Google is shutting down OpenID 2.0

https://developers.google.com/accounts/docs/OpenID#shutdown-timetable

by lisper • 12 years ago

228 77 12 years ago

developers.google.com

teh• 12 years ago

OpenID has been on its way out for a while. It's being replaced by OpenID Connect [1] so this is not bad news, but a good reminder in any case!

[1] http://openid.net/connect/

nailer8• 12 years ago

Practically, openID is being replaced by oauth. A decade ago authentication and authorisation were quite separate concepts. This has been replaced with a realisation that 'being authorised to use a particular account' (Google Account, Twitter, FB, etc) is sufficient to prove ownership of that account and therefore identity.

Tobu• 12 years ago

OpenID Connect is based on OAuth.

nly2• 12 years ago

This gives me the creeps. Authorisation and identification are not the same. If you use 'Login with X' you're giving X access to all your accounts. That's not just third party attestation of your identity. It's kind of like saying a passport is what gives you access to your home country... in reality your status as a citizen is what gives you that right, the passport is merely a convenience.

rabbyte• 12 years ago

That was actually understood a decade ago as well and was part of the conversation that led to OpenID and OAuth. It was suggested close to a decade ago that they both merge efforts and they have both struggled to find their place. Development on this scale just lags a bit behind, specially when the community around it is so fragmented and opinionated.

chris_wot• 12 years ago

I'm a tad confused... To be authorised is great, but authentication must first happen surely? Authorisation says I can access x, but authentication says I am who I say I am!

Being authorized to use a particular account is still seperate from proving who I am. I have visions of going to the Pentagon and I say "Hi, President Obama here, give me access to all your intelligence data" and the analysts saying "Certainly sir! You have top authorisation, here is all the data". :-)

Actually, that would work better at a bank. "Hi, I'm Donald Trump, give me a million dollars from my loose change account, thanks!"

christiansmith• 12 years ago

In fact, unlike previous OpenID protocols, OpenID Connect is a profile of OAuth 2.0.

The conflation of authorization with authentication is an accident and a mistake. They are still quite separate concepts. Authentication is about verifying identity. Authorization is about privileges afforded a given identity. Access control models usually depend on some form of upstream authentication.

The third-party authorization flows provided by OAuth are not intended to establish or verify a user's identity. Their purpose is to extend a user's access to a third-party in a limited way without sharing passwords.

Social Sign-in is an accident of 3-Legged OAuth and its use for this purpose is considered a very weak form of authentication.

OpenID Connect takes the best ideas from preceding identity protocols and incorporates them into OAuth flows, giving the best of both worlds.

More information on all of the above here: https://github.com/christiansmith/anvil-connect/wiki/Referen...

learningram• 12 years ago

Do you have any suggested good reads about the topics ?

ComputerGuru• 12 years ago

Called it back in 2008: https://neosmart.net/blog/2008/google-doesnt-use-openid/

OpenID 2.0 screamed "embrace, extend, and extinguish" loud and clear. It's 8 years later, probably not as evil (TM) as I had prophesied (more likely attributable to the death of OpenID rather than malice), but, yeah...

EDIT: Yes, 6, not 8. I got the 8 from 2008 stuck in my head, apparently. Oops!

taytus• 12 years ago

You "called it" 6 years ago :/

StavrosK8• 12 years ago

Mozilla Persona was the best of the authentication protocols :(

ldng• 12 years ago

Well, it still could be, no ? If someone would put the resources behind that is.

StavrosK8• 12 years ago

Sure, protocols only die when nobody uses them, but who will?

brunoqc• 12 years ago

How was it the best?

StavrosK8• 12 years ago

The sibling explains it well:

https://news.ycombinator.com/item?id=8831465

nickbauman4• 12 years ago

Mozilla Persona _should_ have been the successor to OpenID. It solves almost all of the problems with OpenID, which were:

1) The NASCAR problem. Arrive at a page for a site you signed up for with OpenID and be totes confused: which "openId" did I use for this site?

2) The privacy leak: If you used your Google OpenID, now Google knows that you logged into someotherplace.com with your "openid"

3) The ID problem. Wait, what? Yeah, like, how does someone keep track of which "openid" ID is "me".

The final problem is that not many people will write a full implementation of it other than the big players like mozilla itself or Google or Microsoft. And the latter two don't have a ton of incentive to do so.

