How to explain Login with OpenID to end users, good models to follow?

Question

I have an analytic app for data-oriented professionals. For authentication it offers

• social login (Sign in with Google, LinkedIn, Twitter) or
• "Email me a signin link" (like Forgot my Password without shame)

No password option, so as not to have one to keep secret or encourage weak passwords. And I'd also like it to be easy, attractive, modern, inviting to new users.

Doing in-person testing with end users, I observed everyone but the 25-year old (i.e. the youngest one) paused, and then chose the "email me" to create their account.

Probing, all of them actually had Gmail, LinkedIn and Twitter accounts, usually all three. They said they just wondered and worried why the app wanted their social media account. Does it post to their wall? Scrape their contacts? And so just avoided it.

They never clicked, so didn't even get to the point in the process where the OpenId provider showed the minimal access requested (just email, name in this case) and asks for their permission.

(Interestingly, OpenId provider screens don't show the information that's NOT being requested, such as access to spreadsheets, contacts, message board, etc. to reassure users, or allow users to selectively decline certain ones).

So I'm writing a brief popup window "What's this?" with a short text:

The best way to keep your passwords secure is not to share them.   
OpenID works on thousands of websites. It’s an open standard.   
The OpenID provider verifies your email address and name. That's it.    
[This app] cannot access to your documents, contacts, posts or anything else.

Learn more (href="http://openid.net/get-an-openid/individuals/")

I can't find examples of sites that seem to explain it well. Most sites seem to have no explanation at all (e.g. StackOverflow, SauceLabs fine, they target developers. But Netflix, Rhapsody target end users and still nothing).

Is there a good model to follow? A good external link to point users to?

What makes OpenID so difficult to use by persons with no technical background?

How do you prevent users from getting confused with multiple login options?

Answer 1

All that is happening really is you are redirecting them to google, they are logging in, and google / twitter / whoever is passing a token back for you to use as authentication. Maybe tell them that, in a more user friendly way. This is my 5 minute stab at it:

Answer 2

I agree that OpenID is not well explained to end users, either on the official website or on any of the websites of the major companies using it (that I have seen).

Maybe that is what motivated the people behind http://openidexplained.com/ - which is the best attempt I have come across. They use a Creative Commons licence, so you might be able to cut out the most relevant portions of the info and use it on your site. Or you could just link to them.

Caveat

But that site doesn't cover everything, in my opinion. For decades now, end users have been encouraged to look after their passwords carefully - especially for important systems like their email account. With OpenID, the user is being asked to type in their Yahoo password (for example) in order to get access to some random website/app.

I think openidexplained.com does a good job of giving users a happy feeling that this is all hunky-dory. As the owner of that random website/app, this may meet your immediate needs. But out of social responsibility I think we should also be very clear what's so special about the situation the user is encountering that makes it hunky-dory. End users still must not just type in their Yahoo password whenever they are randomly asked for it.

The front page of openidexplained.com does say this:

When you type your username and password, make sure you're actually on the website you think you are (i.e., check the address).

But that is all it says. I would want to see this greatly elaborated with pictures and lots of words on the How do I log in page, but it's not, in the slightest.