Careers open id authentication configuration not synced with stackoverflow?

Question

I can't seem to login to careers with my primary OpenID for stackoverflow (the accounts are associated).

Here's what I've observed:

1. I had a stackoverflow account on which I used Blogger as the primary OpenID provider and Yahoo! as the alternate OpenID provider.

2. I created a careers account, the Blogger OpenID worked correctly for authentication on careers. All seemed well.

3. I successfully changed my stackoverflow authentication configuration to use Google as the primary OpenID provider and Blogger as the alternate OpenID provider.

4. Currently, careers does not recognize my Google open id, but Blogger continues to work on careers. Both Google and Blogger work on stackoverflow.

So basically, I've put myself into a state where my primary stack overflow open id does not work on careers even though the accounts are associated and the careers login page declare:

For best results, please sign into careers with the same OpenID that you use on Stack Overflow.

Answer 1

The problem is the Google OpenID. Google uses a "secure" system, such that they generate a unique endpoint for you for every domain where you use your ID. So the OpenID endpoint seen by careers.stackoverflow is different from stackoverflow itself. You log in to a completely different OpenID endpoint.

The idea is to specifically prevent this kind of "sharing" scenario. Imagine that Careers and StackOverflow where completely different businesses. You wouldn't necessarily want them sharing info about you without your consent.

For example, say Amazon.com started accpeted OpenID logins. You have an account there, and they might even have your e-mail address. You do some shopping on Amazon and find an item. One nice thing about Amazon is that it lists other affiliated retailers also selling the same item, and in this case a different reputable shop has the item at a better price. You make the purchase there, and they also accept OpenId.

Now, you would give this other retailer your shipping address. After all, you want the item shipped to the correct location. But you may not want to give them your e-mail address. With most openID providers, their relationship with Amazon and the common OpenID endpoint might be enough for them to get the address out of Amazon (I'll give Amazon a little privacy credit and say "probably not", but you never know). Google's scheme prevents them from matching up the accounts that way and sharing data.

So it's not necessarily a bad thing. But it's a pain when it gets in the way.

Answer 2

We're planning to change how this works in the next 4-5 days 6-8 weeks.

Basically, if you use Google or another non-identifiable openid, you can copy and paste a "user key" (a unique key string) from one site to the other to manually link them.