PythonicAlpha4• 12 years ago

   The final problem is that not many people will write a full implementation of
   it other than the big players like mozilla itself or Google or Microsoft.
   And the latter two don't have a ton of incentive to do so.

When I see such a proliferation (I looked at one architecture image of OpenID.connect and was shocked) than I am reminded of SOAP and I again think, that one reason might be, to hold smaller players at bay -- and to give the bigger players an advantage. For Facebook, Amazon or an other big internet company, it is really easy to even implement a big stack of software with complicated architectures and many features -- but for a four people start-up it is a big problem.

SwellJoe• 12 years ago

So, how to do we revive Persona? I mean, it's still around, but it's been kind of back-burnered by Mozilla.

The odd thing is that I didn't even know it existed until this whole conversation about Google dropping OpenID came up...and I use Firefox as my browser across all my devices, I use sync, I use Thunderbird, I follow the Firefox OS development with interest, and yet, I had no idea Persona was a thing.

I've always been uncomfortable with Google and Facebook being my "identity" provider, and I've been equally uncomfortable with the fact that they would happily provide those authentication services but won't accept them (i.e. I can login to thousands of services using my Google or Facebook account, but I can't login to Google or Facebook with any other service account). I simply don't like Google and Facebook owning my online life, but the convenience of it often trumps the ethical and privacy implications. I have, thus far, avoided integrating Google or Facebook logins on my sites because of the ethical implications, but I hate making my users keep up with passwords and usernames.

Why aren't more websites supporting Persona?

For my part, I plan to integrate Persona into the next version of my company website launching early this year, as well as our wiki and blogs. I may even try to figure out how to fit it into our products, somehow.

I found the following, seemingly maintained, extensions for Persona support in the apps I use for the websites I maintain:

https://www.drupal.org/project/persona

https://wordpress.org/plugins/browserid/

https://www.mediawiki.org/wiki/Extension:Persona

orf• 12 years ago

I added persona login to Simple (a Python blog I maintain). It was super simple and painless[1], much better than the basic-auth I was using before. This makes me wonder why nobody is using it - is it a marketing issue?

1. https://github.com/orf/simple/blob/master/simple/app.py#L381

lukeh• 12 years ago

Persona is/was great. It's hard to get a grassroots/delegated identity service off the ground when everyone has a Facebook/Google account (and doesn't understand the privacy tradeoff). The lack of support for delegation (the original use case for OAuth) was also a problem.

seanieb• 12 years ago

Until Mozilla gets Two Factor Auth they should NOT be doing anything with passwords or authentication.

StavrosK8• 12 years ago

What does 2FA have to do with Persona? Your comment is just uninformed and wrong.

nickbauman4• 12 years ago

Persona ameliorates the need for two-factor auth because you have to have control over an email account registered as the provider for Persona to interact with the user.

Logic being if someone controls your email account already, it doesn't matter that you have two-factor auth, they can shut it off because they control your account. A lot people using two factor auth with their Google account have been hacked exactly this way.

sergiosgc• 12 years ago

Persona does not require any interaction with Mozilla. If your identity provider wishes to require 2FA on Persona logins, he may do so. Persona is a protocol for signing identity assertions. Authentication is out of scope and thus not defined.

mahouse• 12 years ago

...is disabled for a small number of requests on an intermittent basis, some users will be forced to re-consent

Very inconsiderate.

fryguy• 12 years ago

Actually, it's considerate. Given the choice of having all of your users suddenly shut off, or a small portion of them, the latter is better. Suppose that the number is 1% of people that get shown this page. This means only 1% of the people are going to email you to remind you to fix it, instead of everyone at once. By gradually ramping this number up, you get the most notification with the least number of users inconvenienced.

fintler• 12 years ago

Previous discussion at https://news.ycombinator.com/item?id=8346355

PythonicAlpha4• 12 years ago

What me frightens a little with this move (OK, I acknowledge that OpenID2.0 is deprecated and should be updated to something new), is that Google talks only about "Google+ Signin". And OK, as I read in previous discussion, Google will also in the future support logins from people with normal eMail account.

Still, I am worried, since Google does not clearly communicate these facts, but when you look at their communications, you read only about "Google+ Signin" and you have to search to find that you do not need Google+ but just the new protocol OpenID connect.

I don't like to see such communications from a company, that once claimed (long, long time ago!! Do you remember Google?) "Don't be evil".

It is OK, when they move away from an old protocol, but it is not OK, when they (and it very much looks that way to me!) use it as vehicle to market their products. Google has troubled people enough with forcing G+ on them -- so I even find it more troublesome, how they do it now (as it seems to me currently).

