News for hackers. Stuff that matters.
Re:Bye Bye Passwords by dragonwriter on Thursday May 29, 2014 @05:45PM (#7818783)
> So this is essentially delegating authentication to the user's Email service. Delegating authentication seems like a good idea: fewer passwords to forget and more conveniene. So why not delegate to a proper authentication service like OpenID?

Because the user is more likely to have email than OpenID, so delegating to an option of one or the other is more complex, and delegating to only the latter is limiting your market.

Re:Bye Bye Passwords by bjackman on Thursday May 29, 2014 @06:07PM (#7818913)
But either way the user has to sign up to something. When you delegate to Email you still have to initially create an account with the site's specialised authentication system. You'd just replace that process with creating an OpenID account.

But yeah, I guess saying "now go to this 3rd party website and create an OpenID account" is pretty ugly. I wonder if it's possible to have your own "sign up" page that's a proxy for creating an OpenID with a 3rd party provider?

Re:Bye Bye Passwords by giovannibajo1 on Thursday May 29, 2014 @06:15PM (#7818944)
From an UX standpoint, the problem with OpenID is that users are forced to remember and type URLs as usernames.

People are likely to remember their email if they have one, but URLs are disappearing from user interfaces (see Chrome, Safari, Mobile Safari, etc.).

Re:Bye Bye Passwords by pauselaugh on Saturday May 31, 2014 @01:23AM (#7825348)
Uh, no.

A user probably already has email, thus it usually isn't required. Unlike openID

Re:Bye Bye Passwords by donniezazen on Thursday May 29, 2014 @11:57PM (#7820195)
Anyone who has a Gmail or Facebook account automatically has one. I really like Google+ sign-in on Android.
Re:Bye Bye Passwords by hansrodtang on Friday May 30, 2014 @01:34PM (#7822996)
Facebook and Google both use OAuth 2.0, not OpenID. Google used to support OpenID, but that feature is deprecated.

They do seem to moving towards OpenID Connect though, which is just a identity layer on top of OAuth 2.0