Google Adopts, Forks OpenID 1.0 316
An anonymous reader writes "Right on the heels of Microsoft's adoption of the OpenID protocol by announcing their intention to enable OpenID authentication against all Live IDs, Google has announced their intention to join the growing list of OpenID authentication providers. Except it turns out they're using their own version of OpenID that is incompatible with everyone else. It seems that Google will be using their own 'improved' version of OpenID (based upon research and user feedback of the OpenID system) which isn't backwards compatible with OpenID 1.0/2.0, in hopes of improving end-user experience at the cost of protocol compatibility and complexity."
Slightly Conflicting Vision Statements (Score:5, Funny)
OpenID eliminates the need for multiple usernames across different websites, simplifying your online experience.
Everyone else's vision statement:
Fuck OpenID, I'm in control now.
Re:Slightly Conflicting Vision Statements (Score:5, Funny)
EMBRACE AND EXTEND!!!!
oh...wait...I'm confused, this a Google article, not a microsoft article
Re:Slightly Conflicting Vision Statements (Score:5, Interesting)
To make matters even more confusing, Microsoft has embraced, but not extended.
Re:Slightly Conflicting Vision Statements (Score:5, Funny)
Re:Slightly Conflicting Vision Statements (Score:4, Funny)
It truly is a sign of the apocalypse.
Microsoft being "un-evil" and Google eviling it up.
Google did no such extension either. (Score:5, Informative)
If I were Google, I would demand a retraction from this guy for pushing this libelous garbage.
Re:Google did no such extension either. (Score:4, Informative)
Mod this dude up, the article has it totally wrong. Google is just supporting OpenID 2.0 which happens to be incompatible with OpenID 1.0. It's also worth mentioning that 2.0 was developed by the OpenID group and not Google (unlike some Microsoft 2.0s)
Re: (Score:3, Informative)
Re:Slightly Conflicting Vision Statements (Score:5, Funny)
Google:
1) write a good search engine
2) ???
3) grow to critical mass where you can guarantee yourself users
4) embrace
5) extend
6) release extensions to the community
7) get users based on 1-5 using the new system
8) advertise the hell out of everything to the users on this system, too
9) profit!
10) repeat steps 4 through 9
Microsoft:
1) write decent BASIC tools
2) ???
3) get someone else's OS preloaded by IBM and ride their coattails to ubiquity
4) embrace
5) extend
6) close off extensions
7) hook users through lock-in created in steps 3 through 6
8) extinguish open system
9) profit!
10) repeat steps 4 through 9
The '???' steps come a little early in these. Sorry about that.
Re: Google Version!! (Score:5, Funny)
Embrace, Beta, Languish!
How to judge what's going on (Score:5, Interesting)
1. Do they make it possible for everyone else to implement exactly what they are doing, on both the producer and consumer end, without any patent restrictions, royalties, or discriminatory licensing?
2. How close is what they are doing to the latest version of the standard, not 1.0?
3. Do they try to get what they are doing into version 2.1 (or whatever) of the standard?
4. Do they really have a reason for doing this? Like making the login easier for normal nontechnical people rather than you and I?
Bruce
Re: (Score:3, Interesting)
I'm not sure about #3. It might be a lost cause because standards generally don't much like breaking compatibility. Still, I guess it couldn't hurt for them to try.
Re:How to judge what's going on (Score:5, Interesting)
The string typed in is sufficiently different from what OpenID uses today that it would be easy to disambiguate. Putting this in an OpenID library, without increasing complication to the library user, sounds easy enough.
I think what Google is saying here is that if 99% of users are used to typing in their email address, and not used to typing in a URL as their ID, you should try to make your ID scheme work with an email address rather than invent something new. This actually sounds sensible. But I haven't looked very deeply and would be happy to hear from folks with more expertise.
Bruce
Re:How to judge what's going on (Score:5, Insightful)
I agree with you wholeheartedly that Google's solution is better, Bruce, but...it's not the standard. The proper way to do this, and one I'd have been fine with, would be to support OpenID, plus this alternative that's much easier for the average user to understand. That's not what Google did, and I don't think we're out-of-line for faulting them for it.
Re:How to judge what's going on (Score:4, Interesting)
Re:How to judge what's going on (Score:5, Informative)
Re: (Score:3, Informative)
Actually, no. Google's mechanism varies from OpenID 2.0 in one key area: the identifier provided is neither an XRI nor an HTTP or HTTPS URL.
Re:How to judge what's going on (Score:4, Insightful)
Re:How to judge what's going on (Score:4, Informative)
It's "computer criminal". "Hacker" means something else.
Yes, legacy systems would tend to treat the OpenID login as your "handle". But they don't have to, and IMO it's bad practice to do so once you join OpenID.
Bruce
Snarky AC comment (Score:4, Interesting)
Dear AC,
This is an understandable assumption but doesn't reflect the facts. For example, Symbian has purchased consulting services from me. If you look here [theregister.co.uk], you'll notice that I am not afraid to criticize them.
Had Google taken me on and allowed me to work on the PR for this, I would have had them communicate about it differently. It's no trouble for Google to get this stuff back into OpenID, but they obviously didn't take the trouble to assure people that would happen.
Bruce
Re:Snarky AC comment (Score:5, Insightful)
If you want this, you need to go to W3C and start a standards activity. Browser authentication has remained the same, it seems, for a very long time. And if you actually implement it, you find it's lacking. For example, there is no way to log out! Browsers generally send authentication with each request to the site after you sign on.
Bruce
Re: (Score:3, Interesting)
Easiest way to log out using browser authentication? Throw a 403 when the browser sends its credentials. They get in a huffy and demand the user give them new ones.
Re: (Score:3, Funny)
Maybe you should know who you're talking to
He did say "Get over yourself", didn't he?
Re:How to judge what's going on (Score:5, Funny)
There is nothing similar in the 2.0 OpenId standard.
HAHA DISREGARD THAT, I DON'T READ STANDARDS
Re:How to judge what's going on (Score:5, Informative)
Actually, it IS OpenID 2.0 compatible from what I can tell, but the id to use is obscure. It is NOT backwards compatible to OpenID 1.0. It DOES require the site doing the authentication request to be approved by Google. It does NOT require modifications to any OpenID 2.0 compatible library that I can tell. It DOES recommend modifying your login UI to provide 'login with google', which is just a shortcut to going to OpenID on the special google openid URL.
They list a couple sites on the google group as having been authorized. I found google's special openid url and tried it on livejournal, twitterfeed (not listed on their approved sites list) and on one of the approved sites. Here's my results:
Livejournal: LJ gave me an error. I guess LJ is still 1.0, though I have no proof.
Twitterfeed: Google gave me an error, saying I wasn't authorized to perform the action.
The approved site gave me a 'login with google' option and also a 'login with openid' option. I used the openid one and put in the google openid URL. It brought me to the google openid signin page.
Nowhere did I enter in any personally identifiable information to any of these websites, it uses the same trick yahoo does where you can just put in yahoo.com and it'll work, and respond with the email if I allow it access (except currently google's openid URL is much more awkward). I'm not convinced that anything is going against the OpenID 2.0 spec here, though the fact that every site that wants to support this has to request permission seems kind of odd.
Re:How to judge what's going on (Score:5, Informative)
I think so. I don't think they even intend to announce that they support OpenID. I think they're using it as a protocol because all the libraries are already written, but they recognize that you can't just go to random_website.com and use their id URL since 1) they won't let random_website.com use this service, and 2) their id URL is really really weird at the moment (and doesn't use email addresses or any personally identifiable information, sorry everyone else commenting).
I believe the story is just FUD, all around. The summary is wrong (it says it's not OpenID 2.0, Google's page says to use any OpenID 2.0 library). Google hasn't announced they're supporting OpenID, but they are [at least planning on] providing a service that uses OpenID under the hood to do OpenID-like things (namely a "Login With Google" option). I will be very surprised if Google advertises that they support OpenID and that everyone's gmail account is OpenID enabled with this implementation, since it's definitely not going to work for the vast majority of sites.
Making Extensions Possible Without Evil (Score:5, Insightful)
It's open development if the extension is as open as the original standard. It's not an accepted standard until the standards group accepts the extension.
Is it an Open Standard if you can't extend it openly? I am entirely against closed extensions to open standards, and unnecessarily incompatible extensions, the classical "Embrace, Extend, Extinguish" stuff. But I am equally against standards being a ball and chain that prohibits further innovation. You should be able to produce an extension that you make open on the same terms as the original standard.
It looks to me as if Google is attempting to hit OpenID with a clue stick on a really obvious issue, saying "Normal folks use email addresses to log in, dummies!". And I am being told that what they are doing is really close to OpenID 2.0.
Bruce
Re:How to judge what's going on (Score:5, Insightful)
And because Microsoft has a record of doing just that repeatedly, it would be reasonable to do so.
Please don't forget all of the bad practice around approval of Office Open XML, which made a sham of ISO, and their very recent maneuver to take over the OpenDocument standard group at ISO.
At the moment, I am less likely to trust Google regarding democracy and civil liberty issues than I am regarding Open Standards. Because they have a record on that.
But I agree that they screwed up the relationship and PR issues around this move. They should know better.
Bruce
Re:Slightly Conflicting Vision Statements (Score:5, Informative)
copied from down thread:
I cannot overemphasis the need to actually read the articles: Google is not supporting OpenID 1.0, they are supporting OpenID 2.0. This is exactly as they claim in the first article. The sensationalist second article linked above is claiming they somehow extended OpenID 1.0, when really it was the OpenID designers who extended it into its second form. Google is embracing the protocol as it exists.
If I were Google, I would demand a retraction from this guy for pushing this libelous garbage.
don't be evil (Score:5, Funny)
Google... learning more from Microsoft everyday (Score:5, Insightful)
Re:Google... learning more from Microsoft everyday (Score:5, Insightful)
Yes, except just yesterday Microsoft joined OpenId, _without_ this sort of stunt.
IMHO, microsoft's behavior in the last few years is to be commended, they are worlds away from where they were 10 years ago.
Sadly, google seems to be heading the other way.
Re:Google... learning more from Microsoft everyday (Score:5, Informative)
Google themselves are claiming they're not supporting OpenID version 1, which is what the article is raving about. They claim they're supporting OpenID version 2.0, which as far as I can tell, that's exactly what they're doing. I can't see any difference between Google's documentation and OpenIDv2's documentation, at all. Can you? His "emphasis added" section clearly says the same thing the OpenIDv2's "emphasis added" section says is the difference between the two protocols in the first place.
Sensational press 1, Rational thinking 0.
Re: (Score:2)
Sensational press 2, Rational thinking
Re:Google... learning more from Microsoft everyday (Score:5, Funny)
Don't forget irrational thinking, -2i!
Re:Google... learning more from Microsoft everyday (Score:5, Informative)
Don't forget irrational thinking, -2i!
That would be complex thinking. Irrational thinking would be -pi :)
Re: (Score:3, Informative)
No, Google is taking OpenID, and putting out their own version.
Google's OpenID is not OpenID, it's GoogleID.
If MS did this, you'd throw a bitch fit.
Re: (Score:3, Interesting)
No joke. When I first read the summary, my first thought was that this will finally shut the naysayers up about Google being evil. This is almost exactly the sort of thing for which people have criticized Microsoft.
I say "almost" because there are a few things yet to be seen:
The big problem with Microsoft's EEE philosophy is from an interoperability standpoint. Reverse-engine
Re:Google... learning more from Microsoft everyday (Score:4, Interesting)
IMHO, microsoft's behavior in the last few years is to be commended
Yeah, they behaved so well during the whole OOXML/ODF stuff.
they are worlds away from where they were 10 years ago.
One half-assed attempt at a good deed (that isnt actually good in any real way as they're only providing OpenID not accepting it from others) doesn't erase decades of screwing people over.
Re: (Score:3, Informative)
microsoft's behavior in the last few years is to be commended
Excuse me? Have you been living under a rock? Microsoft has subverted an entire standards body worldwide to push a bloated mess of a document format! Their browser is still a POS, except it's now a more user friendly POS. Microsoft is exactly where they were 10 years ago, they've just adapted to a changed world.
Re: (Score:2, Interesting)
Re:Google... learning more from Microsoft everyday (Score:5, Informative)
Microsoft has a history of supporting unfinished or in progress standards, then keeping them that way. Just look at what they do with W3C standards. Keeping is static.
No ECMAScript 4.x, no DOM Events, no Canvas/SVG/etc., no greatly improved JS support because they only "want to make existing content content run better" rather than preparing for what the future may hold. Everyone else is doing that - make JS more robust today, so we can have better apps tomorrow.
MS has no interest in a standard that really works - but they'd love to be able to claim support for an open standard just the same.
