James Cridland's blog

A radio futurologist writing about what happens when radio and new platforms collide

« | Blog index | »

OpenID – not ready for primetime yet

Posted on Saturday, January 5th, 2008 at 11:57am. #

I’ve been experimenting with, and pondering on, OpenID.

A new site’s appeared, spreadopenid.org, which, when I read the blog post describing it, looked just like the thing I was looking for:

The goal of Spread OpenID is to complement the official OpenID.net site with content that cannot be found there (at least not presented in the same way). The intended audience is the average internet user.

Excellent. At last, I thought, a website which communicates, in a simple to understand way, what an OpenID is and how to get one (or discover whether you’ve already got one) in a clear, friendly way that the average user will understand.

So, I rush over. To be depressed, instantly.

Here’s the second paragraph (my bold):

The first problem many end users are facing is finding an OpenID provider. Maybe you know that OpenID is a decentralised single sign-on (SSO) system which simply means that no one owns it and that you can choose from different providers which is very positive for users, of course; they can choose a provider they trust and which fits their needs.

Putting aside the inconsistent “you” or “they” in this writing, this manages to use so much geek-speak it’s actually totally unfit for purpose. I am, apparently, an “end user”, and apparently I might know that it’s a decentralised single sign-on system – helpfully, if that bit wasn’t confusing enough, the site writers have added a Three Letter Acronym (TLA), the scourge of the modern world, to confuse a user. The rest of this text never refers to an SSO again, incidentally, which makes it entirely pointless.

I’d rewrite it as:The first thing you’ll need is to find someone to provide you with an OpenID. Just like an email address, you can get an OpenID from loads of different people: it’s up to you.

But this is the big problem with OpenID right now. The rather better openID.net gives this page to show to prospective users to show them how to get an OpenID of their own. This is a better and easier-to-understand page, but it’s still nowhere near as simple as it could be.

All I want is, for my OpenID-enabled application (I have one, it’s under wraps for now), to be able to have a “register now” link which takes the user to a simple, easy-to-understand page, which succinctly explains how to get an OpenID. And, perhaps because of OpenID’s “decentralized nature”, there’s nowhere to take my users which is clear and understandable.

Until OpenID stops talking to the geeks and starts talking to the users, it’s not ready for primetime. Which is a shame – because as a developer I’m delighted not to have to write yet another registration module, and as a user, I’m delighted not to have to remember yet another username/password combination.

Photo: Mike Linksvayer. Public domain.

2 comments

Scott Kveton
commenting at January 5th, 2008 at 8:41pm

We have debated as a community how to present the data at openid.net/get … its tough to balance the want of community members to be on the page with ease-of-use for users. The current page certainly could be easier and I really welcome the work that Carsten and Thomas are doing with spreadopenid.org.

Would welcome any/all comments on how to make it easier … I’d love a page that could succinctly describe what an OpenID is, why a user wants one and then a few form elements to make it happen … or would it be something else?

Eamonn Smyth
commenting at January 14th, 2008 at 6:06pm

I agree the concept of openid is great, which is why I am considering its incorporation in my web application development system. Details of the sourceforge project can be found @ ephp.org.

Without even looking at the mechanisms or code base behind openid I can see potential pitfalls.

You acquire an identity and register with x number of sites, all runs well and smooth, until one day you awake and find your openid provider has disappeared and you can no longer log into the site you once did.

I have seen sites offering active openid username/password as a test facility. What mechanism stops sites being spammed by the use of publicly available openid logins?

Leave a comment

Here's my commenting policy