just ask Google or Facebook or Yahoo or my own website - they'll vouch for me.

It doesn't mean I'm giving SE access to my email, or Facebook wall, or Flickr account. It's more akin to flashing a driver's license when you're in the checkout lane at the local supermarket: "I know you've never seen me before, but the State of Colorado knows me."

Second, the way SE exposes this is a little bit... weird. In part because if you don't have that "driver's license" you actually can give it a user name (email address, actually) and password, thus creating yet another account. At which point, you can use that account elsewhere... And in part because of how SE supports multiple sets of credentials on one account. This is extremely powerful, and together they solve a rather unfortunate problem with OpenID (the "all your eggs in one basket" issue), but it does make things less... simple.

Now, I'm told it makes a lot more sense if you don't over-think it, but if you're writing a screed on Meta it's probably too late for that. So here's how I like to think of it*:

  1. Stack Overflow wants to know who you are.

  2. You tell it, "Google knows me" or "Facebook knows me" or "Joe's House of OpenIDs knows me". If you've created an Open ID on Stack Exchange (that is, a SE OpenID - not a SE.com profile) you just say, "Stack Exchange knows me".

  3. Stack Overflow asks Google, or Stack Exchange, or Joe's who you are, and they in turn ask you who you are - which you tell them by logging into that site in the usual fashion. Stack Overflow then gets access to some small bit of information that identifies you and only you in the context of that site. Maybe your email address, or a URL, or a beautiful snowflake**.

  4. Stack Overflow remembers this token bit of information about you, and associates it with your profile, as well as any other profiles you might have across all the other Stack Exchange sites. Next time you want to log in, you can again use whatever third-party you like to authenticate you, and if they cough up the same token, you get the same account.

  5. You can provide multiple sets of credentials by asking multiple sites to vouch for you. All of those tokens get stored on your account, so when Joe's goes out of business, you can still get in via Google.

*disclaimer: this is a gross simplification, and Rebecca is gonna murder me with an axe if I ever claim this is how it really works. **actually, khakis. Yes, you really are your khakis.

share|improve this answer
2  
Not a bad explanation for the thingadongdong. –  Adam Davis Mar 12 '12 at 4:42
5  
+1 Just for the disclaimer with regard to Rebecca. I would pay reputation points to see her chase you with an axe. *Disclaimer: You also deserve another good answer badge. Not like you can ever have enough of those. –  Diago Mar 12 '12 at 8:57

Some of us got tired of the 90's method of having multiple hundred user ids and passwords because we use the web a lot. Open IDs improve security and user experience by allowing users to remember ONE or few universal credentials which are used to authorize sites.

share|improve this answer

First, I want to commend you for starting programming when programmers used soldering irons and wires to write their "code." Hopefully you've visited electronics.stackexchange.com and browsed there, I believe we could use a tube/analog guy...

I want to ask how invasive even Stack Exchange sites are. Are you bothered? Or is creating more sophisticated such technology and exploiting a better thing?

We all build on the shoulders of giants. The founders of Stack Overflow could have built their own login system, their own javascript/ajax library, and indeed could have built all the foundation required to build Stack Exchange.

However, that's not what they wanted to spend their time doing - they wanted to build a site where people could share knowledge. Spending time re-inventing the wheel means they would have less time to outfit the vehicle the wheel ultimately was going to move, and we'd have a site with many fewer features, and many more bugs.

There is some risk of dependance and some loss of privacy in relying on the resources others give - for instance, jquery is loaded from google, and these sites use analytics from google, quantcast, and others.

In exchange we get to use javascript libraries that are constantly updated, debugged, and maintained.

So yes - when you visit you are making that same exchange.

Is the site useful enough for you to continue to consider that exchange worthwhile? If not, are there things you can do to re-balance the equation so it does make sense for you? There are countless proxies, for instance, free and commercial, that would be able to give you the anonymity you need without losing access to the site. You can sign up for multiple openid accounts from a variety of sources if you require this site not share information with other openid sites, and in fact you can set your own up. I use a mini openid site I set up for myself so I can completely control my own openid, and not rely on anyone else. I didn't do this because I was worried about what information might be shared, but because I didn't want to lose my account here just because I lost control of an openid account with a third party.

So no, generally people don't worry about this sort of thing. Those that do have means to avoid the major issues.

Meanwhile, by using the resources available, Stack Exchange can spend the majority of its limited developer resources on the core mission of the site, rather than trying to patch the latest hole in a wheel that's been built countless times by countless other programmers.

share|improve this answer

OpenID is for your benefit. It allows you to control how you interact with every site from a central location. It is also borne out of increasing specialization and SRP. Let the people who are experts in account security focus on account security.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .