Hacker News new | ask | show | jobs
by kevincox 1269 days ago
Do any big-name providers support this? For example trying the webfinger request described in the first link on gmail.com returns a 404.

As much as I love the ability to use my own server it is going to fall flat for the vast majority of users if you can't support at least one of Google/Facebook/Twitter/Microsoft.

OpenID was supported by Google, Yahoo, MySpace, Wordpress and a few other big names. Not ideal but enough that you could basically expect most users to be covered.
2 comments
tlarkworthy 1268 days ago
It's here for Google https://accounts.google.com/.well-known/openid-configuration

Here for Microsoft https://login.microsoftonline.com/common/v2.0/.well-known/op...

link
BillinghamJ 1268 days ago
And even for Apple: https://appleid.apple.com/.well-known/openid-configuration

Facebook: https://www.facebook.com/.well-known/openid-configuration

link
kevincox 1262 days ago
But that's not the point. The goal of the discovery spec is that the user can enter an email and sign in with an OpenID connect provider of their choice. If I need to do an MX lookup and guess what identity provider they are using it doesn't solve the problem of needing to maintain a list of supported providers.
link
tlarkworthy 1261 days ago
True, the "well-known" path seems to be in a random location but maybe that's a problem with the spec, you might expect it to be off the root of the email domain.
link
dwaite 1268 days ago
No. Generally this is because it is not a technical capability problem, but a business problem.

Often, sites which use OpenID for authentication either have no automated account recovery, or do recovery based on a verified email claim. This means those relying parties do indeed rely on the reliability and service support promises of the OP, as well as the validity of attribute data shared.

If ISPs or Google had been interested in providing webfinger-based discovery, we might have been able to create a decent UX around an assumption that your identifier was an email address, and that a local authentication process (including potentially an emailed code or link) was an acceptable fall-back. But there was never really critical mass for this to happen.

link