I fear, Google is still hunting after Facebook and is by the way inheriting its bad habits.

As I see now, they also want that a new button is used -- something with G+ on it. I see, they really lay the pressure on the people -- many people will think, that they need a Google+ account to use this feature (even if not required). I would say, Google you are going to hurt yourself!

I myself, was thinking about using a "Login with Google" button in my application ... but now, with things changed, I will think twice, before I do such a move!

timothya2• 12 years ago

Google+ Sign-In is an implementation of OpenID Connect, with some nice features built on top:

"Google+ Sign-In is built on the OAuth 2.0 and OpenID Connect protocols. It supports over-the-air installs, social features, and a sign-in widget on top of standardized OpenID Connect sign-in flows. Google+ Sign-In works for all users with a Google account, whether or not they have upgraded to Google+." [0]

I don't understand where all your other conclusions came from.

[0] https://developers.google.com/accounts/docs/OAuth2LoginV1

PythonicAlpha4• 12 years ago

From this Link:

https://developers.google.com/accounts/docs/OpenID#shutdown-...

and from common sense.

BTW: Maybe you should also read my full post, before answering.

7952• 12 years ago

Google have never properly supported federated login. You should be able to login to Google services with an external account and not need to sign up with Google at all. Their Authentication and Authorization APIs have always been about pushing Google Services.

PythonicAlpha4• 12 years ago

That is right. But till now, I could use a simple Google acount (not G+) to login for example at Stackoverflow.com.

In future the button will change from "G"-Login to "G+"-Login. As somebody else stated, Google said, that a normal Google account will suffice in the future, but alone the wording and the new button will alienate people.

sumedh• 12 years ago

Google's documentation is so confusing. I just wanted a simple tutorial which would tell how to get the name and email address of the person with the new API. That is all I need.

But the name Google+ Signin implies that this is related to Google Plus which I did not want. So I thought I have to use some other API for my simple needs, after wasting lot of time I realised I have to use Google+ login even for my simple needs. Couple of head banging sessions later, I realized this is just a vehicle to market their product.

higherpurpose• 12 years ago

Time to replace it with SQRL?

https://www.grc.com/sqrl/sqrl.htm

(I think the final spec will launch in a week or two.

nly2• 12 years ago

SQRL doesn't solve any of the hard problems.

See my post here https://news.ycombinator.com/item?id=8790768

jay_kyburz2• 12 years ago

I'm going to use this opportunity to transition my users off social loggins altogether.

I used Google and Facebook when first building the webapp because I simply didn't want to do the work of building an authentication system. It's lots of work to get right.

About a year ago I had a lot of users complain my site _only_ had social logins so I had to implement my own anyhow.

Now I have it, I don't see a lot of value in keeping the social logins around.

I just need to ask users to add a password to their account and they can login using email/password combo.

dyoo19792• 12 years ago

I don't know your audience, so perhaps this makes sense.

I don't want to remember or keep track of yet another password for a random web site. If the web site requires login and doesn't support Facebook/Twitter/G+ login, then I'll likely give up and avoid the page.

jay_kyburz2• 12 years ago

I think there are a lot of users who feel the other way around, they can't trust "some random website" with their facebook / G+ identity. They would rather just make a throw away account with some easy to remember password.

knocte• 12 years ago

Sorry if this is a stupid question but, does this mean that Google accounts will no longer be OpenID accounts?

lowlevel• 12 years ago

Just wait until they shut down gmail.

kordless2• 12 years ago

There's no mention in here about the Python Users API that Google provides for managing users in your Python AppEngine application. Google hasn't updated the Python Users page (other than mentioning there are changes coming) and haven't indicated if they will or will not update the Users API methods to support the new auth methods.

Given I chose AppEngine in part because of the Users API, it would be nice if there was some clarification by Google on what they plan to do with the Users call and how provide some suggestions (or, heaven forbid, sample code) to show us how to do it ourselves.

kordless2• 12 years ago

Just a small update, because there's basically nowhere else anyone is going to read this given Google suspended Google groups for AppEngine and doesn't answer StackOverflow questions. I tried using the sample code from the User API pages and built this: http://kordtester2.appspot.com/. The app is using standard Google authentication, not the federated auth. The docs say it should work, but it's clearly broken.

Google is shutting down OpenID 2.0

Related Stories