News for hackers. Stuff that matters.
Re:Gchat Was the Future of Messaging, but Google Didn’t Know by Freak_NL on Sunday May 29, 2016 @05:36AM (#11795697)
I have no qualms about OpenID Connect itself — it is a sound standard, using JSON Web Tokens is a particularly nice feature — but I dislike encouraging users to identify themselves for every service they use with Facebook or Google accounts. Way too much information about your digital life centralised with a single commercial party.

I'd much rather see the use of password managers become more common, or even better, stimulate user-friendly two-factor authentication standards such as FIDO U2F.

Re:Gchat Was the Future of Messaging, but Google Didn’t Know by StavrosK on Sunday May 29, 2016 @05:39AM (#11795710)
OpenID Connect supports discoverability, which enables a protocol like Mozilla Persona to work over it. That's exactly what some others and I are working on, hopefully we will make some headway and greatly increase the usability of authentication again.
Re:Gchat Was the Future of Messaging, but Google Didn’t Know by Freak_NL on Sunday May 29, 2016 @07:01AM (#11795916)
Sounds like a good initiative, be sure to post on HN when you reach significant milestones.

What I worry about with OpenID Connect on the open internet (as opposed to OpenID Connect used in a corporate setting, or to provide single sign-on solutions for specific partnered services) is how it almost always results in a service asking you to use Google or Facebook to authenticate, with huge coloured buttons, followed by a tiny de-emphasized grey link where you can sign up using email and a password.

Is this something we can prevent?

Re:Gchat Was the Future of Messaging, but Google Didn’t Know by zanny on Sunday May 29, 2016 @11:14AM (#11796614)
They only provide Google / Facebook buttons because they are by far the most popular option. In practice the vast majority of major online web services support some from of openid / oauth signon, from Github to Steam to Wordpress and more.

As a site developer, it is your job to figure out what buttons your user demographic will use. If it is all facebook / google, then provide those, and most of these sites know providing more obscure options only confuses their potential users.

Re:Gchat Was the Future of Messaging, but Google Didn’t Know by StavrosK on Monday May 30, 2016 @07:14AM (#11800735)
I think it is, because the "Google" or "Facebook" part isn't static in OpenID Connect, they're just popular defaults. OIDC doesn't care where it goes to authenticate, you can just as well enter your email, [email protected] and the server will try discovery and authentication against example.com (which can then be running your own OIDC provider).

What we're working on (we will definitely post about it) is basically OIDC with a nicer UX, where the user enters their email, the domain is parsed out, discovery (of OIDC or whatever other protocol) is done, and the user is redirected to either their provider, if found, or to a default method of authentication (currently a link sent over email) to log in.