Hacker News Reader

Comment by djcapelis | Hacker News Reader

You're not using OpenID if you do this, you're using Google's id.

It's fine if that's what you expose by default, but you really do need to give the user a checkbox or something so they can input their own if they have one. I have an OpenID I use everywhere, if I come to one of your sites and end up using my google ID instead it will cause me nothing but frustration and end up being less secure.

In fact I'd probably not login to your site because of this if I didn't have a compelling reason to do so.

View on HN

I'm using Google ID, but the technology that enables this is OpenID. It's just under the hood, which IMHO is where it should be. Most users have no idea what OpenID is, and are confused when they are asked for a URL in order to sign up.

Even for an OpenID-savvy user, why would it be frustrating or less secure to login via Google? If someone got my Gmail password, sites like mine would be the least of my worries..

Because I don't have a google account. But I do run my own openid provider.

I'd say that's an edge case, but still - sites that don't support OpenID would require you to create login. This method basically asks you to create that login with Google instead, is more secure than most of these sites.

Because my preferred openid provider uses client-side SSL certs to authenticate me, google doesn't. Part of the point of openid is it allows me to implement security procedures you haven't thought of without making me beg every site I use to do things the way I want.

This is still OpenID.

Google uses a singular URL for all identities that OpenID consumers use to discover the true user identity, which is unique per user per consumer domain.

If it only accepts google logins, then it doesn't matter if google is using openid as the mechanism -- you can't say you use openid logins. It's like if I said that my application supports CSV, but you have to provide it as an Excel file.

Reply on news.ycombinator.com