Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That site fails terribly at supporting OpenID: it only supports four authentication providers, and doesn't allow a user to enter an arbitrary OpenID URL.

"Properly implemented", OpenID looks like http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit : a choice of common OpenID providers to help users who don't understand OpenID, an option to use an arbitrary OpenID, and an option to use a username and password.

Properly implemented, BrowserID looks like one big shiny "sign in" button, and yet it still supports any service the user wants to use, and better yet no third-party service at all. Seems like a big improvement to me.



There are legitimate reasons to whitelist OpenID providers, especially if you are dealing with $$ or want to minimize support costs.


Why do you think a "properly implemented" OpenID site should allow the user to use any authentication provider? The relying party site is trusting the OpenID provider to authenticate its users. Wouldn't sites with real security requirements want to vet providers before trusting them?


Exactly right.

And all OpenID providers have different attribute exchange protocol extensions. If you use them, you can effectively allow only those you have tested.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: