Apparently, new users of the Stack Exchange Network automatically are being registered with an OpenID provider. The registration process appears misleadingly merely to offer an option to register with OpenID provider, openid.stackexchange.com, but in fact new users are being registered automatically with that OpenID provider without giving consent, and without being consulted or even told. (For potentially thousands of websites?)
For a user to feel comfortable registering with a single-sign-on provider (e.g. an OpenID provider), they must be told this is happening: informed consent is important in security. If we aren't clear about all the ways we are protected from other users of our own computers, what a feeling of unease could be generated! Obviously, if a user signs off from a website, it is important they not experience another person (without their credentials) reentering that website as them. Not merely regarding websites individually, single-sign-on providers further magnify this automatically to a tremendous and unknown number of other websites, at least potentially, in the mind of anyone who has not decided to register with a single-sign-on provider.
In the following, please note the many official references to Stack Exchange, and that the OpenID aspect of registration is presented as optional. These details show currently how signing up for the Stack Exchange Network actually means being signed up with an OpenID provider, specifically the surreptitious aspect of it:
- A prospective user of stackoverflow.com sees no signup link, and follows its top-menu link, 'log in', which leads to, 'click here to sign up.'
- The resulting page with a big, blue label, 'Stack Exchange' has a button, 'Create Stack Exchange Account'.
- After signing up, the user receives an email with the subject, 'Complete Registration on stackoverflow.com'.
- The email contains the text, 'You're almost done!...Once you create your Stack Exchange account you can use it to log in to thousands of websites. To log in to a Stack Exchange site: click the "Log in with Stack Exchange" button. To log in to other websites that accept OpenID: enter this URL https://openid.stackexchange.com/' . Apparently, this offers a choice, and one of the meanings of the word, 'can' is, 'at most, potentially'.
- Not wanting to go further with an OpenID feature at this time, the user avoids the above advertised URL, 'openid.stackexchange.com'. Instead, (in the email) the user clicks a button labeled, 'Click here to complete your registration on stackoverflow.com'.
- After completing this registration, the user checks whether they can log out and back in again.
- The registration leaves the user's current URL as stackexchange.com. There, the top-menu link 'log in' results in the question, 'Do you already have an account on one of these sites? Click the logo to log in with it here.' One of the cards says, 'log in with Stack Exchange'. The user clicks this.
- The resulting page with a big, blue label, 'Stack Exchange' says, 'Sign in with your Stack Exchange account'.
- A successful login results in the Stack Exchange homepage.
- Clicking the top-menu link, 'log out' leads to a page with a big, blue label, 'Stack Exchange' saying, 'You're a registered user. You recently used the following credentials to login'. Listed first is an apparent option (in blue), 'Email' with the user's email address, 'You can login with any...Stack Exchange account that uses any of the emails above.' Next apparently is another option (because it is also in blue): 'OpenID / Stack Exchange' with no other information.
- Last is an orange button labeled, 'Log Out', plus the text, 'Clicking Log Out will clear all local credentials in your browser'. Clicking this results briefly in the message, 'Clear Global Credentials'; then the user sees the public version of the Stack Exchange homepage.
So, the would-be user of stackoverflow.com apparently has registered with stackexchange.com, because stackoverflow.com said this was necessary. (Trusting stackoverflow.com, they trusted where it sent them to register. However, they were actually registering instead with openid.stackexchange.com unawares.)
Already, they were comfortable with families of websites that are subdomains of the same domain name, because browsers provide cookie protection to users of such subdomain families. (For example, signing in at accounts.google.com leads us to mail.google.com.) Albeit, it did not occur to the user that stackexchange.com and stackoverflow.com do not share a common domain name.
The user had not considered, was unready, and was unwilling because of security concerns to take the step of registering with any single-sign-on provider, for example openid.stackexchange.com, and they had chosen deliberately not to do so. However, in fact, they had been registered automatically and surreptitiously with the OpenID provider.
Logically, either it is possible, or it is impossible, for any user without an OpenID provider to sign in once, and access the entire Stack Exchange Network.
If it is possible, Stack Exchange could allow new users to register without an OpenID provider, as well as optionally by using an OpenID provider. If it is impossible, new users could be alerted and informed they must use an OpenID provider. Certainly, either way, openid.stackexchange might be suggested.
If it is impossible, openid.stackexchange might also be dedicated specifically only to the Stack Exchange Network, with a policy guaranteeing this to the users. Then, a sign out from any website of the Stack Exchange Network could automatically sign out the user from the dedicated OpenID provider as well. If a user trusts this statement of policy, they might judge this method safe for them.