NOTE: Official end of support date for OpenID was July 25, 2018. We are currently working on removing support, but it won't be done today. We will update here when support is removed.

Stack Overflow was an early and strong supporter of OpenID. We built our sign up/log in flow around it. We were idealistic and had high hopes, but these hopes weren't realized. Over the years people have wondered if OpenID is dead. We've had to remove support as OpenID providers pulled support or shut down.

The time has come to part ways. The reality is OpenID support has created a ton of complexity in our codebase and the number of users actively using OpenID simply don't justify that cost. Users have spoken with their actions. You prefer Google, Facebook and Stack Exchange (aka email/PW) based account auth.

Chart with Stack Exchange accounts by type. Non-OpenID = 9.8m, Inactive OpenID = 268k, Active OpenID = 13k.

Of our 9,813,747 accounts around one-tenth of a percent are actively using OpenID (defined as having visited a site in the past 12 months). If you include all the inactive accounts it is still less than 2.9% of all accounts.

So, what is the plan?

  1. DONE - Remove the ability to create a new account with most OpenID providers
  2. DONE - Add the ability to add email sign in to a current account
  3. DONE - Convert Launchpad (used on askubuntu.com ) to OAuth
  4. DONE - Remove creating new accounts with Steam from Arqade (Steam removed support for OAuth. Only 454 accounts that use Steam have visited Arqade in the past 6 months.)

  5. DONE - We will email all users that rely on deprecated OpenID credentials and request that they add a new provider to their account

  6. July - Run an announcement banner for any user who signs in with deprecated OpenID credentials urging them to add a new provider to their account
  7. July 25 - End support for logging in via OpenID and deprecate openid.stackexchange.com (note: only 0.2% of authorized sites in the last year have been non-Stack Exchange sites. Running some additional analysis and will update when we have more info.)

Obviously, if your account relies on OpenID, then make life easy and go now and add your Google or Facebook credentials or set up email/password auth.

If you've forgotten what you credentials you use to login, then click this link to refresh your memory. If you don't see one of the three account types shown in the image below (Google, Facebook or Stack Exchange) then click the "add more logins" button to add one of them to your account.

Screenshot of the "My Logins" preference page

Remember, SE OpenID accounts are really email/pw accounts handled through complicated OpenID code path. They will be migrated to a simpler email/pw only code path as a part of this change. No extra work required on your part.

28 Answers 28

up vote 7 down vote accepted

If you have any problems in this transition or can't successfully add a new provider to your account, please contact us and we'll get it sorted out for you.

I'm using https://openid.stackexchange.com/ to log in on SEDE, the Stack Exchange Data Explorer. Will there be another kind of integration between SEDE accounts and Stack Exchange accounts or do I need to switch providers there as well?

  • 81
    This bit was missed when we did our analysis. We will need to make a change here, but I don't have details at this time. We will post later on how SEDE login will change. – Joe Friend Mar 6 at 18:13
  • 22
    We'll make sure login works here, but not what form it'll take yet. Ideally I'd make it single-sign-on and your stackexchange.com cookie works but I wouldn't promise that at all as there are fundamental issues at odds with an open source project. It may be using our OAuth path or something similar. Kevin and I will discuss early next week (I'm out this week) and get a plan together. SEDE obviously needs to work and we'll make that happen one way or another. – Nick Craver Mar 6 at 18:15
  • 1
    @NickCraver If there is work that can / needs to be done on the open source bits and you think you can off-load some of that work, don't hesitate to ping me, I'm happy to help out. – rene Mar 6 at 18:39
  • 11
    I hope it's OK to post this as a comment here (if not I'll delete it/feel free to flag it). I'm glad something will happen, because logging into SEDE with my Stack Exchange OpenID randomly and silently fails for me about half the time... – Zanna Mar 6 at 20:43
  • 1
    @Zanna it did for me as well, until I cleared my cache for that website. – Glorfindel Mar 6 at 20:46
  • @JoeFriend related question: meta.stackexchange.com/questions/305771/… – Cœur Mar 7 at 1:23
  • 27
    I would really like SEDE to work with the normal SE login, just like any other site in the network. I have three separate SEDE accounts because of how messy the system is… :/ – poke Mar 7 at 11:52
  • @poke This timeline is forcing them to do something about it... but there's still the problem of finite dev time so something else will be temporarily shelved. – wizzwizz4 Mar 7 at 18:13
  • @JoeFriend If you're changing the login code for SEDE, maybe this would be a good time to e.g. allow for persistent login there? – E.P. Mar 11 at 15:54

ChatExchange is a Python API for Stack Exchange chat. It logs in by visiting openid.stackexchange.com, logging in (scraping the page for fkey), and then using that cookie to log into a Stack Exchange site. The cookie from Stack Exchange login then gets used to authenticate for chat.

SmokeDetector uses ChatExchange. If that flow breaks, we'll need to know about it so that we can put the necessary patches in place and not have extensive downtime while we figure things out. A transition period where both the old flow and the new flow work would be ideal.

  • 27
    All of the chat libraries and bots that I know of use openid.stackexchange.com since that’s what the web login uses (or at least it did when we reverse-engineered it). We can update everything to use a new system, and some of us in SOBotics want to write up some unofficial documentation on login and chat, but advance notice of any breaking changes would be awesome, so we don’t wake up one morning to find everything falling apart (especially Smokey). – NobodyNada Mar 7 at 6:07
  • @NobodyNada In a similar situation. For our Android chat app we use OpenID for SE but I'm unsure what we'll do when that dies. Hoping SE implements a email+password login similar to SO. – Tristan Wiley Mar 7 at 18:02
  • @ArtOfCode You could use Stack Exchange OAuth. – wizzwizz4 Mar 7 at 18:11
  • 9
    @wizzwizz4 Is that an alternative to the standard web login though? As there's no official chat API, chatbots have to use the web interface, which means we have to authenticate using the website to get session cookies and fkeys and whatnot. – NobodyNada Mar 7 at 18:16
  • @NobodyNada There's client-side and server-side mentioned in the OAuth thing... I don't know whether that'll let you authenticate a browser session for chat but judging from the iOS app it seems to. – wizzwizz4 Mar 7 at 18:18
  • @wizzwizz4 The iOS app does not need/use a browser session, at least to my knowledge. – NobodyNada Mar 7 at 18:18
  • @NobodyNada It does for timed-out chat pings from inbox. – wizzwizz4 Mar 7 at 18:19
  • But don't we have to log in separately to the web browser it opens? – NobodyNada Mar 7 at 18:20
  • 2
    Non-OpenID login routes exist, but only on specific sites, so if we want to use one, like https://stackapps.com/users/login, it could be necessarily to auto-register the user on StackApps as part of the login flow (we won't yet know what sites they're already on). This may be acceptable, but it's a bit gross compared with having a profile-agnostic login page like https://chat.stackexchange.com/users/login, https://stackauth.com/users/login, or https://stackexchange.com/users/login. (From this discussion in chat.) – Something Bad Happened Mar 7 at 19:31
  • My bot named Duga is also refering to openid.stackexchange.com in her code, I have checked and made sure that she does use Stack Exchange login, but I guess the code have to be rewritten a bit. She's extensively used by Code Review and Software Engineering. – Simon Forsberg Mar 11 at 12:30
  • I took the liberty of creating a chat room so that we can help each other with the new login flow: chat.stackexchange.com/rooms/74338/… – Simon Forsberg Mar 11 at 12:40
  • 12
    Umm since SmokeDetector aka Smokey is our most active moderator on SO, perhaps it will have to take precedence over "lets change things for changing's own sake" decisions by the SO company. The people who make these kind of bots are awesome and should be supported by SO, not shot down. Or by all means shut down the bot and then SO employees can do the forum moderation themselves. – Lundin Mar 12 at 15:45

The timeline says June - run an announcement banner for users who sign in with OpenID.

  • Why wait until June? Shouldn't the announcement banner go up immediately?
  • How about also showing the banner to users who use StackExchange as their OpenID provider?
  • 3
    You could add that anyone voting or otherwise participating in any question containing "openID" should get a notification. Example of questions containing "openID": meta.stackexchange.com/q/190442/242736 or meta.stackexchange.com/questions/256767/… – user2987828 Mar 8 at 10:11
  • 2
    I mean, get a notification immediately. (couldn't edit previous comment in time because of the five minute threshold) – user2987828 Mar 8 at 10:17
  • 3
    @user2987828 What I do is copy-paste the previous comment into a new one, modify and save it, and then delete the old comment. – robinCTS Mar 19 at 6:58
  • 4
    +2 Waiting until there's less than a month left to make the first unmissable announcement that you are going to lose access to your account unless you take prompt action is bad. – Peter Taylor Jun 28 at 8:10
  • 2
    I got lucky seeing the notification today. Last month I did not have a chance to access from my laptop where I am logged in so i easily could have missed the notification :-(. – cstamas Jul 2 at 20:58

TLDR: OK for tearing down openID if it means cleaner code, but vision impaired people should be allowed to still answer, and if possible upvote and comment without JavaScript.

In end of April 2018, openID is necessary to login, ask questions, answer and edit on the sites of the stackexchange network without any JavaScript. But Logging in needs, as of April 2018, OpenID as explained in new message Because JavaScript is disabled, you can only log in by entering your OpenID URL manually:.

Previously, in 2013 and at the time the above question and this answer were created, openID and some whitelisting of some JavaScript sites were necessary to answer, comment, and chat on the sites of the stackexchange network .

Best browsers for vision impaired people (me!) do not support JavaScript, but are the only choice for blind users out there. I am fortunate enough to be able to use firefox, but what about truly blind people ?

Security conscious users also tend to use fewest possible JavaScript web sites.

This is also a way to speed up a lot the time to show webpages. The fastest load time is with the lynx browser. Lynx is fast because it does load images. Lynx browser also happens to be favored by blind people with text readers.

My life

I use lynx 99% of the time. No interest in seeing images except for click-bait pages.

I use firefox for www.sharelatex.com, to vote or answer in stackexchange websites, for google agenda, and for shopping. The rest, among which news.google.fr, gmail.com, searching (including in stackexchanges websites), ... I do that in lynx browser. I just started answering and editing posts on lynx browser also. But I would also like to favorite (the favorite button is an unhelpful link to current question), upvote and comment nicely, and as a side have a better interface than manually entering the URL https://<URL>.com/posts/<Question ID>/comments to open hidden comments.

PS: I am now editing this post using lynx browser, thanks @KevinMontrose for the work. Though I like to be able to upvote questions and answers, I'll do that a few time a day if it did not require a graphical browser like firefox.

  • 25
    Login has never "technically" required javascript but the various provider buttons over the years have used it to fill in and submit a form. Today you can sign in with a manually enetered OpenID or email & password with javascript disabled. When OpenID is deprecated, email and password logins will remain <noscript> friendly. I don't think signup has been <noscript> friendly in years, I'll take a look at fixing that ASAP. – Kevin Montrose Mar 7 at 15:40
  • 7
    logging in is nice, upvoting, commenting (at least see all comments!) and answering would allow blind people to participate. – user2987828 Mar 7 at 15:45
  • 1
    @user2987828 As a workaround, you can go to https://<site>.com/posts/<id>/comments to see all the comments (for example, for this post, you can go to https://meta.stackexchange.com/posts/307691/comments. – J F Mar 7 at 17:51
  • 12
    Signup will work without JS in the next build. Voting, commenting, and answering are various degrees of complicated. Answering technically works, but Google's ReCaptcha will fail anyone without JS enabled (we may be able to relax that, but it requires more discussion; I've done the groundwork anyway). Voting and commenting I think have always required JS so there's not an easy fix there - I've pinged the relevant parties to see if it's addressable. – Kevin Montrose Mar 7 at 18:56
  • 6
    Wait, people actually disable JS? How on earth do you use the internet without JS? – Clonkex Mar 7 at 23:16
  • 4
    Or that there's folks who can't use modern browsers for acessability reasons imagine lynx and a screen reader. I'm sure a lot of people would live a text browser that does se and see chat perfectly. – Journeyman Geek Mar 8 at 5:00
  • 2
    @Kevin Montrose "Google's ReCaptcha will fail anyone without JS enabled (we may be able to relax that, but it requires more discussion [...])" : I started the discussion 4 years ago in meta.stackexchange.com/questions/208862/… : is it a good place ? – user2987828 Mar 8 at 9:01
  • @Clonkex I modifed my answer to add a second reason for that, beside security: fastest way to load a page. It is even faster in lynx browser, because this one does not load images... – user2987828 Mar 8 at 9:03
  • @J F oh thanks I didn't know that. Would it be easy to insert such links as noscript fallbacks for all links like "show 5 more comments" ? It currently opens httNOGREPps://host-redacted.stackexchange.com/questions/number-redacted/title-redacted# but it would be nice if it showed your link instead. – user2987828 Mar 8 at 9:52
  • 3
    @KevinMontrose : "Login has never "technically" required javascript" : it still does require javaScript, I just re-tested on lynx browser. Without openID, lynx on stackoverflow.com/users/login shows "[BUTTON Input] (not implemented)". I can fill the openID field with httNOGREPps://openid.stackexchange.com but openID's submits to a 404. I documented details 4 years ago on meta.stackexchange.com/questions/208862/… You can deduce from last linked comment that nothing changed in 4 years. – user2987828 Mar 8 at 10:03
  • 6
    @Clonkex Many websites work fine without javascript. Most are functional with a subset of their scripts enabled. Just on this page, I have 6 domains disabled, everything's fine. This, plus ublock origin, can make pages load several seconds faster. – isanae Mar 8 at 14:02
  • 4
    There is a way to browse and search questions, post (answers, questions and comments), edit posts, and vote, without Javascript. Use Emacs and the sx package. For initial setup, you need to generate an authentication token with a browser, I don't know if that requires Javascript. Emacs has good support for blind people, including Emacspeak. – Gilles Mar 8 at 22:40
  • 1
    @Clonkex: That's fine for you, but since most sites basically have to be non-Javascript friendly (or else Googlebot can't read them), turning off Javascript is not an unreasonable thing for people to do. – Kevin Mar 9 at 22:46
  • 3
    @Clonkex When you work around people who sell browser exploit chains for a living, you tend to get more than a little weary about using JavaScript yourself. The fact that SE doesn't use CSP either is a little scary. – forest Mar 10 at 8:48
  • 3
    @Clonkex Honestly, I prefer my webpages to not spy on me, track my every move, or sell my information to parties unknown, vs having a bit more functionality. If your site stops working when I disable facebook, doubleclick, etc, then I guess you didn't really want my business (and yes, I leave non-annoying ads enabled because of this--I know how capitalism works).. – Ogre Psalm33 Mar 12 at 13:54

Just a quick addendum to Joe's post, we'll have a pretty strong support plan in place for those that become disenfranchised from their accounts due to not seeing the message. While we're being really proactive about getting the word out, there's always going to be a few stragglers.

When we pulled MathOverflow into the network after making major changes to how accounts are structured compared to the version of the SE 1.0 software they were using, we ended up having to manually fix quite a few accounts and it went remarkably well. So, we've got everything needed to support folks. It won't be the end of the world for anyone that misses the boat.

There's also the case of benevolent bots, those that folks in our community create that need to log in to be useful. Reach out to us with any major concerns so that we can do what we can to coordinate (which could be as simple as guiding you to other larger projects working on the same thing where you could combine forces).

  • 1
    How about having an open chat room for this where all us bot developers can share projects, concerns and solutions? I took the liberty of creating one and encourage others who share my concerns to join: chat.stackexchange.com/rooms/74338/… – Simon Forsberg Mar 11 at 12:39
  • 5
    I'm currently updating the Java library ChatExchange. It's working on Stack Overflow, but stackexchange.com (which we need to connect to chat.stackexchange.com) is still using OpenID. Can we expect that stackexchange.com will be updated to use the same login-forms like Stack Overflow, meta.SE or AskUbuntu? If yes, do you already know, when this will happen? – FelixSFD Mar 21 at 15:18
  • Update regarding my previous comment: We were able to update ChatExchange to use the new login flow. Logging in to chat.stackexchange.com works by using the cookies we get from meta.stackexchange.com. – FelixSFD Jul 17 at 10:41

The numbers seem too convincing for the decision but don't we need to consider each user group's activity/contribution to the community?

The activities/contributions of 13k active OpenID users(which is 0.13% of total members) constitute only 0.13% of the total activity/contribution?

  • 65
    Welcome to the use of statistics-as-lamppost: for support rather than illumination. That SE used OpenID was what brought me here in the first place, and it's still the only federated identity management scheme that puts all the control in the hands of the user. No wonder it was never popular. – MadHatter Mar 7 at 11:32
  • 12
    We aren't closing 13k users accounts and telling them to go away. We are simply asking them to transition to one of the other three options. – Joe Friend Mar 7 at 19:49
  • 30
    @JoeFriend That doesn't really answer the question. It completely sidesteps it. – forest Mar 10 at 8:50
  • 6
    Indeed, a better (although still not perfect) statistics would be which percentage of the network-wide reputation was generated through openid users. – celtschk Mar 10 at 16:07
  • 3
    @JoeFriend, your other 3 options are sell your soul to google, sell your soul to facebook or sell your soul to me! I would also love to see a true statistics! – AaA Jun 28 at 2:02
  • Also, some subcommunities may have disproportionally larger number of OpenID users. – Velkan Jul 3 at 9:57
  • 2
    @JoeFriend I don't care about OpenID per sé but the values it was created for (decentralized, user controlled) and currently you are removing OpenID but not putting anything back that has these values. You say 'three options' like it's a lot but one is username/pass and the other are from the 2 biggest ad companies in the world that are known for harvesting user data for a living. Please give us Mozilla login. Them I trust (more) with my data. With Google/Facebook I know they will be harvesting it. With non-profit like Mozilla we have a chance.... – Stijn de Witt Jul 5 at 8:09

Can you keep providing OpenID without accepting different OpenID providers?

(And of course, if so, would you consider it?)

I understand the complexity involved in accepting many different logins. Surely that is (at least in great part) separate from the complexity of providing OpenID? One requires calling external APIs the other is providing one to the outside by only checking SE login. Or can you not have one without the other? Or does this question not make sense because it's basically what OAuth does?

I'm not the most regular user of OpenID but it's sure nice to not have to create an account for every bug tracker or what not out there that I'll use only once.

  • 3
    Yeah, I like using the OpenID provider for logging into other Q&A sites that are like SO, but not part of the network, like answers.ros.org.. – m01 Mar 7 at 22:52
  • If it doesn't cost much to provide, such a service can also be a small publicity/user stream. – Nemo Mar 10 at 22:04
  • @Nemo and tbh it sounds like it'd solve most of the other issues raised here – Cimbali Mar 10 at 22:30
  • 6
    OpenID is designed so that a site can just provide, just consume, or both. SE's code might have common code for them, but on the outside view, the SE OpenID provider is independent of the SE OpenID consumer. – SevenSidedDie Mar 12 at 6:47
  • 2
    maybe a replacement: indieauth.com – NH. Apr 21 at 16:45

Stack Exchange is the only OpenID provider I can use, for reasons. I'm not in the same position as some other people who've used theirs for things other than testing, but I would still find some similar system extremely useful. Are there plans to provide a Stack Exchange OAuth?

