Another great day for OpenID: Facebook, one of the world’s biggest social networks, is adopting the standard as a Relying Party. That means Facebook members can log in to the site with an OpenID from providers like Yahoo!, MySpace, Google, and many more. Also they will be able to sign up to Facebook with an OpenID.
However, the OpenID integration is not implemented yet. If we can believe the announcement, Facebook will auto-detect the OpenID provider if users are already logged into it when coming to Facebook:
Facebook will automatically check to see if users have logged into any OpenID account when they hit Facebook.com, and give them the option to automatically login to Facebook without entering new information.
It will be interesting to see how this works, especially if it works with all providers and not just some of the big ones. Though if it works smoothly, this flow will reduce much of the hassle of OpenID for users. They would not have to provide their OpenID to a relying party anymore if they’re already signed into the OpenID provider already. Actually, it is recommended to sign in to the provider by the beginning of each web browsing session anyway, because it effectively reduces the danger of phishing.
If Facebook integrates OpenID well, it will surely boost OpenID. First, it will signal that large sites don’t have to become providers only. And second, user experience will be improved greatly. So hopefully, Facebook’s implementation will be live soon and we can check it again.
Facebook persistent caching of supplied OpenID is horrible. I have posted about this, with the hopes enough people make then realize and recognize the issue.
I really can’t comment on that because I haven’t experienced similar problems. Maybe you should post your problems on the OpenID General mailing list (http://openid.net/mailman/listinfo/general). Facebook developers read that list and post there.
I think Facebook will have to be pretty limited to start out in what OpenID providers it accepts sign ins from (that means “the big ones”) — without some trust basis for the account provider, you’re not protecting user info responsibly.
This is a good step, forward for OpenID, even so. This kind of two-way connections, where sites like Facebook become account providers AND relying parties is what needs to happen to really get OpenID realizing its potential for everyday users. I work for a company that provides a multi-way sign-in service for relying parties called RPX (http://rpxnow.com) and one of the factors that is holding back even stronger growth in the use of OpenIDs is that big sites have yet to get on board in ACCEPTING OpenIDs from elsewhere. The big sites ISSUE OpenIDs, but the connections through RPX have been mostly OpenIDs from big sites being used to access smaller web sites. Once you can use, easily, your Google account as your OpenID to access Facebook and Yahoo! Travel as well as the smaller sites who are already on board, OpenID will see a big burst in growth and acceptance in the mass market.
First, sorry for approving your comment late. It simply got lost in the spam queue.
Yes, RPX is a valid option for many relying parties that want to avoid the hassle of implementing relying party code themselves. A hosted solution which also provides logins from other providers like Facebook and Twitter easily broadens the reach of the RP.
I also agree that it is important for OpenID that there are more big RPs. Many people have like five or more OpenIDs but can’t use them on big sites they log into daily. This has to change, of course.