When I signed up for StackOverflow, I typed in "http://jrock.us/ as my OpenID, and was finished. No password, no email, no "click this link to confirm your email", etc. If SO gets hacked, they have no useful information of mine. If my OpenID provider gets hacked, I remove a few lines of HTML from my index.html page, and can use a different provider. There is only a tiny window where my accounts can be compromised. Either until I take down the redirect, or the provider itself is taken down.
(Compare this to the Perlmonks debacle, where my plaintext password is now known to the world, and I had to change the password on every website I've ever used. That is what I consider "complicated".)
This is probably the main user friendliness issues with openID. It's made worse by the fact that your Google/yahoo openid is some long URL and that typing in your yahoo/gmail in an openID 1.0 box doesn't redirect you to the login page like an openid 2.0 box.
Prove me wrong, but I think those are three skills not normally found in the average Facebook user.
I feel that my online ID is andrewducker.livejournal.com - it's been the centre of my online social life since 2001, it's where I keep in contact with my distributed friends, where I post things I think about. In a very real way, it's my defining online identity.
And now, thanks to OpenID, I can carry that identity with me to other sites. If I post on Stack Overflow I'm posting as _me_ - not just as whatever user id I happened to get in the gold rush.
That matters to me. If it doesn't matter to you then that's fine. But it's important to me.
Your identity is also tied to livejournal. I have no such place that I would want my identity tied to. I could run my own OpenID server or some such thing but that's even more of pain in the ass.
Only if you're ashamed of what you say, or are stuck in a place where your views are constantly held against you. Neither of those are true of me, for which I am duly grateful.
You don't need to run your one server. Just get an openId from myopenid.com. Get several. then your ... deniable posts won't be "directly attributed" to the one that's in your real name.
Now combining with OAuth is interesting, but I don't have a "contact list" anywhere. I don't really have any information that I need (or want) to share between sites. It's definitely a cool option though, so I won't bemoan it's existence. However, I am annoyed at sites that require OpenID without the standard alternative.
Without OAuth before i think all you get after authenticating is their OpenID identifier, which isn't much info. The user would still have to provide common profile data like name and email.
So OpenID is really just meant to allow you to have one account to login to all your sites, rather than to make it easier to sign up for new sites.
And really is this even a good idea? I dunno.
Given the StackOverflow example, it would take exactly 5 seconds to type in my usual username and unsecure password and start using the site. The whole Open ID thing seems like a hell of lot more work.
You are weird.
You might I'm being purposely difficult -- and maybe I am. But I'm an intelligent user, I visit hacker news, etc. Imagine rolling this out to your average web user? Good luck with that.
You might I'm being purposely difficult -- and maybe I am.
I'm not, but I agree that you are. Sometimes times change. You are probably one of the people that adds that "Stop HTML Email" ribbon to your mail signature because the first mainframe you used didn't let you send formatted email. It's not 1960 anymore.
The average web user isn't going to give a crap, and honestly neither do I. And I generally love technology for technology sake.
And don't get me started on how horrible HTML email is... ;)
The point now is that every site you visit doesn't have to have your password and email.
And I don't have to signup for some completely unrelated service to receive an email -- everybody already has email.