  • 25
    @wizzwizz4 We support OAuth today, you can find the documentation here: api.stackexchange.com/docs/authentication - these URLs may shift but that'll be a different deprecation path. I'm trying to clarify things around openid.stackexchange.com internally since there's some confusion on the plan here. – Nick Craver Mar 6 at 17:55
  • 8
    @NickCraver Yay! I'll start developing now. – wizzwizz4 Mar 6 at 17:56

I'm one of those folks who's impacted though in the oddest of ways. I've used an openid provider I run myself as a backup since every so often, I run into workplaces that supply me with systems I don't trust. Being able to log into what's essentially a disposable set of credentials was kind of reassuring.

That said? Considering the epic dead pool of openid providers, and what I read on various tweets, and the reactions of devs current and past? This has to be a good thing.

It would be nice to have a "roll your own" sign on option - for folks who want to have their cake and eat it - and have SE login and a backup without needing to trust facebook or google. I half suspect the need for this on SE is relegated to the epically geeky however.

  • 8
    I, too, have been using an OpenID provider for backup -- partly in case I were to ever lose access to my primary credential (not that I think that's likely, but best to be safe) and partly because a previous workplace blocked Google (!). But for all the maintenance burden it's causing, I can instead add an email sign-in as backup. – Monica Cellio Mar 7 at 16:47
  • 2
    Here too - I've maintained my own openID specifically for stackexchange, though I do use other services to log in regularly now. – Adam Davis Mar 8 at 19:43

ChatX is a ruby chat libarary which I wrote and maintain. I figured I could just migrate it to normal SE login, but it turns out that the "Log in with Stack Exchange" button to log in to chat actually POSTS to https://openid.stackexchange.com/affiliate/form/login/submit. Hence, this will also break when openid breaks. That leaves only google/facebook/yahoo oauth, which aren't really things we can migrate chatbots to easily.

TL;DR I'd like to see a solid SE non-openid login form ASAP that I can migrate my stuff to.

I understand removing code that very few uses. I use OpenID over Google/Facebook for anti-surveillance reasons.

When you remove OpenID I understand I can still use username/password.

Is there another alternative? If OAuth is still supported, can I be my own OAuth provider?

  • 2
    No, at the moment there are no plans to support arbitrary OAuth providers. – Adam Lear Mar 8 at 21:23
  • 5
    @AdamLear Why not? – Manngo Jun 27 at 22:00
  • @Manngo Same reasons as why we're deprecating OpenID, really. Sticking to a small, well-defined set of providers reduces our development and support costs by a ton and we're less likely to break something when making changes to authentication. On top of that, many OAuth implementations actually differ behind the scenes (yes yes, I know it's a protocol... but reality doesn't always match the spec in practice). – Adam Lear Jun 28 at 3:55

If it's easy (big "if"), is there any chance of getting a site-agnostic global-auth login page at https://stackauth.com/users/login, for chat bots to use? It wouldn't be part of any user-facing website, so it wouldn't create any misleading expectations like preserving https://stackexchange.com/users/login.

The bot libraries generally only take email and password to login, which means they don't know what sites the account has profiles on, so they don't know which site-specific login route to use.

  • 1
    Six of one, half dozen of the other in terms of creating a new agnostic auth page vs preserving an existing one, honestly... The main reason se.com didn't get the new login page treatment is that I ran out of time back in the day. Off hand, I'd rather not add new auth code to the stackauth project. Whatever we do with user profiles on se.com, we can (likely/maybe) preserve the auth code that already exists and just upgrade the UI. Skip the signup, but allow login... in some fashion, perhaps with appropriate signup guidance that points folks to actual Q&A sites. – Adam Lear Mar 11 at 3:25

So does this mean that the Android Stack Overflow app will finally support Facebook logins? For the longest time, it's supported Google, Stack Exchange, and OpenID logins only, and I suppose the third button's up for replacement now...

  • 9
    Neither the iOS app nor the Android app are actively developed any more, so I doubt they’ll be adding any new features. – NobodyNada Mar 7 at 6:29
  • 3
    though, in theory, wouldn't a broken openid log in button be a bug? – Journeyman Geek Mar 7 at 6:40
  • @JourneymanGeek why broken? Stack Exchange login will work as before, the change is totally transparent for us. As far as I can tell, nothing will change in the apps. – Shadow Wizard Mar 7 at 7:17
  • I mean, if it didn't work, they'd need to fix it – Journeyman Geek Mar 7 at 7:17
  • 3
    @NobodyNada Is this really true? I can't find any post to that effect on the blog, and this post seems to indicate that the app was launched less than a year ago, which would be a remarkably short lifespan. One way or another, though, if they aren't planning to add such advanced functionality as the ability to, oh I dunno, log in, they really should get rid of that advertisement for the app that shows up on every page when you visit this site with a mobile browser. – Charles Srstka Mar 8 at 7:33
  • @CharlesSrstka I expect (and hope) they’ll fix broken OpenID login, but I doubt they’ll add new features to the login system. – NobodyNada Mar 8 at 16:40
  • @NobodyNada I don't expect them to do anything to the OpenID login in any case, since this very topic is announcing that OpenID is on its way out completely. – Charles Srstka Mar 8 at 17:16
  • @CharlesSrstka See this post which confirms that the mobile apps currently have ~0 resources. – Something Bad Happened Mar 8 at 19:25
  • @JeremyBanks "hopefully temporarily until a point where we begin reinvesting dev time into the apps" suggests that they do intend to work on it sometime in the future, which is a hopeful sign. – Charles Srstka Mar 8 at 22:18

Would you please put in your main post the websites/logins you will still specifically maintain? I login with Yahoo. I will never have a Facebook account, and keep Google strictly for use of updating apps on my phone and nothing else (otherwise I'm logged out). Just want to make sure that your current support for everything not OpenID remains in tact. Right now those options are:

  • LiveJournal
  • Blogger
  • AOL
  • Yahoo

I don't mind your special partnerships with Facebook and Google. It's good business. The rest of us shouldn't also find ourselves shut out with this change however.

  • 6
    All those options are also working via OpenID and they're being discontinued. If you're not down with Google or Facebook (which is more than fair enough), you can add an email/password credential that we will maintain going forward. – Adam Lear Mar 11 at 18:44
  • 3
    That's good to know. Should prevent atleast some surprises from those of us who had no idea that Yahoo, et al, used OpenId. – ouflak Mar 11 at 18:46
  • 3
    Same here. I am pretty sure the numbers of people actually using OpenID are underestimated: this the way I identify, and I cannot remember the last time I last had to identify, since “remember me” is always on. – Sébastien Le Callonnec Jun 27 at 18:24

then make life easy and go now and add your Google or Facebook credentials or set up email/password auth.

I do not want to have neither a Google nor a Facebook account - and even if I had to, I would not want to link those to my account here.

March - Convert Launchpad (used on askubuntu.com ) to OAuth

So, if I sign in to AskUbuntu via Launchpad, will I be able to then log-in to the rest of my accounts, without having to add an extra e-mail address? If so, then it's all the same to me if OpenID is gone (I liked this site, because I did not have to register to begin with, which OpenID with my Launchpad account allowed then)

  • 1
    You could link your Launchpad account with an SE email and password account, to more easily log in to other accounts – Sonic the Inclusive Hedgehog Mar 28 at 21:52
  • The old Launchpad OpenID method seems different from the OAuth one. To add a new OAuth entry (which replaces the OpenID one), I had to click add more logins... at askubuntu.com/users/mylogins/me and select Launchpad. This account then becomes visible on other SE sites as well, even if the Launchpad option is not visible (Log in or sign up on any Stack Exchange site using these accounts). – Lekensteyn Jul 3 at 8:49

I expect that a good number of those active OpenID users will not be able to figure out how to migrate from the instructions in this question, or from anywhere else reasonably discoverable.

See this post for details, but briefly: if you already have an email/password login, but have no idea what the password is (because you've been using OpenID for years), you can't use login-add, or the only other obvious link from mylogins (password-reset), or in fact anything else visible anywhere I can find on the site. What you have to do is go to account-recovery, which you would never find.

This question should be edited to explain what many of the actual active OpenID-logging-in users actually need to do. (And whatever announcements go out as July approaches also need that explanation.)

Also, the relevant pages should be improved, but there are other questions for that: add-login page tries to auth existing email/password login.

Decision to drop OpenID support is very unfortunate.

I use OpenID as my preferred login method wherever possible. I would argue that most of those users using OpenID are probably also those more valuable in the community compared to masses of one visit facebook "users" and the likes. Why on earth would anyone want to use such account to login to SO? To brag about answering question infront of their "friends"? Someone must have hit the ground with their head really hard.

On the note of simplification of code by removing OpenID. Since when it became a solution of a problem to "ignore the problem"? Is that why we write code? Do not think so. Making pretty pictures somewhat does not make much to support that.

How you come to a conclusion that OpenID is a failure? I am using mojeid.cz as an authentication provider. The service is run by a non profit organization which is also maintaining our national TLD registry - CZ.NIC. It is steadily picking up traction and is on track to become nationwide login method with verified identity, to have same legal weight as declaring identity in person against state authorities. It is also gaining wide support on commercial sites as well.

Thirdparty OpenID service allows me to login anywhere using two factor authentication, which has only a poor replacement in using google or even facebook with questionable "trust feeling". That does not feel as adequate replacement. How can we use prehistoric "mail+pass" with any sense of security and privacy compared to google and facebook login providers?

Are you planing to add two phase authenticcation support for logging in with mail+pass?

Keeping the OpenID support would be preferable from a not-a-noob user perspective. Please reconsider and DO NOT remove it.

  • Sorry to disappoint, but this path has been set for some time. I truly am sorry for the inconvenience to you. – Joe Friend Jun 28 at 6:02
  • 1
    I just learned about removal of OpenID support from email sent to all accounts using it. A little bit late according to what you are saying. :-( I just hope you would consider improving mail+pass to support two factor authentication like OTP or similar. – darBis Jun 28 at 10:25

Run an announcement banner for any user who signs in with deprecated OpenID credentials urging them to add a new provider to their account

You should definitely show that banner for any user that is logged in via OpenID, not just when signing in. I, for example, am signed in with OpenID, but my last new login was in December.

Additionally I have not received any emails yet and June is almost over. I have not registered an email on my Stack Exchange account, but I have one for Stack Overflow.

  • Emails were just sent out. It seems it went into your spam folder. – Sonic the Inclusive Hedgehog Jun 27 at 21:36
  • @SonictheInclusiveHedgehog If they were sent out just now in the last three hours I already added an additional login and may not have gotten an email because of that. – sth Jun 28 at 0:31

OpenID was never intended as general login system. That's just a widespread misattribution. (Which SE has clearly contributed to.)

Shutting it down habitually will have some ripple effects outside of SE/SO however. It's not just Stack-specific bots using the OpenID consumer. Many users here do utilize the OpenID provider too.

  • For instance I get most useful flags on //freshcode.club from users with an StackExchange OpenID handle.
  • They're not just more frequent than Yahoo logons, but inherently more trustworthy. IMO.

Just measuring active SE logins falls a bit short of its actual impact. Code complexity might not warrant it. But all the maintenance and effort done over the years, wasn't spent on the local scope alone.

  • 3
    OK, I'll bite. What was OpenID intended for? – Nathan Tuggy May 23 at 19:44
  • »Homepage ownership verification protocol«. - And yes, sure, might be a petty technicality. But it's the main usability blunder and why it failed with the average user bourgeois. ;) – mario May 23 at 20:14
  • 3
    I can't find that phrase anywhere on the web. And OpenID.net's about page has, as its first sentence, "OpenID allows you to use an existing account to sign in to multiple websites, without needing to create new passwords." – Nathan Tuggy May 23 at 20:44
  • 1
    Yep, it has been repurposed/advertised as SSO service later on. On the original mailing list lists.danga.com/pipermail/yadis/2005-June/subject.html it was mostly still "OpenID asserts ownership of URLs". Reusable logons was what people wanted it for, but not strictly designed towards. – mario May 23 at 21:01

Just got the notification as a user of OpenID.

Stackoverflow being a developer centric site, I'm surprised that there isn't a github login option. The majority of services I use seem to integrate

Personally, I'd prefer that over google/facebook.

  • @ShadowWizard lol, login using GitHub was part of OpenID which is now removed, so what you mean with that link :) – Al-Mothafar Aug 12 at 5:18
  • @Al-Mothafar I mean there is already feature request for what is asked in this answer. – Shadow Wizard Aug 12 at 6:34
  • @ShadowWizard it is about 6 years old and sounds to be outdated (e.g screen and description are not like what used today), I think it might be better to open new request to "add Sign In with GitHub" next to google and facebook. – Al-Mothafar Aug 12 at 8:42
  • @Al-Mothafar no, time has no meaning for feature requests. It can take long years until a feature request is done, if ever, no point posting a new one every year, or two years etc. – Shadow Wizard Aug 12 at 12:37

It's not worked. (sorry to post here but not sure where else to log an OpenId switch problem)

I just tried to switch over from an openID account to an email login account (using the link on the email that was sent out) but when I try to login with the new email/password combination I get a completely new account created, not my original one.

When I relogged in through OpenId my original account was still there (and is the one I'm using here).

I did receive the "Finish Adding Log In" email, and verified it. But then I got an email saying ""Your friendly, fear-free guide to getting started".

The new account did have my full name in though.

(This may be related: some years ago (like 8 years or something) I think I remember I wanted to switch over from email to OpenId, but this caused another problem and someone had to reintegrate my accounts...)

  • Contact us and we'll get it sorted out for you. A simple merge should do it, but you need to contact us to do it. – Tim Post Jun 29 at 15:19
  • All sorted now, thanks. – Matthew Wilcoxson Jul 2 at 13:02

If you have your own domain set to be your OpenID provider, you may find https://bogomips.org/local-openid/ useful for running a one-off service long enough to log in to Stack Overflow and change your settings. Note that if you run it behind a reverse proxy you will probably have to edit the server_root method to provide your base_url. Also if you are using a modern Ruby you will need to edit ruby-openid-2.1.8/lib/openid/cryptutil.rb to redefine CryptUtil.hmac_sha1 to be:

def CryptUtil.hmac_sha1(key, text)
  digest = OpenSSL::Digest.new('sha1')
  OpenSSL::HMAC.digest(digest, key, text)
end

(The shipped version depends on digest/hmac, which was removed around Ruby 2.2.

  • This still requires OpenID support. When OpenID is yanked out, this solution becomes useless. – Thomas Ward Jun 27 at 20:45
  • Yep, that's why I said "long enough to log in and change your settings" – jsha Jun 27 at 23:22

The StackExchange login screen does not have an email/password option, only the OpenID options:

https://stackexchange.com/users/login

Might be nice to get one.

  • umm... the first to the left "log in with Stack Exchange" is exactly this: email/password login. (click and see) – Shadow Wizard Jul 3 at 14:09
  • That's actually the Stack Exchange OpenId login... It asks me if I want to login to StackExchange with my StackExchange OpenId. – Matthew Wilcoxson Jul 3 at 14:16
  • Stack Exchange is going to stop being OpenID provider, that's part of the change. Behind the scenes this is already only plain username/password login for long time as far as I can tell. – Shadow Wizard Jul 3 at 14:49
  • I think every other login page on the different exchanges has been changed to highlight the email/password login. – Matthew Wilcoxson Jul 3 at 15:38
  • Read the last paragraph of the question. – Sonic the Inclusive Hedgehog Jul 3 at 17:58

I have accounts on many StackExchange communities (and unfortunately I don't even remember all of them by heart -- I just login to them from time to time).

If I add another login method to StackOverflow, will it be added automatically to all other StackExchange communities?

Or must I track the list of all the communities where I have previously logged-in with OpenID and manually add the new login method? (and to do all this during the next few weeks...)

  • 1
    The credentials apply to all profiles, so if you add one on Stack Overflow, you're good to go. – Adam Lear Jul 7 at 16:53

I wanted to ask if this change (affecting 14,000 users) was discussed on meta before the decision was made? Maybe I just missed it?

  • 1
    I left an early comment on the question to test if enough protests would matter. The feedback says no, so even it was discussed on meta my bets are on the same outcome. Taking the hit once, in a single post is then maybe the best strategy, from the companies point of view ... – rene Jul 17 at 6:50
  • That seems to go against the ethos of discussing ideas on meta before unilaterally implementing them. Especially given how many people are affected and all the unintended consequences that are coming up in the discussion... this worries me quite a bit. – James S. Jul 17 at 8:00
  • 1
    Well, yes and no. If you have a resource drainage on a feature that is only used by a fraction of users I can imagine they simply want to ditch it. When you have bills to pay and are not prepared to honor whatever meta dreams up, maybe the best thing is to be bold and honest, instead of leaving it dangling for 6 to 8 weeks. Feels not nice but given the available bad choices, this was the least bad. But agree on that it deviates a bit on what we were used to. – rene Jul 17 at 8:09
  • 2
    Sometimes a business has to make tough decisions, even in the cost of irritating their customers. That's one of those. They decided it's not worth their efforts, and it's the same as, for example, the decision to freeze the development of the mobile apps for iOS and android. When something is not profitable and keep draining resources, it will eventually be removed/closed. – Shadow Wizard Jul 17 at 11:57

Add a link to this question to the login page. I never received an email and had no idea where my login option had gone. This page is difficult to find (googling for problems about SO as opposed to on SO is always difficult...)

If the software design is not complete garbage, the authentication method is implemented by an isolated module with a defined interface, right?

So why did this not begin as a request for volunteers to maintain the OpenID module? If no one volunteers, then remove support...

  • 2
    Here you go: github.com/DotNetOpenAuth/DotNetOpenAuth - of course, that's just the authentication. There's also the UX (most people don't know what OpenID is / how to deal with it when it breaks), and the provider end: github.com/StackExchange/StackID (note the WEALTH of contributors) and all of the plumbing to make the two work seamlessly together without a ton of annoying hoops for everyone who just wants to log in with an email+password. As much of this as possible has been open source since '08 - that you didn't know this speaks to the present success of OpenID... – Shog9 Jul 5 at 23:09
  • @shog9 GitHub URLs are not responsive to my question. At the (apparently necessary) risk of repeating myself, I am asking whether you bothered to solicit volunteers before terminating support for 13,000 active OpenID users, of which I am one. – Nemo Jul 6 at 0:04
  • Yes, @Nemo. We've welcomed volunteers, we've supported the continued development of OpenID financially, socially and with the work of our developers, and we've stuck with it for years even as the largest OpenID providers have one by one all dropped support or abandoned development, leaving bugs to fester and frustrating the users of Stack Exchange who relied on them. We've had a team of people supporting these users, helping them one-on-one if need-be, as they fought with their negligent providers and struggled to retain access to their accounts. – Shog9 Jul 6 at 0:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .