Hacker News Reader

Comment by warp | Hacker News Reader

The benefit for me is that you get to choose who stores your password. A random website may store my password plaintext, I have no way of knowing -- so I am forced to use different passwords for each site, and manage them some way.

Ofcourse, I _know_ this, but in general, users don't know and don't care. So, OpenID actually makes the web a safer place for inexperienced users, which is I think is rather important.

View on HN

Except the phishing aspects make it worse for inexperienced users, since an arbitrary website can redirect to a page that asks for a potentially more sensitive username/password, and that's actually considered normal flow.

I don't understand how anyone can promote OpenID in good conscience with this glaring hole in the design. You simply can't rely on user education.

I've been saying this the whole time and nobody seems to view it as a serious problem. Sure, there are users who will use the same username and password on every site, and there's no hope for them. However, there is a class of users who might think with openid they can use the same credentials for their bank as they do for facebook, but not know to check for valid ssl certificates and nefarious proxying.

Can someone who doesn't believe the phishing potential is real please tell me why? What am I missing?

Good openid providers like wordpress train their users not to expect a login page on anything a authenticating website redirects them to.

And as I said in my original comment, you can't rely on user education. If we've learned anything about the psychology of phishing, it's that.

Reply on news.ycombinator.com