Hacker Newsnew | comments | leaders | jobs | submitlogin
Google Goes Renegade, Creates Own OpenID Fork (neosmart.net)
44 points by ComputerGuru 3 days ago | 20 comments




20 points by sanj 3 days ago | link

From what I can tell, the goal is to make the experience easier on the user by doing the email domain to URL transparent.

The reality is that users don't know URLs as identification mechanisms. They do know email addresses.

reply

17 points by Jasber 3 days ago | link

This was always my biggest complaint with OpenID. I'm glad Google did something about it. Perhaps others will follow suit.

Users are comfortable using an e-mail address as an identity. Everyone has an e-mail address. This makes sense to end-users.

E-mail addresses are unique and they accurately identify who someone is. I have no idea why this wasn't the standard in the first place.

reply

10 points by lux 3 days ago | link

For sure. This is a slight change, but a big change for the better. Nobody wants to remember a URL when they already remember their email. This makes perfect sense, and solves the biggest issue with OpenID in a way that looks like it puts it on par with the ease of use for end users of Facebook Connect, for example.

If every service simply required an email address, and the standard provided for a way to find out the access point from the OpenID provider, then we'd be all set and everyone would be able to implement this change.

reply

1 point by dsims 2 days ago | link

Contact information should not be an identifier. It's like when a B&M store uses your phone number to ID you. I don't want them calling me and I don't want your website to email me.

The URL is simply a pointer to my identity, which is all I should have to give. The different formats the providers use is what makes it confusing (example.com, username.example.com, example.com/username, and now username@example.com)

reply

6 points by zain 3 days ago | link

If Google had stuck with the standard OpenID implementation, they could've still had the same user experience. http://zain@gmail.com/ is a valid URL, and Google could've used that as the OpenID URL.

reply

2 points by siculars 3 days ago | link

how hard would it be to slap "http://" onto the email if it wasnt there? that way you get your email and you dont break the standard. not hard, not hard at all.

reply

3 points by tlrobinson 3 days ago | link

Most/all OpenID libraries already seem to handle identifiers without the http://

If the libraries don't already support the "@" syntax, they should.

If Google's way of doing things requires any proprietary changes, I'd say it's unacceptable, but if that's the only change necessary then it seems like a reasonable way of doing things.

reply

2 points by fallentimes 3 days ago | link

Entering http before your email address doesn't make any sense to the average user.

reply

10 points by Harkins 3 days ago | link

Entering http doesn't make any sense to the average user.

reply

2 points by fallentimes 3 days ago | link

Exactly.

reply

2 points by tlrobinson 3 days ago | link

The http:// is not necessarily required, he was just pointing out that it's a valid URI and thus can be used as an OpenID identifier.

It seems most OpenID implementations handle identifiers without the http:// prepended.

reply

14 points by jmackinn 3 days ago | link

I don't think this blogger actually read the post by Google. The neosmart article emphasizes This is a departure from the process outlined in OpenID 1.0. This is because Google is following the OpenID 2.0 protocol which does contain the discovery request and the XRDS document process.

http://openid.net/specs/openid-authentication-2_0.html#disco...

This is not a fork from OpenID. They are simply using the newer protocol.

reply

3 points by pierrefar 2 days ago | link

According to The Next Web (see this post: http://cli.gs/MM0aab ), "Dick Hardt, an important OpenID supporter, also confirms that Google is NOT compatible with OpenID". They link to his comment on TC.

reply

13 points by randrews 3 days ago | link

This article closes with a meme I'm getting pretty annoyed with.

"Don't be evil" is not the same as "don't do anything that the author disagrees with".

reply

3 points by spydez 3 days ago | link

Well this is pretty much the same thing Microsoft does with standards that everyone yells, "Embrace, extend, extinguish!" at...

reply

6 points by sanj 3 days ago | link

Not really.

Google's telling you pretty much exactly how to do it yourself. They appear more interested in improving the standard for everyone.

reply

5 points by markbao 3 days ago | link

With respect to authentication, this is like Facebook Connect, but with a larger audience.

And it's like OpenID, but without 'send data' and 'server/delegates.'

I really like this.

reply

1 point by sh1mmer 2 days ago | link

The implication of division is also a really false one. Last week we had a summit about OpenID usability and Google as well as all the other major players in this space were there. People really want to find a good solution for users. This is not about division at all. People really want to find the same good solution for users to use everywhere.

I find the implication that tech companies are constantly at each other's throats and back stabbing each other like a bunch of Hollywood hussies tiresome. Google have talked about "federated login" for a while and this is them taking it out into the wild.

The exact implementation of Open ID that ends up being used by everyone is going to change over time as we learn what works for users and what doesn't.

reply

1 point by trevorturk 3 days ago | link

I think this is going to be great for OpenID in the long run. Email addresses just make a lot more sense than URLs for logging into sites.

reply

1 point by adrianwaj 3 days ago | link

I'd also like to see a credit card (or even PayPal account) attached to an OpenID account so one can also use it to pay for things online with an email address. An email confirmation would occur after each purchase. Thus OpenID becomes a substitute for a CC's number and its other details, which are lodged with the OpenID provider. At present, one can't even sign for an online purchase or show a confirming ID or enter a PIN.

reply