OpenID Fan Club Is Shrinking

A.B. VerHausen writes "Even though there's a whole new Web site devoted to understanding and using OpenID, some companies are dropping the login method altogether. OStatic is reporting that the 'free Web site network Wetpaint announced recently that it will no longer support OpenID as a login option for its wiki, citing low usage and high support costs as reasons.' Apparently, fewer than 200 registered users bothered with OpenID, and the extra QA and development time doesn't make it worthwhile to support. This can't come as welcome news on top of the internal issues the article mentions the OpenID Foundation is having now, too." I've actually been quite happy with OpenID, since I have spawned far too many username/password pairs over the last 20-plus years, but it's a major chicken-and-egg problem. Hopefully someone out there will build a better mousetrap ...

It is not supported

[butlerdi]

It would help if the players actually had spent any effort to make it work. Try using Verisign's site and it is horrible. It times out when validating. The others while rich in graphics are no better, nothing to see here .....

OpenID still exists?

[jandrese]

I remember when this came out. I thought to myself "I'll sign up when I run into a website that needs it." Except for this article, that was the last I'd ever heard of it. I'm amazed it is still around.

Re:What bothers me about OpenID.

[Aladrin]

The idea behind OpenID is that the forum never has your login credentials, they just have the promise of some OpenID server that you are really you. They can never use the information they obtain to log into any other service you use with that login.

You still have to trust that OpenID server with all of your logins, but it's not like you trust every tiny site with them.

Having said that, very few sites I use will take OpenID, and some are providers only... Which is absolutely worthless. I'm waiting for something worthwhile to happen before I jump in, and I bet a lot of other people are, too.

Re:Local software solution instead

[DMUTPeregrine]

KeePass Password Safe is open source, and quite portable. I keep my database on a USB key, which is on my keychain. Anywhere I go I have my passwords AND the executables.

Re:a site that uses nothing but OpenID

[Dan667]

More clicks and is annoying being redirected.

Re:I Wonder Why...

[Main Gauche]

I checked out the "Explaining OpenID" web site referenced in the article, and it didn't make a whole lot of sense.

Agree 100%. After wasting time plowing through the same front page you read, I finally found the five minute video [openidexplained.com] (!) that makes me think this works similarly to Google Checkout: When you want to log in to site X, you are redirected to an OpenID site, and enter your single password there; then site X is told that it's really you.

I got none of that from the front page.

Re:What bothers me about OpenID.

[Anonymous Coward]

The idea is dumb, it does put your eggs all in one basket because once someone has your login credentials they have your whole online identity.

If I found out Richard Stallman's openID usr/pass I could create an account on slashdot and post shit and people would think I am him because I am using his openID identity.

That's what is so damaging about it. Not only does it give a black hat login access to your personal information all over the internet, but it also allows you to create new information under the guise of someone else potentially ruining a person's life.

The above shows off OpenID's biggest weakness. Which is not the "all your eggs in one basket" as the poster alludes to, but rather the phenomenally poor marketing of OpenID. OpenID's web page pretty much sucks in explaining the technologies strengths. The biggest strength is that you don't have to have a static username/password. All the following are valid ways to authenticate with OpenID

• RSA Tokens [verisignlabs.com]
• Yubi Keys" [yubico.com]
• SMS Texting (The authentication server generates a random string and sends it to a phone via sms. It has the added benefit that you know when someone is trying to access your account.
• A system that uses Perfect paper passwords [grc.com]
• A system that takes an image from your digital photo collection and asks who took it
• A system that asks you to solve a word problem
• Whatever else you can come up with

In addition, the system can be set up so that you can have a list of "high security" sites (ie: a bank) where you have to answer a different set of questions/use a different authenticator then your normal everyday blog site.

who the hell uses MS Passport?

[Anonymous Coward]

Yes, but the difference is that Passport has worked reliably for years and years now... 10 years, if I'm remembering correctly... and I've yet to flawlessly log in to anything using OpenID even once.

Who the fuck uses Passport except other MS sites? I honestly thought that they killed it off years ago until you brought it up now.

Re:It is not supported

[Randle_Revar]

MyOpenID works very well. The few times I have had a failure to login, the problem was on the client web site's end.