What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Possible Duplicate:
MyOpenID account mysteriously vanished

When creating a new account on Stack Exchange, one has to pick an OpenID provider. myOpenID is one of the top five providers that Stack Exchange lists. You might want to consider removing myOpenID from that list.

Rationale 1: Today I had an interesting experience. When I went to log into Stack Exchange, the login failed. It turns out that myOpenID had completely lost track of the existence of my account with them. When I went to the myOpenID web page for my account, their system claimed that my account did not exist any more. So I immediately created an account with the same username as my old username, and that succeeded.

Implications: myOpenID lost my account for no apparent reason. (I didn't delete it or do anything that should have caused it to be lost. I use it actively and frequently.) This could have prevented me from accessing my Stack Exchange account. Also, it would have been trivial for someone else to hijack my Stack Exchange account: all they would have had to do was get there first to create an account with my old username. This is a security hole. (Note that having a secondar/alternate OpenID provider does not defend against this security risk; someone could still hijack your account, if myOpenID is one of your OpenID providers and your myOpenID account is randomly deleted, like mine was.) The consequence is that I believe myOpenID cannot be trusted to securely maintain accounts. I have become convinced that myOpenID is a security failure.

Rationale 2: In the process of investigating myOpenID, I learned that there is no way to contact them, no way to recover a wrongly deleted account, no way to recover from a failure. They say that myOpenID is a free product and is unsupported. There is a forum with a long list of posts from users, but no response from the myOpenID folks. There is a longstanding and serious bug in their system: generation of a client-side SSL cert just doesn't work. This was reported openly in the myOpenID forum about a year ago, and there has been absolutely no response from the myOpenID folks.

As a result of this experience, I have come to believe that myOpenID is not a professional service that Stack Exchange users should rely upon. It is a security risk to Stack Exchange users, and cannot be counted upon to ensure that people are able to log into their account. There are other, better OpenID providers. When I created my Stack Exchange account, I chose myOpenID rather arbitrarily to be my OpenID provider, primarily because Stack Exchange appeared to be endorsing it (based upon its prominent presence on the Stack Exchange page). Now that I know about shortcomings in myOpenID, I regret my choice. Going forward, Stack Exchange should protect new users from being exposed to these risks, and avoid suggesting that myOpenID is a good provider for Stack Exchange users.

My recommendation: myOpenID should no longer be given preferred status. The icon for myOpenID should be removed from the OpenID login / account creation page.

share|improve this question

marked as duplicate by Jeff Atwood May 1 '11 at 6:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
I had the same experience yesterday. It might be a good idea for SE admins to raise these issues with MyOpenID people. –  Kaveh Apr 25 '11 at 9:17
1  
Just to voice that I never had any issue with my account, though I'm not a heavy user of their services. The certificate does not work for me either, but the UserVoice forum is for their server side "Janrain Engage" product, not for client side users. That said, I've no idea if there's any forum for users. –  Arjan Apr 25 '11 at 9:26
    
@Arjan, I didn't have any issues either up to yesterday, which suddenly noticed that my account is gone without any notification. I like their service but I think SE admins need to discuss these issues with them. –  Kaveh Apr 25 '11 at 10:03
2  
Related: meta.stackexchange.com/questions/88451/lost-my-openid-account, and one highlighting another of their frolics: meta.stackexchange.com/questions/71584/… –  Grant Thomas Apr 25 '11 at 11:03
    
When changing, beware that copying one's profile to other accounts does not copy the OpenID details. –  Arjan Apr 25 '11 at 11:31
2  
Quite suggestive titles in this context, but related WebApps discussions: What to do when your OpenID provider shuts down? and What will the response plan be if your openid provider gets hacked?. -- But which OpenID provider is advisable now? Can we have a discussion on that for once? –  mario Apr 25 '11 at 13:22

1 Answer 1

Not the answer you're looking for? Browse other questions tagged .