I've been following the progress of
Stack Overflow since it's announcement on
Jeff and
Joel's blog, and one of the things that has irked me is that they've decided to provide authentication to Stack Overflow only via
Open ID.
So for those who don't know what Open ID is, it's easiest to explain by providing an example. So lets say you want to register for Stack Overflow with Open ID.
The first step would be to pick a provider, i.e.
Claim ID, where you register a name, password, email address, etc and at the end of your registeration get an endpoint (i.e.
http://claimid.com/fooUser).
You'd then log into Stack Overflow and instead of creating an account you provide your Open ID endpoint (
http://claimid.com/fooUser) and Stack Overflow will redirects you to Claim ID where you would log in with your Claim ID name and password and select the "trust Stack Overflow with my details".
Claim ID will then redirected you back to Stack Overflow and that's it, you've created an account on Stack Overflow.
So the advantage is that once you have an Open ID, creating accounts is really easy as all your details are stored on your Open ID provider and all you need to provide is your Open ID endpoint.
It also means that if you should want to log into another site, you'd just navigate to that site, put in your Open ID endpoint and you don't have to type in your user name and password as you're already authenticated with your Open ID provider.
What that essentially means though is that now you have a single name and password to log into all your sites. GREAT!
Wait a minute? Isn't having the exact same name and password for all your sites considered bad practice? And not only that, isn't there already a way to log into sites using the exact same name and password, which is BY CREATING ACCOUNTS USING THE EXACT SAME AND PASSWORD?