Never say the word ... or check-in in 2 clicks

People do not like to register. It is also necessary (in general) to come up with a login and password, enter your email, wait for a letter, open it, follow the account activation link, and then remember to forget this login with a password. But it has long been a way by which all these steps are not needed. Moreover, you do not need to enter anything at all from the keyboard, 2 mouse clicks and that's it, a person is registered.



What is the most common element in todo startups? I think something like this: "The plans - to make an input on OpenID." Why not do it? Because somehow there is no need. Nobody knows about OpenID, nobody needs it. I got the impression that logging in or registering with OpenID is usually done in order to show the technological advancement of the project. But OpenID can be a very useful thing that simplifies people's lives and increases the number of users of the resource. Next is my vision of how to properly apply this technology.
')

Data

For starters, the facts are:

1. Mail users yandex.ru, rambler.ru and gmail.com together cover a very large percentage of RuNet users. From mail services, all that is missing is mail.ru.
2. Yandex.ru, rambler.ru and gmail.com are providers of OpenID 2.0.
3. For authentication through OpenID 2.0, you do not need to enter anything at all from the keyboard, if the site knows the OpenID provider and the user is authorized by this provider. In OpenID 2.0, the server address is the same for all users (the url does not contain the user name anywhere).
4. Users do not know (and do not want to know) what OpenID is. Well, maybe 1% heard somewhere that this is such an incomprehensible thing for geeks.

What follows from this

In Russia (and in the CIS) it is quite possible to take into account only 3 OpenID providers: the aforementioned Yandex, gmail and rambler. If you provide users with a choice of these 3 providers, then with a high degree of probability a person will have an account somewhere. The user chooses his provider from these 3x (1 click) - the site now has information about which url to use for OpenID authentication. You can then follow the usual OpenID authentication procedure. If the user is authorized by the provider, he confirms authentication (1 more mouse click). If not, it is authorized (this is different for everyone, at best - 1 click, the username and password substituted the browser), then confirms the authentication.

What we have: primary authentication in 2 clicks of the mouse (if the user is authorized in his email). In this case, the site can either register or authorize a user. Additional data for registration (if necessary) the site can be obtained via SREG, hCard, ax, something can be retrieved from the login openid (for all this, the user does not need to perform any actions). If you need to fill something else, then ask the user further. Notice, you will need to ask potentially less than during normal registration.

Repeated logins will occur in 1 click of the mouse (if the user has clicked "remember connection" during authentication), as is the case with the auto-completion of the login-password pair by the browser. And, of course, nobody canceled cookies for memorizing user authorization.

Interface

Now about the interface.

It seems to me that teaching users what OpenID is is a dead number. And it is worth proceeding from the fact that even just using the unfamiliar word “OpenID” can frighten an ordinary person. The average user has mail and an account on VKontakte or classmates, that's all. There is nothing wrong with my sister not wanting to enter into some strange things with strange names (such as OpenID), this is absolutely normal. Most people, I think, never know what OpenID is. From this premise, I propose and build a user interface.

Here is my version of this interface:


As a matter of fact, this is the registration / authorization form on the pip.ec website. The user does not need to check email, activate an account, invent a login and password. Moreover, in a successful case, you do not need to enter anything at all from the keyboard, 2 mouse clicks and that's it, the person is registered.

But all this is a theory that can cause different questions (if people are not afraid of going to another site, will they press “authorize”, etc.) that only practice can answer. So what in practice?

Practice

In addition to registering for OpenID on pip.ec, the possibility of regular registration is also made. The statistics are as follows: more people are registered using OpenID than in the usual way. On the site there is not a single mention of the word OpenID. People who register in the usual way and have mail on a gmail, Yandex or Rambler are generally one. Of those who register in the usual way, half are mail.ru users.

findings

The conclusion of all this: OpenID 2.0, with the right approach, simplifies the lives of users and increases the number of registrations. There is nothing geeky and marginal in the sense that users do not need to know that your registration-authorization occurs through OpenID.

Implementation, technical details

About the implementation. First, a small help, addresses of providers openid (remove underscores):

Google: _https: //www.google.com/accounts/o8/id
Yandex: _http: //openid.yandex.ru/
Rambler: _http: //rambler.ru/

Secondly, about libraries for working with openid. I am sure that for different languages ​​there are a lot of libraries that support OpenID 2.0, if you write them in the comments, I’ll add them here. I have everything written on django, the code is a bit specific and I did not select it in a separate application. For django, I would suggest trying a new project that Alexander Koval wrote (he did not try), or this is a good application: django-authopenid , or this: scipio .

Thirdly, I highly recommend the blog and the OpenID forum with Ivan Sagalaev (which, by the way, also threatens to unleash the correct openid-consul for python / django soon ). If something about OpenID is not clear, read the article from there: OpenID: myths and superstitions , it already had a link to the habr.

Everything that I have written here is far from news, I just decided to systematize everything a little and convey it to a larger audience. The fact is that yes, it’s all kind of not news, and we don’t see projects using the described approach.

And yet, appeal to the mail.ru team. Suddenly one of them will read the article. Please become an OpenID 2.0 provider. Sooner or later, the developers will skip the chip and become more massively make sites with three buttons "Yandex, Gmail, Rambler". Everyone: and mail.ru, and users, and developers will be better if instead of 3 buttons there are 4: “Yandex, Gmail, Mail, Rambler”.

If it also seems to you that it would be great if mail.ru became an OpenID 2.0 provider, you can also write more letters to the mail.ru technical directorate, the address is here: corp.mail.ru/contacts.html