This is really annoying and not the direction I hope internet companies will move toward.
What we need is to be able to login to facebook/yahoo/whatever with google account and vice versa of course; we need to see the idea of OpenID come alive.
What we need is to be able to login to facebook/yahoo/whatever with google account and vice versa of course; we need to see the idea of OpenID come alive.
The problem with every site handling their own logins is that you're creating more vectors for attack. Most people reuse passwords (bad practice I know but it is what most non-technical people do) and not all sites are properly secured - in fact some don't even encrypt passwords! So at least passport sites outsource the data protection issues to larger businesses that you'd expect (no; demand) to have experience to handle that data securely.
It's 2014. There's no excuse for re-using the same damn password over and over again.
And it doesn't make sense to make the situation worse for everyone else because they don't care about their online security.
Get a yourself a damn password manager and use a unique password for each service then we can kiss all these password leak problems goodbye.
Time after time we see people making a big drama because company X had all their 50 million password leaked. Oh was it hashed? Oh was it salted?
If you use a unique password for each service, the service provider can store your password in plaintext and you will be safe.
That's what I do and I couldn't care less if all the passwords in the world are leaked in plaintext.
Which ever solution is implemented needs to work for all groups of internet users - not just yourself ;)
In contrast to the problem you've stated, if I were to exclusively use my Google account to log into websites, it becomes a single point of failure if the service was down, and if it were to be compromised.
Very true. Sadly there's no real right or wrong answer here; a single point of failure but a better secured portal, or a decentralised network with arguably less secured portals.
Personally I try to use a balance of both: Twitter passports for sites I don't trust and passwords for sites I do trust. But that's just my personal preference.
This is exactly right. And, as you mentioned above, there are more kinds of people out there than are present in this thread.
I have a password manager and generate a new random password per site, so I don't have any desire to use a single log-in for almost all sites. However, many (most?) people reuse a single password (or a handful of them), and until that changes, they're likely much better protected by having a single well-protected authentication point.
If a company can't manage passwords securely, they won't be able to keep your data any more secure anyway, so you should entrust private data to site you don't trust, independently of how they handle sign in.
Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.