They honestly don't care where the login comes from as long as you keep a profile with them and use their service. The whole idea of these IDs that you can use in many places is just that, it lets somebody else handle the authentication part and you can concentrate on building your service.

So far I am impressed with OpenID because it means that it is no longer my problem if my user locked himself out of the system for the 100th time in a row (it happens). This is one of my most common sources of frustration from applications that need user/role security, people are simply too stupid/lazy. And I mean it, I have had customers that complain about locking themselves out, yet they simply can't read the "forgot your password? click here" link that I put in every login box. This link points to a page that asks you your username OR your email address. Either is enough to recover your account and have temporary passwords emailed to you.

Then they complain that they don't like the temporary passwords that we assign them. Or that we are not able to send them the password that they originally used (we simply can't, the passwords are stored with a salted one-way hash to avoid this).

Better to let them use their AOL or Google identity as an OpenID, and hope that they care enough about these accounts to make sure that they remember their passwords.

Permalink | Report