3

I know two of the biggest advantages of using open ID is that users don't have to remember yet another user name/ password and that you don't have to worry about confirmation email messages ending up in spam or not being sent at all. I'm wondering what the drawbacks are for using Open ID? Are they're any?

1
  • On your or on the user's end?
    – Pekka
    May 3, 2010 at 6:51

5 Answers 5

2

Well the biggest drawback is that is hellishly complex and implemented slightly differently on each provider. Some return email addresses via sreg, some via ax and some not at all. At the base of it all it gives you is authentication, meaning it lets you know that somebody is who they said they are.

There is also the problem of trust.

For example:

Say I have an openid named http://waffles.com it may tell you that my email address is [email protected] if you trust the openid provider all is fine, but keep in mind that anyone can run an openid server. So you end up whitelisting providers which makes things more complicated.

The other big problem is that some non-savvy users are afraid of open id and do not understand it, they are used to traditional sign up / on and will not consider anything else.

1
2

The disadvantage is the same as its greatest strength. There are three parties involved:

  1. You
  2. OpenID provider
  3. Website

(this is of course the whole point; without a common third party there can't even be global logins.)

The traditional system:

  1. You
  2. Website
13
  • I'm sorry why can't there be global logins without an open id provider? language?
    – Nick
    May 3, 2010 at 5:29
  • 3
    @nick -- er.. what? without a THIRD PARTY there can only ever be unique per-website logins on every website. It's like.. physics.. or math.. or something. 1=1. May 3, 2010 at 5:32
  • oh yes of course, the third party email is there in some form either way! I guess I'm mostly wondering what the disadvantages are to switching to Open ID after starting without it? Would we loose something somewhere that I'm not realizing?
    – Nick
    May 3, 2010 at 5:40
  • my goal: no waiting to sign up and no hunting for confirmation emails in spam boxes; that = open id? wondering why i don't see it much on other networks?
    – Nick
    May 3, 2010 at 5:48
  • @Jeff I don't agree. Maybe not at the moment, but how about in future when there will be good ways to authenticate with a certificate provided by the user? Math and physics don't change over time, this does.
    – Peter Smit
    May 3, 2010 at 5:48
  • 2
    @peter a certificate validated by whom? the user him or herself? Or another entity like "the state of California" or "Verisign" or "Facebook"? GOTCHA :) May 3, 2010 at 5:54
  • 1
    @Jeff Self-signed. Public-Private cryptography. User gives his public key to sites where it makes an account and then the authentication happens always with the private key. No need for validated certificates or so, everybody can generate that himself
    – Peter Smit
    May 3, 2010 at 11:46
  • @peter I don't think that actually works without a centralized third party -- it's like self-signed email which as near as I can tell is an utter failure. Where do you get the private key from, exactly? May 3, 2010 at 12:54
  • @Jeff A private key can be generated by yourself. Look for example to ssh. ssh-keygen will create a public/private key-pair. Because of the length and randomness of the key, chance of collisions are nill. Now every website where you want to login you will give the public key (for example at account creation, first time logging in). Now the website sends a challenge to you that you have to encrypt with your private key. The result you send back and will be decrypted with the public key to check if it is still the same.
    – Peter Smit
    May 3, 2010 at 14:13
  • @Jeff the problem with self-signed email is that you want to verify that the user behind the email is the owner of the email address. The difference here is that the only thing you want to know is whether a user is the same as the user that registered the account.
    – Peter Smit
    May 3, 2010 at 14:15
  • BTW, yes, I do work with these things in my day job. May 3, 2010 at 22:32
  • @Donal Get the point, I am not talking about any certificate that is signed. Look to SSH instead of SSL. A private key is your 'identity' and your public key the matching public identifier. It does not matter who or what has generated the keys. Without the private key nobody can login to an account where the matching public key is attached.
    – Peter Smit
    May 4, 2010 at 5:22
  • 1
    BTW, yes, I don't like people who are bragging that they are professionals just to amplify their statement without giving real insightful reasoning.
    – Peter Smit
    May 4, 2010 at 5:23
0

I can't think of any.

  • It's secure
  • Easy to use
  • Easy to setup if you don't have one
  • Flexible

It also takes the burden off of SOFU from having to host a user name / password database, send authentication emails, verify signups, etc.

Any disadvantages far outweigh the benefits.

5
  • Say one already has a user name / password database set up and say that person is experiencing a HUGE problem with confirmation emails going to spam or not being sent all. What do you think about having both perhaps? Or do I need to completely get rid of our original setup?
    – Nick
    May 3, 2010 at 5:15
  • Switching to an OpenID platform shouldn't be hard. Basically you would only allow new registrations through an OpenID provider and when old accounts login force them to authenticate with an OpenID. It'd be hairy for a bit but nothing unmanageable. Can you be more specific in your question about what you need?
    – Josh K
    May 3, 2010 at 5:20
  • I'm pretty much desperately looking for a better way to have people sign up for my site. It was working fine for a little while but now all emails are either going to spam or not being sent at all? I'm just wondering what I'm to loose by going with Open ID? I can't help but notice that most popular networks out there today don't use Open ID for a sign up, they use they're own.
    – Nick
    May 3, 2010 at 5:25
  • Honestly, I haven't looked under the hood so to speak on OpenID much at all, you would probably get better answers on SO.
    – Josh K
    May 3, 2010 at 5:29
  • "Any disadvantages far outweigh the benefits." <-- What? Do I detect a transposition? May 3, 2010 at 5:37
0

There are some security implications. See for example the accepted answer to "Are there any security risks associated with me using OpenID as the authentication method on my site?" (on Stack Overflow).

0

Well, I can tell you one huge problem with OpenID -- Stack Exchange seems to have dropped support for it. A month or so ago, I found myself unable to log in using my 1id login. That problem got fixed, but as of today, I found myself unable to sign up on other stack exchange properties (like this one).

I finally created a conventional sign up on Stack Exchange just so I could post to meta.

4
  • That "conventional signup" is OpenID. OpenID is still the only way to sign in. SE just happen to also be an OpenID provider, for convenience. Apr 30, 2014 at 14:21
  • Well, this is the second time this year that login via 1id has broken. Once is a bug. Twice is support being dropped. Note that 1id uses nonconventional urls -- mine is simply "=falk". I'll probably have to adopt a new account, but I had the 1id account for years and it had a lot of karma. Apr 30, 2014 at 14:29
  • If you create a new account then you can ask the SE team to merge your accounts. See meta.stackexchange.com/help/merging-accounts Apr 30, 2014 at 14:34
  • Thanks, I will do that. Apr 30, 2014 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .