What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I know two of the biggest advantages of using open ID is that users don't have to remember yet another user name/ password and that you don't have to worry about confirmation email messages ending up in spam or not being sent at all. I'm wondering what the drawbacks are for using Open ID? Are they're any?

share|improve this question
    
On your or on the user's end? –  Pëkka May 3 '10 at 6:51

5 Answers 5

up vote 2 down vote accepted

Well the biggest drawback is that is hellishly complex and implemented slightly differently on each provider. Some return email addresses via sreg, some via ax and some not at all. At the base of it all it gives you is authentication, meaning it lets you know that somebody is who they said they are.

There is also the problem of trust.

For example:

Say I have an openid named http://waffles.com it may tell you that my email address is bob@othermail.com if you trust the openid provider all is fine, but keep in mind that anyone can run an openid server. So you end up whitelisting providers which makes things more complicated.

The other big problem is that some non-savvy users are afraid of open id and do not understand it, they are used to traditional sign up / on and will not consider anything else.

share|improve this answer
1  
regarding confirmation mails see: corvidworks.com/articles/mail-deliverability-tip –  waffles May 3 '10 at 5:51

The disadvantage is the same as its greatest strength. There are three parties involved:

  1. You
  2. OpenID provider
  3. Website

(this is of course the whole point; without a common third party there can't even be global logins.)

The traditional system:

  1. You
  2. Website
share|improve this answer
    
I'm sorry why can't there be global logins without an open id provider? language? –  Nick May 3 '10 at 5:29
3  
@nick -- er.. what? without a THIRD PARTY there can only ever be unique per-website logins on every website. It's like.. physics.. or math.. or something. 1=1. –  Jeff Atwood May 3 '10 at 5:32
    
oh yes of course, the third party email is there in some form either way! I guess I'm mostly wondering what the disadvantages are to switching to Open ID after starting without it? Would we loose something somewhere that I'm not realizing? –  Nick May 3 '10 at 5:40
    
my goal: no waiting to sign up and no hunting for confirmation emails in spam boxes; that = open id? wondering why i don't see it much on other networks? –  Nick May 3 '10 at 5:48
    
@Jeff I don't agree. Maybe not at the moment, but how about in future when there will be good ways to authenticate with a certificate provided by the user? Math and physics don't change over time, this does. –  Peter Smit May 3 '10 at 5:48
2  
@peter a certificate validated by whom? the user him or herself? Or another entity like "the state of California" or "Verisign" or "Facebook"? GOTCHA :) –  Jeff Atwood May 3 '10 at 5:54
1  
@Jeff Self-signed. Public-Private cryptography. User gives his public key to sites where it makes an account and then the authentication happens always with the private key. No need for validated certificates or so, everybody can generate that himself –  Peter Smit May 3 '10 at 11:46
    
@peter I don't think that actually works without a centralized third party -- it's like self-signed email which as near as I can tell is an utter failure. Where do you get the private key from, exactly? –  Jeff Atwood May 3 '10 at 12:54
    
@Jeff A private key can be generated by yourself. Look for example to ssh. ssh-keygen will create a public/private key-pair. Because of the length and randomness of the key, chance of collisions are nill. Now every website where you want to login you will give the public key (for example at account creation, first time logging in). Now the website sends a challenge to you that you have to encrypt with your private key. The result you send back and will be decrypted with the public key to check if it is still the same. –  Peter Smit May 3 '10 at 14:13
    
@Jeff the problem with self-signed email is that you want to verify that the user behind the email is the owner of the email address. The difference here is that the only thing you want to know is whether a user is the same as the user that registered the account. –  Peter Smit May 3 '10 at 14:15
1  
@Peter: The problem with self-signed certs is that they're not worth shit. Anyone with the ability to work their way through OpenSSL's manual page can… Hmm… OK, 0.00001% of the population can make a self-signed cert claiming to be anyone. What's really needed is some way for one party to verify that the other isn't lying. That's what a CA does; be a party that both sides of a communication can trust to make identity assertions. (A F2F meeting might also work, but doesn't prove that much without some trust somewhere, such as a passport or driver-licensing authority.) –  Donal Fellows May 3 '10 at 22:31
    
BTW, yes, I do work with these things in my day job. –  Donal Fellows May 3 '10 at 22:32
    
@Donal Get the point, I am not talking about any certificate that is signed. Look to SSH instead of SSL. A private key is your 'identity' and your public key the matching public identifier. It does not matter who or what has generated the keys. Without the private key nobody can login to an account where the matching public key is attached. –  Peter Smit May 4 '10 at 5:22
1  
BTW, yes, I don't like people who are bragging that they are professionals just to amplify their statement without giving real insightful reasoning. –  Peter Smit May 4 '10 at 5:23

I can't think of any.

  • It's secure
  • Easy to use
  • Easy to setup if you don't have one
  • Flexible

It also takes the burden off of SOFU from having to host a user name / password database, send authentication emails, verify signups, etc.

Any disadvantages far outweigh the benefits.

share|improve this answer
    
Say one already has a user name / password database set up and say that person is experiencing a HUGE problem with confirmation emails going to spam or not being sent all. What do you think about having both perhaps? Or do I need to completely get rid of our original setup? –  Nick May 3 '10 at 5:15
    
Switching to an OpenID platform shouldn't be hard. Basically you would only allow new registrations through an OpenID provider and when old accounts login force them to authenticate with an OpenID. It'd be hairy for a bit but nothing unmanageable. Can you be more specific in your question about what you need? –  Josh K May 3 '10 at 5:20
    
I'm pretty much desperately looking for a better way to have people sign up for my site. It was working fine for a little while but now all emails are either going to spam or not being sent at all? I'm just wondering what I'm to loose by going with Open ID? I can't help but notice that most popular networks out there today don't use Open ID for a sign up, they use they're own. –  Nick May 3 '10 at 5:25
    
Honestly, I haven't looked under the hood so to speak on OpenID much at all, you would probably get better answers on SO. –  Josh K May 3 '10 at 5:29
    
"Any disadvantages far outweigh the benefits." <-- What? Do I detect a transposition? –  Billy ONeal May 3 '10 at 5:37

There are some security implications. See for example the accepted answer to "Are there any security risks associated with me using OpenID as the authentication method on my site?" (on Stack Overflow).

share|improve this answer

Well, I can tell you one huge problem with OpenID -- Stack Exchange seems to have dropped support for it. A month or so ago, I found myself unable to log in using my 1id login. That problem got fixed, but as of today, I found myself unable to sign up on other stack exchange properties (like this one).

I finally created a conventional sign up on Stack Exchange just so I could post to meta.

share|improve this answer
    
That "conventional signup" is OpenID. OpenID is still the only way to sign in. SE just happen to also be an OpenID provider, for convenience. –  Billy Mailman Apr 30 at 14:21
    
Well, this is the second time this year that login via 1id has broken. Once is a bug. Twice is support being dropped. Note that 1id uses nonconventional urls -- mine is simply "=falk". I'll probably have to adopt a new account, but I had the 1id account for years and it had a lot of karma. –  Edward Falk Apr 30 at 14:29
    
If you create a new account then you can ask the SE team to merge your accounts. See meta.stackexchange.com/help/merging-accounts –  George Duckett Apr 30 at 14:34
    
Thanks, I will do that. –  Edward Falk Apr 30 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .