News for hackers. Stuff that matters.
Re:Why don't we expire passwords on the web? by StavrosK on Monday December 13, 2010 @10:50AM (#2000780)
Okay, we need centralised authentication of some sort. Since everyone seems to hate OpenID, is there a good protocol we can use now? OAuth looks good, but I don't know of any way to have individual servers, like OpenID.

A great solution would be to have what is, essentially, OpenID, but verified by your email provider. You enter your email (instead of a URL), and get sent to your email provider for authentication. Nobody forgets their email...

Regardless, what's a good alternative now?

Re:Why don't we expire passwords on the web? by iamdave on Monday December 13, 2010 @11:13AM (#2000877)
There's nothing wrong with OpenID in my opinion, I use it 9:10 times logging into this very website through ClickPass. The thing that doomed the project, from what I've been reading (and I've done a lot of reading because I thought it was a great idea) was the lack of documentation.

Both technical documentation and soft documentation ranging from how end users should interact with it, and what the best practices are. This seems to be an Achilles heel of a lot of projects like this in various patterns regarding informing users how to use it, versus how developers can develop for it.

Re:Why don't we expire passwords on the web? by StavrosK on Monday December 13, 2010 @11:17AM (#2000893)
I love OpenID too, I use it on every single site that supports it. However, I hear that people don't like it very much, probably because of the reason you mentioned. It's very sad, I think it had (and still has) great potential. Another problem with OpenID is that non-technical users can't really understand it :/