Hacker News Reader

Comment by StavrosK | Hacker News Reader

It's common knowledge now that OpenID has severe usability problems. As much as I wanted it to work, none of my apps' visitors (hell, back in 2006) could understand what it was or how to use it.

BrowserID, however, has now fixed most of these issues, and it's very straightforward to use. To try it out, you can have a look at http://www.yourpane.com/

View on HN

I just never understood how the hell it worked.

1) I would go to a website, it would ask me to register or sign in with "OpenID". It would tell me a little bit about OpenID "Yahoo, ___, and ___ are OpenID providers. If you have a Yahoo ID then you have an Open ID".

2) WTF is the point of an OpenID then?! If I could just sign in with a Yahoo account I thought...

3) I try to sign in with my Yahoo ID like it said. It fails every time. WTF.

4) I go back to Yahoo to GET an OpenID. It tells me I already have one. I try to get one from other "providers" and somewhere along the way I always get misdirected or the sign up / registration process just fails and I just get sick of the whole OpenID-Mind-Game and sign in with my facebook account.

After 3 or 4 mind games I became extremely frustrated and soulfully HATED OpenID. It was all over the place, I didn't get it. It couldn't work for me. So I felt like it was a feature I was not allowed to have. Just thinking of the OpenID logo and name evokes feelings of annoyance. So the brand is trashed is what I'm saying.

This too.

And the so-called "informational" documentation on the OpenID project site is ... vague to the extreme, and that's being charitable.

While it's fine abstracting away technical information from users who don't want it, if you're going to create a Grand Unifying Identity Service, you're going to get much better buy-in from those who do care to find out about how things work under the hood, if you make it possible to do so (and without reading the source / diving fully into the developer docs).

OpenID is a trust dud.

"To log in, just enter your email address below and click the link that we send you. To log in again, you can save the link and use it directly (you don't have to request a new one)."

In what world is that more usable than "Click here to login with Google / Yahoo"?

Err, click the "BrowserID" button. Those are two separate auth mechanisms.

StavrosK has a hybrid auth system -- that's not a part of Persona (née BrowserID). Which is actually kind of cool -- because we use email addresses as identifiers, it's really easy to add Persona support alongside traditional auth mechanisms, and without giving up ownership of your users.

If you want to see a more "pure" Persona implementation, our standard example site is at http://123done.org/ (and you can preview the "Persona" redesign at http://dev.123done.org/).

As for as being as easy for first-time users as "Click here to log in with Google / Yahoo," well, we've got some tricks up our sleeves. Look for a blog post next month at http://identity.mozilla.com/ :)

When are you guys going to add browser support already?!

Also, I love how I can integrate Persona with Django in (quite literally) three minutes, with zero changes to any existing auth mechanism.

Native browser support is slated for Firefox 17, though it'll be disabled by default for a while, much like with our SPDY support. Of course, native support in Gecko is a hard requirement for our Boot2Gecko phones, and the first big code freeze for that is rapidly approaching (mid-August, IIRC?), so it's absolutely on its way!

BrowserID is horribly complicated. Even to log into Mozilla's own Web Apps store. I had to remember my browser id, wait, enter it again and then enter a password. Why are there more steps to something so simple. It's for these reasons that no one wants to adopt these things.

So I just signed up to your site with BrowserID, clicked the link in the mail they sent me, and got directed to... an almost blank BrowserID page.

You're losing users right there if it doesn't redirect back to your site after account verification.

I don't think they can do that, unfortunately. Verification is done when you create a BrowserID account, so it'll never happen again, no matter which site you go to next. You'll just get logged in.

Yeah, that totally sucks. We're working on it. Support for post-verification redirects should land in production in ~2 weeks, IIRC. There will be an announcement on the Mozilla Identity blog when that goes live. (Sorry to threadsit here!)

Actually yes, now that I think about it, you can just include the referring site in the verification link and redirect back. That will be very handy and help with the visitor drop-off problem.

I'm really hoping Persona takes off, especially with widespread browser support. Will it still need a third party service then, or will everything happen in-browser?

Also, in the step when you enter a password (to create a BrowserID), the second field is called "Reset password". What's up with that? Should it not be something like "Password (confirm)"?

Our translation files were messed up. The fix should enter production on Monday: https://github.com/mozilla/browserid/issues/1905 Thanks!

Reply on news.ycombinator.com