Re: (Score:2, Funny)
Re:Google... learning more from Microsoft everyday (Score:4, Interesting)
I'm not saying what Google is doing is right but they're just getting to the point where as MS was taking the slow route to the same destination.
Re:Google... learning more from Microsoft everyday (Score:4, Funny)
They drank Flavor Aid at Jonestown.
Re: (Score:2)
And fucking typical to have it referred to as "adopting" and "forking", when they're really just doing the same ol' corporate bullshit of stealing and proprietarizing.
so lets see slashdot bias at work (Score:2, Insightful)
if microsoft did this, the hoardes would be eviscerating the company
if google does this, watch the defenders come out of the woodwork
slashdot bias: microsoft bad, google good, apple shrug
its not the year 2000 folks. google is not some little darling upstart anymore. update your bias accordingly please
Re:so lets see slashdot bias at work (Score:5, Insightful)
Google will be cheered or booed depending on what they do with their changes to OpenID. They could very well turn around and propose it for version two or whatnot of OpenID. After all, if it isn't compatible then what the hell is the point.
Microsoft is hated because they DEFINED "embrace and extend." They regularly use it as a weapon against their competitors. We have yet to see Google use their version of OpenID, much less use it against anyone.
Never mind that OpenID screams "single point of failure" to me.
Re: (Score:2)
Read the article.
Google hasnt provided any extensions or changes to OpenID and has released no new protocols. They've introduced a black box you have to go through to get to their vanilla OpenID service. Theres no value add for developers.
The value add for clients is that they can just enter their email address instead of a URL. This would've been far better served by defining a DNS-SD spec for use in looking up emails and transforming them into OpenID's. Instead Google's opted for a black box of no use
Re: (Score:2, Insightful)
I think Google's shininess has worn off for most at this point.
The interesting implication to me is that I may have to concede Microsoft is not inherently evil, at least not more so than any other large corporation. Google, having become one has been progressively more Microsoft-ey.
Re:so lets see slashdot bias at work (Score:4, Interesting)
Hell, I honestly think it's possible to root for Microsoft these days. .NET, including the stuff they've just announced, is an open standard, and MS is encouraging competing implementations. They're working with Mono to ensure it has good Silverlight support, including proprietary codecs. They have their own cloud service, yet worked with Amazon so that Windows could be on EC2. They offer a free version of VisualStudio that's more than sufficient for hobbyist work, and ironically arguably have the most open and easy-to-target 3rd-gen gaming console for small development shops. They're supporting OpenID, making IE increasingly standards-compliant, and, with Windows 7, look like they might actually have a pretty nice operating system that I might not feel a pressing need to migrate away from. They're definitely not perfect—I'm still royally pissed at their behavior over OOXML—but they're doing an awful lot of things right these days.
Google, on the other hand, is going the opposite direction. They've done a proprietary fork of OpenID (which, despite the other comments on here, I definitely find offensive, because locks you into Google in exactly the same way Passport locked you into Microsoft). They closed their SOAP service and offer no alternative. They've basically said Gmail will never use IMAP properly, and they consider that a feature, not a bug. They do business in China on the argument that "well, someone had to do it, so why not us." They still do a tremendous amount of things right, but, just as I think we should acknowledge that Microsoft nowadays is doing a lot of things right, I think we need to start acknowledging that Google is doing a lot of things wrong.
Nobody's perfect, and situations can change surprisingly quickly. I remember when IBM was the evil overlord and Microsoft was our savior.
That was 1992.
Just because Google's been good up to now is no reason to assume they'll continue to be.
Re:so lets see slashdot bias at work (Score:4, Informative)
um did you completely forget destroying the validity of ISO to push a document format that is useless for 90% of the world to work with, that was pushed through so hard several countries are beginning to reject ALL ISO standards.
so yea MSFT has been a good citizen lately.
Re: (Score:3, Insightful)
There is institutional bias at slashdot, but from what I've seen, the pro-googliness has dropped in the past year or two as Google has started playing hardball with a big stack[2].
At any rate, slashdot is a community of individuals, and any perceived bias among the community just reflects the fact that fanbois exist -- and if you're aware of that fact, you can run the comments through your ow
insert foaming (Score:5, Interesting)
You see, it is OPEN, right? I mean, it says so right in the name of the protocol *OPEN*ID right? And google is cool right? So OpenXyz + Google = Win, right? I mean, OpenID sucks, right? What is wrong with somebody embracing it and then fixing the problems by extending it to be better? Nothing. After all, it is OpenID.
I think if I ever start a company that publishes the most evil DRM spec on earth, I'd probably name it OpenDRM or FreeDRM just so I can win over the Slashdot crowd. As long as it has Open or Free in the name, you can pretty much get away with murder, especially when your Slashdot corporate karma is "excellent".
But seriously, OpenID needs more then a face lift. For starters, based on my experience with Stackoverflow, browsers need to auto-fill the OpenID box with my URL, er, login name (cough). Then they need to boot out any fool who things the "login" should be anything other then an email address. Whoever dreamed up using a URL for a login wanted the spec to fail. Oh, and then when they are done with that, how about moving it down the network stack so that the damn thing can be used to authenticate against protocols other then HTTP, like say, IMAP or something. Oh wait, except OpenID was never intended to be used to authentication... or was it? Nobody really knows because even OpenID proponents says you shouldn't use it for anything other then trivial accounts and if you use it for anything else, you are mis-using the spec!
Re: (Score:3, Informative)
Then they need to boot out any fool who things the "login" should be anything other then an email address. Whoever dreamed up using a URL for a login wanted the spec to fail.
Excellent point. OpenID 3.0 should include provisions for carrying out the authentication via SMTP, and maybe BitTorrent or NNTP.
Meanwhile, in reality, you know that ultimately the URL is the location of your OpenID server, right?
Why OpenID fails (Score:5, Insightful)
I've got one word for you
Huh? No seriously. Huh?
OpenID is just so damn unintuitive that nobody really gets it. It is a fucking login. Why can't it be an email address? Why can't it resolve the right place to conduct authentication business via DNS the same way SMTP gets it's MX record based on everything after the @domain.com?
Seriously, the more people try to explain it, the more it just makes peoples eyes glaze over. All they see, and all I see, is a fugly looking URL that is supposed to magically authenticate me, only as a web developer, I'm told I can't actually trust the authentication because the protocol wasn't designed for it. Or something. My head spins now.
Re: (Score:2)
Why can't it resolve the right place to conduct authentication business via DNS the same way SMTP gets it's MX record based on everything after the @domain.com?
Because for the average person, it's a lot easier to set up a blog than it is to get their ISP to set up custom DNS records.
Re:Why OpenID fails (Score:5, Insightful)
There you go again. What the hell are you talking about? Now to log into some stupid site, I have to get a blog too? Huh?
Admit it, the URL thing sucks ass. Email addresses are something we all have, and many websites are using email addresses as your login already. If OpenID did email, even *if* there wasn't any DNS trickery like I suggest, life would have been 100% easier. But no, I'm sure there is some "valid" reason the purity trolls who wrote the spec had against something so simple and logical, so they decided URL's would be best, usability be damned.
Re:Why OpenID fails (Score:5, Insightful)
Do you already have a Google Account nickname set up and ready to enter into the login field? Did you even know such a thing existed? Does Joe The Plumber (TM) know that?
I do, but then again, I use OpenID the way God intended: I have my blog delegate to a 3rd party that specializes in it (myopenid.com).
My blog URL is exactly what I want to show the world my identity. It's the hub of a significant portion of my public online content.
Why does a blog that I'm commenting on need to know my e-mail address? They might spam me.
An e-mail address is private information. A URL is just as unique, with the added benefit of being public.
Re: (Score:3, Interesting)
Of course it is, you'll have to trust that I will not disclose it to other people and instead let you pick a nickname.
Quite frankly, if you aren't willing to at least offer a way to contact you, I'm not interested in letting you post a comment. Remember I have to trust you aren't gonna spam the bajesus out of my site too! A random OpenID URL offers me no assurance you aren't just some comment s
Re: (Score:3, Interesting)
I'm willing to provide the URL of my blog. With that information, you can find out quite a bit about me, or not, without my knowledge, and you can also contact me if you choose. An e-mail address can be generated and throw
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
if microsoft did this, the hoardes would be eviscerating the company
if google does this, watch the defenders come out of the woodwork
slashdot bias: microsoft bad, google good, apple shrug
its not the year 2000 folks. google is not some little darling upstart anymore. update your bias accordingly please
I've been seeing similar comments whenever google does something stupid lately - but for all that people claim we're a bunch of google apologists here, I seldom actually see it. Usually google gets torn apart just as much as anyone else does - perhaps even a bit worse than others because of their unfortunate choice of slogan.
