BuddyPress.org

Just make it buddypress plugin, so users won’t have to visit wp-admin/profile.php to change which IDs they use. If this setting can be done on frontend, it would be perfect.

We need this has a buddypress plugin?

Also, if I’m logged into facebook on my computer, and close facebook,

You tech genius wouldn’t do that, right?

@Tracedef, Are you starting the plugin or what?

Just to address JohnJamesJacoby’s first concern, that’s not how OpenID works. “Sniffing” ain’t allowed. Authentication takes place *not* on the new site, but on the old site, i.e., Google or Facebook, and the *only* thing the new site is getting in terms of authentication is an oAuth token saying “Google says you’re good, so I’m going to authenticate you, using Google’s token and whatever other information you and Google have chosen to give me.”

That means the new site gets NO password.

ZERO.

ZILCH.

Now porting other data, and concerns over privacy with regards to that? Well, it’s not using Google or Facebook’s data, it’s *porting* it, so, yes, I can see privacy concerns cropping up all over the place with that, and it is a little Wild West right now.

But that will get better over time. Somebody will think of a way to better secure your data, etc.

Incidentally the OLD way for porting data *did* have the new site capture your password, i.e., to import friends on Facebook, you had to enter your email and password for, say, gmail, and then trust that Facebook wouldn’t keep it but would only scrape the data from gmail *one time*…THAT is dangerous, and, thankfully, OpenID and oAuth (distributed social networking) is doing away with that bad practice.

Regarding who is responsible for data, it seems there is a lot of misunderstanding about OpenID out there. I’m not the ultimate evangelist on all this, but 90% of these types of concerns have already been addressed by the real know-hows of distributed social networking.

OpenID does *not* mean everyone has access to everything. Rather, it just becomes a viable way to port information, when necessary or desired, more easily, as well as providing a way for an individual to be identified more easily at any given site — but, again, this doesn’t preclude telling every site everything. Trust is still a site by site variable.

Here’s a list of great reads (plus a web “TV” show!) for those interested in understanding what’s true and what isn’t:

http://factoryjoe.com/blog/page/12/ (old, but addresses some common concerns)

http://josephsmarr.com/2008/04/23/data-portability-privacy-and-the-emergence-of-the-social-web-web-20-expo/ (also old, but an original “diso” reference”)

http://www.sociallipstick.com/2009/03/a-proposal-for-a-conceptual-open-stack/ (social stack reworked)

http://factoryjoe.com/blog/2009/02/13/this-week-in-video-facebook-and-the-openid-design-workshop/ (a bunch of videos from the OpenID Summit)

http://thesocialweb.tv/ (periodic episodes updating the latest in diso)

The final thing I would add is, like it or not, distributed social networking (OpenID and the like) are _already_ here: Google, Facebook, Yahoo!, AOL, MySpace, and a host of other providers have already embraced OpenID, and the clock can’t be turned back. There are still a lot of variables to be worked out (such as “single sign out”!), but BuddyPress would do well to support it, if not because it is a highly useful technology, then at least to support the percentage of customers who are going to want (demand?) the technology.

Anyway, back to RPX and BuddyPress…

The first MAJOR flaw I see in this design, is that all it takes is one website to put up password stealing/sniffing code, and now you’ve given your twitter password to anyone with access to the sites malicious intentions.

OpenID and oAuth were designed very much to prevent the spreading or co-opting of passwords. Until recently many services like Twitter let other services accept their user passwords, but now oAuth routes authorization requests to the appropriate authority.

The second MAJOR flaw I see from a developers standpoint is that you as a site administrator no longer have control over the user data that is using your website.

I don’t really follow this, but I also don’t think he’s describing the situation very accurately.

I don’t plan on using Facebook for the rest of my life, so when I delete my account in a few years, that means I can no longer use your site without creating a new profile.

This is no different than, “what if I cancel my email account”

The nice thing about OpenID is that most good implementations will allow multiple ways of accessing the account (either multiple OpenIDs or the option of logging in with the native account username/email)

Also, if I’m logged into facebook on my computer, and close facebook, and then my girlfriend walks over

This isn’t unique to single-sign on services. Any time you fail to log-out of an account and give access to someone else, your account can be compromised.