To OpenID or not to OpenID? Is it worth it?

What I like most about OpenID is that it doesn't feel like I'm creating an account at all. It's more like I already have an account for the entire Web, and StackOverflow is taking notice of it when I log in. I'm really tired of having to create a new "identity" on every site I run across because they want to have a bigger user count.

I also like that sites that (only) use OpenID tend to make the whole account experience more flexible: no email confirmation required, no enforced-unique usernames, use of Gravatar, etc. The upside is that there is no registration; I just log in like I was already here.

It seems to me it is easier and faster for the user to simply enter a username and password in a signup form they have to go through anyway.

I think, on the contrary, that often it's easier and less of a hassle if the user can login with his existing OpenID, instead of creating separate credentials for every site. (Isn't that the main point about it.)

In my latest application I give the users a choice. I think if you do offer OpenID it should be optional and the fact that it's optional needs be very clear to your users. I tested my signup with "average" users and they were very hesitant to sign in with their Yahoo, Facebook, Google, or what have you.

For users that do want to use OpenID, do it right. If there is additional information that your site requires and you can pull that info in along with their authentication token then do it.

OpenId has been challenged because it is a new and unfamiliar concept. In many ways it should have been called "OpenPassword" because the main benefit is controlling a bunch of logins to many sites with a single password. However it is more than that because you specify one quantity and it says both who you are, and proves it.

I know some very experienced computer scientists who were completely thrown when introduced to the concept -- couldn't really see right away how it was secure like entering a password. Because it is called "OpenID" they thought it was just an unsecured name. I mention this because this challenge to understand is significant.

Facebook Connect is the exact same thing -- and it works simply because there are 1 billion people with Facebook accounts, and they tend to stay logged into Facebook all the time. What the facebook guys did well is the user interface, and those implementing OpenID need to take a lesson from that.

The second big mistake I see developers make is thinking that because login is handled some other place, that there is no need for a user profile either. That is incorrect. Each program using OpenId still needs to take responsibility of keeping information about the user EXCEPT for password. The password is the only piece of information that the relying site does not need to keep. Again, there is that "OpenPassword" silly idea again.

I think it is a GIVEN that OpenID will be successful once (1) the general public gets used to this idea of linking a login to another site and (2) OpenID implementors get the user interface right to avoid much of the complication.

Always keep things consistent. OpenID is still in infancy and non-existent to most casual users. It will confuse users who are not familiar with it and they may even end up thinking that they're opting to 'Open' their IDs to the general public.

You can optionally embed a unobtrusive link on the sign up saying "Have an Open ID?". This way you, those familiar with it know to use it, those who aren't simply ignore it.

I'm a developer and tech-savvy person and I find it horrible to use OpenID. But that's just my opinion. In the end you have to choose what fits best with your hypothetical end user.