I have an analytic app for data-oriented professionals. For authentication it offers

• social login (Sign in with Google, LinkedIn, Twitter) or
• "Email me a signin link" (like Forgot my Password without shame)

No password option, so as not to have one to keep secret or encourage weak passwords. And I'd also like it to be easy, attractive, modern, inviting to new users.

Doing in-person testing with end users, I observed everyone but the 25-year old (i.e. the youngest one) paused, and then chose the "email me" to create their account.

Probing, all of them actually had Gmail, LinkedIn and Twitter accounts, usually all three. They said they just wondered and worried why the app wanted their social media account. Does it post to their wall? Scrape their contacts? And so just avoided it.

They never clicked, so didn't even get to the point in the process where the OpenId provider showed the minimal access requested (just email, name in this case) and asks for their permission.

(Interestingly, OpenId provider screens don't show the information that's NOT being requested, such as access to spreadsheets, contacts, message board, etc. to reassure users, or allow users to selectively decline certain ones).

So I'm writing a brief popup window "What's this?" with a short text:

The best way to keep your passwords secure is not to share them.   
OpenID works on thousands of websites. It’s an open standard.   
The OpenID provider verifies your email address and name. That's it.    
[This app] cannot access to your documents, contacts, posts or anything else.

Learn more (href="http://openid.net/get-an-openid/individuals/")

I can't find examples of sites that seem to explain it well. Most sites seem to have no explanation at all (e.g. StackOverflow, SauceLabs fine, they target developers. But Netflix, Rhapsody target end users and still nothing).

Is there a good model to follow? A good external link to point users to?

What makes OpenID so difficult to use by persons with no technical background?

How do you prevent users from getting confused with multiple login options?

I have an analytic app for data-oriented professionals. For authentication it offers

• social login (Sign in with Google, LinkedIn, Twitter) or
• "Email me a signin link" (like Forgot my Password without shame)

No password option, so as not to have one to keep secret or encourage weak passwords. And I'd also like it to be easy, attractive, modern, inviting to new users.

Doing in-person testing with end users, I observed everyone but the 25-year old (i.e. the youngest one) paused, and then chose the "email me" to create their account.

Probing, all of them actually had Gmail, LinkedIn and Twitter accounts, usually all three. They said they just wondered and worried why the app wanted their social media account. Does it post to their wall? Scrape their contacts? And so just avoided it.

They never clicked, so didn't even get to the point in the process where the OpenId provider showed the minimal access requested (just email, name in this case) and asks for their permission.

(Interestingly, OpenId provider screens don't show the information that's NOT being requested, such as access to spreadsheets, contacts, message board, etc. to reassure users, or allow users to selectively decline certain ones).

So I'm writing a brief popup window "What's this?" with a short text:

The best way to keep your passwords secure is not to share them.   
OpenID works on thousands of websites. It’s an open standard.   
The OpenID provider verifies your email address and name. That's it.    
[This app] cannot access to your documents, contacts, posts or anything else.

Learn more (href="http://openid.net/get-an-openid/individuals/")

I can't find examples of sites that seem to explain it well. Most sites seem to have no explanation at all (e.g. StackOverflow, SauceLabs fine, they target developers. But Netflix, Rhapsody target end users and still nothing).

Is there a good model to follow? A good external link to point users to?

What makes OpenID so difficult to use by persons with no technical background?

How do you prevent users from getting confused with multiple login options?