Re: (Score:3, Insightful)
Yes, that is true. But, there's just one thing though that isn't mentioned enough, namely that they created a new paradigm in search 10 years ago. The 10 years ago part is the thing. There's not only been no improvement, they've effectively eradicated all competition, and their search is now fairly well gamed by most any and all black hats.
Thus, the net result is that, overall, the user experience for search is now worse
Embrace and extend (Score:2, Redundant)
Embrace and extend [wikipedia.org] — all the while doing not evil. No, absolutely not.
New and improved feature? (Score:4, Insightful)
Google OpenID: New and improved personal information gathering.
Sorta defeats the purpose yes? (Score:2, Interesting)
I mean, if I can't use my Gmail address to logon to websites that actually support OpenID, then why would I bother? Not only that though, does it support non Google addresses hosted on Google Apps? (E.g. sexygrrl@example.com)? If not, then even bigger fuck off to it.
Meh, sounds a bit like another "Passport", fuck that, I don't want a big (or little) corporation controlling my ID.
Anyway for the ignorant and lazy:
Re: (Score:2)
I see two options Google could have pursued if they'd wanted to embrace and extend OpenID to let users use their email addresses.
1) Define a mapping users can use. Tell users to use http://gmail.com/~ApathyMaybe [gmail.com] or http://apathymaybe.gmail.com/ [gmail.com] for their url's for example.
2) Define a protocol for developers to map email addresses to URLs. Use some kind of URI-template to convert ApathyMaybe@gmail.com into one of the aboves.
As you sarcastically point out, they ignored both options and dropped a heinously u
Re: (Score:2, Informative)
I'd really hope that whoever owns the OpenID trademark comes after them and forces them to stop calling whatever they're doing "OpenID". If it's not compatible with an existing specification, it's not OpenID. They will risk seriously devaluing their trademark if they allow incompatible implementations to use the name. They need to be ruthless about this. Google can do whatever it wants and call it "GoogleID", but if it's called "OpenID", it needs to be compatible with everyone else claiming to be that.
http://openid.net/what/ [openid.net] says:
... OpenID is not owned by anyone, nor should it be. ...
And considering the guy that created OpenID (Brad Fitzpatrick) now works for Google, and Google has a seat on the board of OpenID, I don't see much happening
Stop your complaining (Score:5, Insightful)
OpenID usability sucks.
There, I said it. It's true. My computer-illiterate dad just wants to post a comment on a blog, or to login to a new website. You can't possibly expect him to do something as complex as reading up on what OpenID is, signing up for an OpenID account on a totally different website that has got nothing to do with the original website that he was on, and then logging in by entering a long magical URL. People like him - average users - have trouble enough understanding usernames and passwords! The recently published OpenID usability study confirms all the criticism that I've had on OpenID.
While OpenID is technologically sound, its usability is not. If Google's version is more usable, but is still open, then I'd gladly support it even if it's not compatible with the "official" OpenID standard. I don't care whether they're being "nice" or "evil" or whatever, I want better usability because software is supposed to be usable.
Re: (Score:2)
Re: (Score:2, Interesting)
Re: (Score:3, Insightful)
You clearly havent spent even the most cursory effort to investigate what Google has actually done here.
They havent changed OpenID, they've built their own black box to lookup OpenID URL's for email addresses.
Your entire argument is posited around Google making a more usable version of OpenID. While it may be easier for gmail users in that they can use their email addresses instead of url's, Google has not provided any spec for how other sites can implement the black box they've thrown in front of a comple
Google's Docs (Score:3, Interesting)
That's not true.
They've provide a spec on its (fairly trivial) interaction (since developers couldn't use it otherwise), and they've provided recommendations and rationale on implementation
Re:Stop your complaining (Score:4, Insightful)
Reading your thread you do a very fine job justifying a means to an end, but I'd still wager that the means that Google used are abominable.
"It means that now, people who have Google accounts can login to my website without having to register."
It also means FooBarWidget's dad (the proverbial Joe the Plumber of this thread) also has to remember that on every other site he has to use something else. And if he wants to use his Yahoo or MSN account, he has to remember its something totally different. Google has simply added to the confusion by throwing in their own proprietary non-interoperable standard, further fractioning a standard you've already argued is unusable for its complexity.
