18

Possible Duplicate:
MyOpenID account mysteriously vanished

When creating a new account on Stack Exchange, one has to pick an OpenID provider. myOpenID is one of the top five providers that Stack Exchange lists. You might want to consider removing myOpenID from that list.

Rationale 1: Today I had an interesting experience. When I went to log into Stack Exchange, the login failed. It turns out that myOpenID had completely lost track of the existence of my account with them. When I went to the myOpenID web page for my account, their system claimed that my account did not exist any more. So I immediately created an account with the same username as my old username, and that succeeded.

Implications: myOpenID lost my account for no apparent reason. (I didn't delete it or do anything that should have caused it to be lost. I use it actively and frequently.) This could have prevented me from accessing my Stack Exchange account. Also, it would have been trivial for someone else to hijack my Stack Exchange account: all they would have had to do was get there first to create an account with my old username. This is a security hole. (Note that having a secondar/alternate OpenID provider does not defend against this security risk; someone could still hijack your account, if myOpenID is one of your OpenID providers and your myOpenID account is randomly deleted, like mine was.) The consequence is that I believe myOpenID cannot be trusted to securely maintain accounts. I have become convinced that myOpenID is a security failure.

Rationale 2: In the process of investigating myOpenID, I learned that there is no way to contact them, no way to recover a wrongly deleted account, no way to recover from a failure. They say that myOpenID is a free product and is unsupported. There is a forum with a long list of posts from users, but no response from the myOpenID folks. There is a longstanding and serious bug in their system: generation of a client-side SSL cert just doesn't work. This was reported openly in the myOpenID forum about a year ago, and there has been absolutely no response from the myOpenID folks.

As a result of this experience, I have come to believe that myOpenID is not a professional service that Stack Exchange users should rely upon. It is a security risk to Stack Exchange users, and cannot be counted upon to ensure that people are able to log into their account. There are other, better OpenID providers. When I created my Stack Exchange account, I chose myOpenID rather arbitrarily to be my OpenID provider, primarily because Stack Exchange appeared to be endorsing it (based upon its prominent presence on the Stack Exchange page). Now that I know about shortcomings in myOpenID, I regret my choice. Going forward, Stack Exchange should protect new users from being exposed to these risks, and avoid suggesting that myOpenID is a good provider for Stack Exchange users.

My recommendation: myOpenID should no longer be given preferred status. The icon for myOpenID should be removed from the OpenID login / account creation page.

marked as duplicate by Jeff Atwood May 1 '11 at 6:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

This seems to be related to Amazon's sever failure:

MyOpenID account mysteriously vanished

Downed Amazon Servers Leave Websites Across Internet Struggling

Not the answer you're looking for? Browse other questions tagged .