<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Nov 18, 2010, at 16:11, Allen Tom wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">The author raises many important issues for consumer oriented websites that are trying to accept 3rd party logins, and I think we as a community should listen and take the author's feedback very seriously.</blockquote><div><br></div><div>I strongly agree with Allen.</div><div><br></div><div>Even if the author was all wrong (he isn't -- I've run into some of the same issues) it clearly indicates that there is a lot of work to be done, at the very minimum documenting everything so well that few people can get it wrong. Nothing is a faster way into irrelevance than claiming the customer is wrong.</div><br><blockquote type="cite"><div>Specially:</div><div><br></div><div>1) Directed Identity / PPID (Pairwise Pseudonmous identifier) / non-correlatible RP specific identifier - is great in theory, but does not provide enough value to most RPs to justify implementing OpenID.</div></blockquote><div><br></div><div>Some people may remember me arguing "what about customer service" so many years back. If I can't tell my identifier to the customer service guy on the phone, how is it ever going to work? Amusingly, this article refers exactly to that use case</div><br><blockquote type="cite"><div> PPID identifiers have no history, no data, and no reputation - why would any RP want this? Also, as the author pointed out, changing the PPID based on the realm/return_to means that RPs will "lose all their users" if they ever switch their domain/realm. There are many valid reasons why RPs would want to have multiple realms/domains, or to change them around.</div>
<div><br></div><div>2) username@provider identifiers are necessary for users to contact the RP via customer support and other out of band mechanisms. For all practical purposes, the email address is really required.</div></blockquote><div><br></div><div>If the user remembers their e-mail address but not anything else (like URL), that's a tautology.</div><br><blockquote type="cite">
<div>3) We often talk about OpenID's value to end users, but we don't talk enough about giving value to RPs. The main hurdle to OpenID adoption is that RPs don't see enough value in OpenID, especially relative to other proprietary alternatives. </div>
<div><br></div><div>For a really harsh critique of OpenID, I highly recommend reading Yishan Wong's (ex Facebook/Paypal) tirade against OpenID on Quora:</div><div><br></div><div><a href="http://www.quora.com/What-s-wrong-with-OpenID">http://www.quora.com/What-s-wrong-with-OpenID</a></div>
<div><br></div><div>Allen</div><div><br></div><div><br></div><div><br></div><div><div class="gmail_quote">On Wed, Nov 17, 2010 at 4:01 PM, Bill Shupp <span dir="ltr"><<a href="mailto:hostmaster@shupp.org">hostmaster@shupp.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><a href="http://blog.wekeroad.com/thoughts/open-id-is-a-party-that-happened" target="_blank">http://blog.wekeroad.com/thoughts/open-id-is-a-party-that-happened</a><br>
<br></blockquote></div><br></div>
_______________________________________________<br>general mailing list<br><a href="mailto:general@lists.openid.net">general@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-general">http://lists.openid.net/mailman/listinfo/openid-general</a><br></blockquote></div><br></body></html>