The only acceptable way to make this a win for users was to make some kind of a standard. Google didnt. Instead they've only further exacerbated the mess of online identity standards. I'm happy that you're happy that you can tell your dad to just use his email, but for Dad thats only ever going to work on a very very small handful of sites for users who happen to want to use their google account identity; for the other 99.99% of use cases it only murkier the water further.
The real insult-to-injury here is that OpenID already supports email logins. Theres no reason Google couldnt have let good ole dad login with foo.dad@gmail.com; OpenID translates this to http://gmail.com/ [gmail.com] which happens to be a valid web address. But instead of implementing an existing standard at no cost to developers everywhere, Google added more complexity for developers and more confusion for users.
I dont see whats salvagable about this. Google didnt add anything new for users, made it so users of gmail couldnt use 99.999% of OpenID consumers, put a huge burden on developers, and confused a lot of users struggling with an complex system whose only boon was interoperability.
I'm happy its easy for you and your dad. But theres about eighty things a 9 year old programmer would have made better decisions about, and at no cost to the rediculously low bar you've set for your expectations.
stackoverflow too (Score:2)
Check out stackoverflow.com, it exclusively uses OpenID for account info.
Re:Stop your complaining (Score:5, Insightful)
"Rubbish. For people like your dad, OpenID is both simple *and* simpler than having to sign up for dozens of sites just to post a comment."
That's true if you count the step. The thing you overlooked is, he doesn't know what OpenID is! Try to explain OpenID to a random person on street. How big is the chance that he understands it and will even care? Have you ever went through an OpenID registration process? There's no way my dad understands that. The barrier to entry for average users is too high.
There's more to usability than simply counting the number of steps.
"Suppose we live in a world where everybody implements OpenID (as a consumer and provider)."
It's useless to speak of such a world. It simply doesn't exist. The hard reality is that OpenID adoption is still low.
"If I "can't possibly expect [your dad] to do something as complex" as that, I weep for your dad - and you, given that you got 50% of your genes from him."
Oh yeah, like launching a personal attack on me will make the usability problems magically go away. If anything, this is a sign of your weakness.
Re: (Score:2)
Well, to add to the other guy who reponsed to you, you also have to remember some ugly looking URL too. That or use a "popular" OpenID provider and hope that every site you visit has a way to enter the "username" portion of the OpenID URL and have it convert into a real URL.
The whole thing is insane. Had they gone with email addresses, it would had more of a chance to catch on. That is, if it could also overcome the whole "trust" thing... that is why am I supposed to trust any random OpenID provider to t
And this is why... (Score:4, Insightful)
...Google scares me more than Microsoft. Even as a die-hard Linux and BSD user, a FOSS zealot, I rest easy knowing Microsoft in its current form will likely be dead in less than a decade. Google, on the other hand, stands to become the Internet-age version of Standard Oil. This is the first "publically-visible" sign of their slide into Microsoft-like evilness, and unlike MS, they will probably be around a long, long time.
Think about it: the OS doesn't *really* matter (if it did OS X and Linux and all the rest would never have any users). Even MS knows this, as they prepare to break into the "cloud" market. Even the applications aren't *that* important now, with the number of people working on converters and programs like OpenOffice. What's important is data, raw information, and Google is a massive data broker.
Be very, very careful how much you trust to Google.
Re: (Score:2)
You mean they'll reduce the price of their product so low that consumers will flock to them putting their competitors out of business?
Oh no, maybe their competitors should get Congress involved [reuters.com].
Hold on, can you show your work... (Score:2)
I'm not really addressing your conclusions here, I'm just wondering about one of your assumptions...
Think about it: the OS doesn't *really* matter (if it did OS X and Linux and all the rest would never have any users).
If the OS didn't matter I'd be using Windows. It's because the OS matters that there's more than one OS out there.
Can you explain what you mean here?
Re: (Score:3, Insightful)
I have been on Slashdot for a decade now and those comments about Microsoft being gone in 5, 10, 20 years never get old. When you are sitting on that kind of cash and that kind of cash generating ability your not going anywhere, anytime soon.
