OpenID 一定是电子商务的好选择吗？
作为单点登录实现，我认为 OpenID 很棒。 即便如此，这对于电子商务来说一定是一个好的选择吗？ 我知道可以用，但是应该用吗？ 将一个人的所有访问详细信息放在一个篮子中是否会冒太大的风险？
外界普遍的看法是什么？
As a Single Sign-On implementation, I think OpenID is great. Even so, is it necessarily a good choice for eCommerce? I know it can be used, but should it? Are you risking too much in putting all of one's access details in a single basket?
What's the general opinion out there?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（9）
当我在一家大型电子商务公司工作时，该公司关注了 OpenID。
不要为此感到不安，但该公司拒绝了 OpenID，因为他们不喜欢实施过程中的一些笨拙，并且他们发现，在进行样本用户社区测试时，它实际上降低了注册率（用户社区讨厌它） ，但他们讨厌很多东西）。
底线：您绝对可以将它用于电子商务网站，但我会构建数据库以允许在必要时进行切换，并有办法确定它是否赢得或失去了客户。
When I worked for a large eCommerce company, the company looked at OpenID.
Don't get upset by this, but the company rejected OpenID because they didn't like some of the clunkyness of the implementation, and they found that it actually reduced signup rates, when run through sample user community testing (the user community hated it, but they hated alot of things).
Bottom line: you absolutely can use it for a eCommerce site, but I would have the database built to allow for a switch if necessary, and have a way to determine if it is gaining or costing customers.
取决于您的目标受众。
不懂技术的人可能对OpenID还很陌生，这会提高你开店的门槛。 一个实用的解决方案是同时提供传统身份验证和 openID 身份验证。
从技术上讲，OpenID 身份验证很容易实现，特别是如果您使用 Jboss Seam 这样的框架。
编辑：另一个问题是将部分用户体验交到 openid 提供商手中。 提供商并不都以相同的方式实现 OpenID 规范，因此您需要确保不限制仅使用一个提供商进行测试（例如，google 根据您的应用程序的域返回不同的经过身份验证的 openid，而其他提供商则不会）。 无法进行身份验证是用户将责任归咎于您的网站，而不是提供商。
Depends on your target audience.
The less tech-savvy are probably pretty unfamiliar with OpenID, which would raise the threshold for your shop. A practical solution would be offering both conventional and openID authentication.
Technically OpenID authentication is a snap to implement, especially if you use a framework like Jboss Seam.
Edit: An additional concern is putting part of the user experience in your openid provider's hands. Providers do not all implement the OpenID spec the same, so you need to make sure you do not limit testing with just one (for example google returns a different authenticated openid depending on the domain of your app, while others don't). Not being able to authenticate is something the user is going to blame your site for, not the provider.
问题实际上是它是否适合您的网站用户。 一般的电子商务网站不太可能有很多用户已经设置了 OpenID，而 StackOverflow 的目标受众中我猜至少 50% 的用户已经设置了 OpenID。
如果您有时间，那么肯定会为了那些有幸发现 OpenID 的人的利益而实施它:o)。 不过，我还会为不关心 OpenID 的用户实现一个“标准”登录解决方案。
The question is really whether it is appropriate for your sites users. A general e-commerce site is unlikely to have many users that already have an OpenID setup, in contrast to the target audience of StackOverflow where I would guess at least 50% already have one.
If you have the time, then yes definately implement it for the benefit of those fortunate enough to have discovered OpenID :o). However I would also implement a 'standard' login solution for users that don't care about OpenID.
我认为将 OpenID 用于电子商务应用程序可能会产生一些非常积极的广泛影响。 能够在所有在线购物中使用相同的登录名（尽管这本身可能是一个小安全风险）的想法使得其他人有可能出现并制作将获取您的 OpenID 并向您提供“您所有商店的“市场”（Amazon、BestBuy、EBay 等，全部集中在一个位置）
I think the use of OpenID for ecommerce applications could have some very positive wide range effects. The idea of being able to use the same login for all of your online shopping (albeit that may be itself a small security risk) makes it possible for others to potentially come along and make applications which will take your OpenID and present you with a "marketplace" of all your shops (Amazon, BestBuy, EBay, etc. all in one location)
就个人而言，不。 我不会以任何方式或形式将我的开放 ID 附加到我的银行帐户。
我对各种“垃圾”网站使用开放 ID，我不相信他们会保守我的详细信息，也不相信他们会足够安全，不会让他们受到损害。
Personally, no. I would not attach my open id to my bank accounts in any which way or form.
I use open id for all sorts of 'crap' sites and I don't trust them to keep my details on the down low or to be secure enough not to let them become compromised.
我为什么不呢？
但这在某种程度上取决于登录用户获得的选项。
如果他们可以取消订单，在个人资料中保留信用卡详细信息，在不立即付款的情况下下订单，等等......
那么您应该更加小心，但如果它就像其他电子商务网站一样，请记住购物篮中的东西，跟踪订单状态等。
然后我个人喜欢不记住另一个用户和密码。
无论如何，用户倾向于在任何地方使用相同的密码，如果是这样的话为什么不使用相同的服务来登录:)？
Imo why not?
But it kinda depends on what options the logged in users got..
If they can cancel orders, keep their creditcard details with their profile, make orders without paying right away, and soo on..
Then you should be more carefull, but if its just like the other eCommerce sites, remember stuff in basket, keep track of orderstatus and so on.
Then id personally like not to remember another user and password..
Anyway, users tend to use the same password everywhere, and if thats the case why not use the same service to do the login :) ?
为什么不？ 重要的是，您希望用户能够使用这两种方式进行身份验证。
例如，在 Stack Overflow 中，我使用 google 进行身份验证，我认为这是非常方便快捷的方法。 但是，如果有人足够偏执（叹气），他们不想向单个 Openid 提供商提供太多信息，如果您留下使用自定义注册和身份验证的可能性，他们应该会感到满意。
Why not? Important thing is that you live to user the possibility to use both ways to authenticate.
For example here in Stack Overflow I use google for my auth and i think that it's pretty convenient and fast way. But if there is someone paranoid enough (sigh) who doesn't want to give too much information to single Openid provider if you leave possibility to use your custom registration&auth they should be satisfied.
我正在努力解决这个版本问题。 实施很容易，对于没有或不想使用 openid 的人来说，您肯定需要一个常规帐户系统。
我真正担心的是用户端可能会出现混淆，从一个站点登录到另一个站点并不常见、不被理解或不被充分信任。 如果你愿意的话，它会非常有效，但仅仅要求某人输入他们现有的密码可能看起来像是一个骗局。 大多数支持 OpenID 的网站都是基于博客和信息的，而不是电子商务。 我认为当涉及信用卡和信用卡时，人们更关心安全。 个人信息。
到目前为止，我发现电子商务中唯一提供 OpenID 登录的大牌是 Sears.com / kmart.com，有人知道还有其他吗？
I'm struggling with this version question. Implementing is easy, and you definitely need a regular account system for someone who doesn't have or want to use openid.
My real concern is the possible confusion on the user's end, using a login from one site on another just isn't common, understood or well trusted. It can work really well if you go with it, but just asking someone to enter their existing password might look like a scam. Most OpenID enable sites are blogs and information based, not ecommerce. I think people are more concerned with safety when it involves their credit card & personal information.
So far the only big names in ecommerce I've found to offer OpenID login is sears.com / kmart.com, does anyone know of any others?
有趣的是，我只是尝试使用我的谷歌“openid”登录这里并收到错误（即使我实际上被允许/登录，但我看到了一个错误页面）。
我想知道当用户使用 openid 登录电子商务站点时会发生什么......站点管理员仍然可以知道用户的所有详细信息吗？
换句话说，openid 登录 = 网站所有者没有任何用户数据吗？ 或者是否创建一个帐户，用户可以填写个人详细信息。
funny, i just tried to login here using my google "openid" and got an error (even though I actually was allowed/logged in I was shown an error page).
what I wonder is what happens when a user uses openid to log into an e-comm site....can the site admin still know all the details of the user?
in other words, does an openid login = site owner not having any user data? or does an account get created which the user can fill in personal details.