OpenID

List overview All Threads
Download

newer

older

Re: [Wikitech-l] nostalgia skin:...

nostalgia skin: gathering ideas...

Jan Kucera

5 Oct 2008 5 Oct '08

1:15 p.m.

Hi there, what about implementing OpenID accross some Wikimedia projects? I know this might be rather "political" than "technical" decision, but I think it would bring only positives. I tried to bring it up on Metapub and Village pump, but quite little interest was showed... Jan

Show replies by date

Sebastian Moleski

5 Oct 5 Oct

1:23 p.m.

On Sun, Oct 5, 2008 at 3:15 PM, Jan Kucera <koltie(a)seznam.cz> wrote:

...

what about implementing OpenID accross some Wikimedia projects? I know this might be rather "political" than "technical" decision, but I think it would bring only positives. I tried to bring it up on Metapub and Village pump, but quite little interest was showed...

I've looked at OpenID a couple of times and I'm still unsure of the benefits it really brings. Where lies the virtue of a centralized login across many sites that have nothing in common? Sebastian

Amir E. Aharoni

1:29 p.m.

On Sun, Oct 5, 2008 at 3:23 PM, Sebastian Moleski <sebmol(a)gmail.com> wrote:

...

On Sun, Oct 5, 2008 at 3:15 PM, Jan Kucera <koltie(a)seznam.cz> wrote:

I've looked at OpenID a couple of times and I'm still unsure of the benefits it really brings. Where lies the virtue of a centralized login across many sites that have nothing in common?

Russian-speaking Wikipedians will enjoy it, because LiveJournal, which uses OpenID, is unbelievably popular among Russian speakers. I can't see any important advantage except that, but i might be wrong. -- Amir Elisha Aharoni heb: http://haharoni.wordpress.com | eng: http://aharoni.wordpress.com cat: http://aprenent.wordpress.com | rus: http://amire80.livejournal.com "We're living in pieces, I want to live in peace." - T. Moore

Bryan Tong Minh

1:35 p.m.

On Sun, Oct 5, 2008 at 3:23 PM, Sebastian Moleski <sebmol(a)gmail.com> wrote:

...

On Sun, Oct 5, 2008 at 3:15 PM, Jan Kucera <koltie(a)seznam.cz> wrote:

I've looked at OpenID a couple of times and I'm still unsure of the benefits it really brings. Where lies the virtue of a centralized login across many sites that have nothing in common? Sebastian

Instead of logging to to Wikimedia with a foreign OpenID, I would rather like to see Wikimedia become an OpenID provider, so that I can login to other sites with a .wikimedia.org OpenID :) There is an open bug for it and also some code in SVN. Bryan

Sebastian Moleski

1:39 p.m.

On Sun, Oct 5, 2008 at 3:35 PM, Bryan Tong Minh <bryan.tongminh(a)gmail.com> wrote:

...

Instead of logging to to Wikimedia with a foreign OpenID, I would rather like to see Wikimedia become an OpenID provider, so that I can login to other sites with a .wikimedia.org OpenID :)

I understand *what* people want to do with it. What I don't understand is *why. What benefit does OpenID provide over just registering with your usual user name and password at any site? If there's an advantage, it would make sense to find some resources to implement this ability. But without some clarity on that, it's rather difficult to justify spending time on that. So what's your hope for what enabling OpenID will accomplish? Sebastian

Nikola Smolenski

2:03 p.m.

On Sunday 05 October 2008 15:39:29 Sebastian Moleski wrote:

...

On Sun, Oct 5, 2008 at 3:35 PM, Bryan Tong Minh <bryan.tongminh(a)gmail.com> wrote:

Instead of logging to to Wikimedia with a foreign OpenID, I would rather like to see Wikimedia become an OpenID provider, so that I can login to other sites with a .wikimedia.org OpenID :)

People don't like registering at websites. If Wikimedia projects would use OpenID, they would attract users they otherwise wouldn't have.

David Gerard

2:12 p.m.

2008/10/5 Nikola Smolenski <smolensk(a)eunet.yu>yu>:

...

On Sunday 05 October 2008 15:39:29 Sebastian Moleski wrote:

...

> I understand *what* people want to do with it. What I don't understand > is *why. What benefit does OpenID provide over just registering with > your usual user name and password at any site? If there's an

...

People don't like registering at websites. If Wikimedia projects would use OpenID, they would attract users they otherwise wouldn't have.

And a lot of "anons" would be a lot more identifiable. Creating logins on 100 websites is a pain in the backside and one of the reasons we allow anon editing - it lures people in. - d.

Mark

3:26 p.m.

Sebastian Moleski wrote:

...

I understand *what* people want to do with it. What I don't understand is *why. What benefit does OpenID provide over just registering with your usual user name and password at any site?

Using the same credentials on more than one site is gambling with your security. Basically anybody you share your secret password with can access all of your accounts everywhere if they want to. With OpenID only the provider ever sees your credential. OpenID provides a method by which the provider can vouch for you having correctly provided your credentials without having to give them to the other site.

...

If there's an advantage, it would make sense to find some resources to implement this ability.

The module has existed for several years. The implementation cost should be fairly small. -- -- ================================================================= -- mark at geekhive dot net --

Jan Kucera

5:11 p.m.

...

If there's an advantage, it would make sense to find some resources to implement this ability.

The module has existed for several years. The implementation cost should be fairly small.

So let us do it. OpenID will be critical for the web, Wikimedia as one of Internets TOP10 sites should not be behind and should take the advantage of being OpenID provider. It will attract new users and make everything easier I think. Jan

Marco Schuster

6 Oct 6 Oct

1:44 p.m.

2008/10/5 Mark <mark(a)geekhive.net>

...

Sebastian Moleski wrote:

I understand *what* people want to do with it. What I don't understand is *why. What benefit does OpenID provide over just registering with your usual user name and password at any site?

Using the same credentials on more than one site is gambling with your security. Basically anybody you share your secret password with can access all of your accounts everywhere if they want to.

Only if you use the same password for everything - what many people do actually...because it's a PITA to keep e.g. KeePass databases synchronized across maybe two computers and a PDA. Marco

Thomas Dalton

1:49 p.m.

...

Only if you use the same password for everything - what many people do actually...because it's a PITA to keep e.g. KeePass databases synchronized across maybe two computers and a PDA.

I've never bothered myself, but you can improve security by mangling the domain name into your password for each site. That allows you to work out the passwords rather than keep a database of them.

Marco Schuster

1:54 p.m.

Which becomes a problem if sites don't allow passwords larger than 10 to 15 chars (as if they couldn't make a MD5/SHA1 out of it...) :( Marco 2008/10/6 Thomas Dalton <thomas.dalton(a)gmail.com>

...

Only if you use the same password for everything - what many people do actually...because it's a PITA to keep e.g. KeePass databases

synchronized

across maybe two computers and a PDA.

I've never bothered myself, but you can improve security by mangling the domain name into your password for each site. That allows you to work out the passwords rather than keep a database of them. _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Lane, Ryan

2:16 p.m.

...

Which becomes a problem if sites don't allow passwords larger than 10 to 15 chars (as if they couldn't make a MD5/SHA1 out of it...) :(

Or sites that force you to have a password between a short range of characters (6-10? Really?), or sites that don't allow special characters, or sites that only allow alpha-numberic. I have no clue why some sites force you to use less secure passwords, but it drives me insane. Password management on the web is in a terrible state. OpenID isn't without it's share of security issues, but I think it at least solves the password issue; I can't wait until I can use my gmail OpenID everywhere ;). V/r, Ryan Lane

Marco Schuster

8 Oct 8 Oct

12:15 a.m.

2008/10/6 Lane, Ryan <Ryan.Lane(a)ocean.navo.navy.mil>

...

The worst example I ever met was a web forum which allowed maximum five characters (and my bank...for hell, why doesn't the web interface accept 20 chars long passwords - we are talking about money here!)

...

OpenID isn't without it's share of security issues, but I think it at least solves the password issue; I can't wait until I can use my gmail OpenID everywhere ;). GMail has OpenID?!

Marco

Lane, Ryan

2:36 p.m.

...

OpenID isn't without it's share of security issues, but I

think it at

least solves the password issue; I can't wait until I can

use my gmail > OpenID everywhere ;). >

...

GMail has OpenID?!

Yep, you can use google as an OpenID provider, yes. They don't advertise it, except for use on blogger. I use it on my personal blog though. V/r, Ryan Lane

Marco Schuster

3:59 p.m.

Sounds cool...do you know if this also works for people using Google Apps? Marco 2008/10/8 Lane, Ryan <Ryan.Lane(a)ocean.navo.navy.mil>

...