Re: (Score:3, Interesting)
``This is the first "publically-visible" sign of their slide into Microsoft-like evilness''
Not even close. They have been doing much more questionable things for a long time now.
using email as login (Score:2, Interesting)
Re: (Score:2)
So they're experimenting (Score:5, Insightful)
Google is a research company; they're doing research. They are improving OpenID, in their opinion. Nobody relies on Google OpenID, they haven't stepped up to make an OpenID implementation and then started adding extensions, and finally broken compatibility to force conversion to their special vendor-locked-in crap. They've come out and said, "We are going to implement something new, based on OpenID."
Wait until Google Docs stops exporting to deprecated MS Word 97 format (and ignorers .docx entirely), but does export to Google Document Format for their new Google Desktop Office; then you'll see Microsoft behavior.
Re: (Score:2)
They'd only do that once they had 80%+ of the market. And given their recent actions, I'm pretty sure they *would* do that in a market where they have a monopoly.
Their whole "don't be evil" thing only applies when it's a minor inconvenience.
Re: (Score:3, Insightful)
Besides, I don't see, from reading the blog, that they make it incompatible with OpenID. they just add two additional steps -- the user enters an gmail address and then the google server returns an OpenID URL. So normal OpenID websites still work, users just type in the URL instead of having the relying party goes find out.
So it is really a compatible augmentation to OpenID. Whether google patents this or uses other way to prevent others from doing that, I don't know and not technical.
Google should provide real OpenID too. (Score:2)
The problem from Google's perspective is that the user doesn't have a Google URL, they have a Google username, and that's what the users think they should enter in order to log in.
So, in stead of typing in something like http://username.openid.google.com/ [google.com] the user selects "Google Account" from a drop-down box, and types in his user name. (Which is functionally equivalent to MS Passport.)
When I log in to a blog and leave a comment with my OpenID, my OpenID URL is displayed as the unique identifier of the au
You fork software, not a standard (Score:2)
I think we can ignore Microsoft, as their embrace/extend/destroy philosophy has remained consistent for decades. If they join OpenID it is only to destroy it from within. But this story is a bit crap.
"As Google points out, this isn't OpenID. This is something that Google cooked up that resembles OpenID masquerading as OpenID"
So if Google says it isn't OpenID how is it masquerading as OpenID? It sounds like they like the OpenID architecture so have copied it for internal use. Why not? They want to lock in th
Google sees the problem with OpenID 2.0 (Score:5, Interesting)
So it's very possible that some engineers at Google said "hold on a minute. This sucks. OpenID 1.1 made a lot more sense, let's build out from there and see if it's something that the Internet community accepts."
It may even come to pass that both OpenID 2.0 and Goopen-ID both end up specifying backwards compatibility to OpenID 1.1, which would be great because it would effectively halt the progress of the over-engineered OpenID 2.0 and put us back on a saner path.
Let's not call Google's plans evil until we see where this goes. It could end up being something that finally puts this useful technology into some widespread use.
Re:Google sees the problem with OpenID 2.0 (Score:5, Insightful)
Basically all open standards do, or eventually do, which is why many commercial entities decide to roll up their own. Yup, while definately many of the times when Microsoft did something like this WAS out of "evil", a large portion was for the same darn reason as this. There's VERY few open standards that aren't an insane mess of "I'll add your idea if you add mine" crap.
Re: (Score:3, Insightful)
You know, Microsoft usually offers that very same excuse when asked why they don't use standard protocols, or extend them: "well, that's because the standard sucks".
We all know how that line of thinking usually goes on /. - but, this is Google, so...
Google reality Check (Score:3, Informative)
Yeah that sucks but it's reality.
Google: We do less evil than everyone else(tm)
Let the backlash and my modding down begin!
As the Great Bill O'Reilly Once Said... (Score:3, Funny)
Fork it! We'll do it live!
Brad @ Google (Score:3, Informative)
Brad Fitzpatrick the creator of OpenID is working for Google now.
Maybe he knows better what they are doing.
No fork (Score:3, Informative)
What a ridiculous headline.
To quote from the actual posting, "The initial version of the API will use the OpenID 2.0 protocol"
This version was developed by OpenID, and is incompatible with 1.0, but open in the same way for everyone to use, with a number of improvements... Google is forking nothing.
Re:It doesn't matter.... (Score:4, Interesting)
Re: (Score:2, Insightful)
There IS a difference between "embrace and extend" and "extend right away": sneakiness.
Google lacks something both MS and Apple are going to enjoy for a long time: user lock-in via proprietary formats, DRM and/or user training.
Google has much less leverage to become evil by abusing lock-ins... hence less evilness.