OpenID isn't without it's share of security issues, but I

think it at

least solves the password issue; I can't wait until I can

use my gmail > OpenID everywhere ;). >

GMail has OpenID?!

Yep, you can use google as an OpenID provider, yes. They don't advertise it, except for use on blogger. I use it on my personal blog though. V/r, Ryan Lane _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Leon Weber

4:05 p.m.

On 06.10.2008 09:16:23, Lane, Ryan wrote:

...

OpenID isn't without it's share of security issues, but I think it at least solves the password issue; I can't wait until I can use my gmail OpenID everywhere ;).

I wouldn't like Google to be my identity provider. Leon -- Leon Weber, leon(a)leonweber.de 0x8E04D7FC blog: http://leonweber.de/blog jabber: leon(a)jabber.ccc.de (icq: 261067046) -- Wenn jeder an sich selbst denkt, ist an alle gedacht.

Aryeh Gregor

4:35 p.m.

On Wed, Oct 8, 2008 at 12:05 PM, Leon Weber <leon(a)leonweber.de> wrote:

...

I wouldn't like Google to be my identity provider.

But evidently Ryan Lane would. Isn't it nice that OpenID lets you choose your own provider, then?

Daniel Friesen

9 Oct 9 Oct

1:41 a.m.

^_^ And if you're tech savvy, you can even be your own... ~Daniel Friesen (Dantman, Nadir-Seen-Fire) ~Profile/Portfolio: http://nadir-seen-fire.com -The Nadir-Point Group (http://nadir-point.com) --It's Wiki-Tools subgroup (http://wiki-tools.com) --The ElectronicMe project (http://electronic-me.org) -Wikia ACG on Wikia.com (http://wikia.com/wiki/Wikia_ACG) --Animepedia (http://anime.wikia.com) --Narutopedia (http://naruto.wikia.com) Aryeh Gregor wrote:

...

On Wed, Oct 8, 2008 at 12:05 PM, Leon Weber <leon(a)leonweber.de> wrote:

I wouldn't like Google to be my identity provider.

But evidently Ryan Lane would. Isn't it nice that OpenID lets you choose your own provider, then?

Thomas Dalton

6 Oct 6 Oct

2:18 p.m.

2008/10/6 Marco Schuster <marco(a)harddisk.is-a-geek.org>rg>:

...

Which becomes a problem if sites don't allow passwords larger than 10 to 15 chars (as if they couldn't make a MD5/SHA1 out of it...) :(

How about a standard 5 character alphanumeric password concatenated with the first 5 characters of the domain name encoded with ROT13? That should be accepted by any site and is pretty secure (it would be good to include symbols in there, but some sites don't accept them, and you may want some better mangling than just ROT13).

Kwan Ting Chan

4:50 p.m.

On Mon, 2008-10-06 at 15:18 +0100, Thomas Dalton wrote:

...

2008/10/6 Marco Schuster <marco(a)harddisk.is-a-geek.org>rg>:

Which becomes a problem if sites don't allow passwords larger than 10 to 15 chars (as if they couldn't make a MD5/SHA1 out of it...) :(

Easy enough for any modern PC to brute force if the one know you are using such scheme. 36^5 isn't that many combination... KTC -- Experience is a good school but the fees are high. - Heinrich Heine

Thomas Dalton

4:54 p.m.

2008/10/6 Kwan Ting Chan <ktc(a)ktchan.info>fo>:

...

On Mon, 2008-10-06 at 15:18 +0100, Thomas Dalton wrote:

2008/10/6 Marco Schuster <marco(a)harddisk.is-a-geek.org>rg>:

Which becomes a problem if sites don't allow passwords larger than 10 to 15 chars (as if they couldn't make a MD5/SHA1 out of it...) :(

Easy enough for any modern PC to brute force if the one know you are using such scheme. 36^5 isn't that many combination...

Yes, knowing half the password in advance will make it easier to crack, that's very true. I was working under the assumption that you don't go around telling people your method of producing passwords...

5679

days inactive

5683

days old

wikitech-l@lists.wikimedia.org

Manage subscription

21 comments

14 participants

tags (0)

participants (14)

Amir E. Aharoni
Aryeh Gregor
Bryan Tong Minh
Daniel Friesen
David Gerard
Jan Kucera
Kwan Ting Chan
Lane, Ryan
Leon Weber
Marco Schuster
Mark
Nikola Smolenski
Sebastian Moleski
Thomas Dalton