Thank you Evernote!

The fantastic news in the saga of working to reclaim my wife's Evernote account has a very happy ending. In working with the Evernote support team (which is incredibly helpful) it appeared that the only option was to create a brand new Evernote account and then import the notes that were sync'd on her laptop. This was a less than ideal solution because it meant her old account would be orphaned and accessible to the person who owned the email address I mistakenly used when registering her account. Because of this I've been delaying setting up my wife's new Evernote account.

You can't imagine my happiness when I fired up Evernote on her laptop this morning and was directed to the web to reset her password. On the page where there used to be just a "An email has been sent" message, there was a "I didn't get the email" button. That took me through a new 'account recovery' flow that allowed me to reclaim my wife's original account (rather than create a new one). Basically, I had to enter the email address I had used to register the account as well as my wife's username and old password. From there I could reset the password. Now that I had reclaimed the account, I went in and fixed my email mistake so I won't get stuck in this situation again:)

THANK YOU EVERNOTE!!!

Another reason to get rid of passwords

This morning I had a very unpleasant experience regarding passwords. A couple years ago I set up an Evernote account for my wife (I had recently given her an iPad). With the recent evernote hack and exposure, I wanted to help her reset her password and get her iPad and laptop apps back in a working order. This should be a very simple and straight forward process... except for one minor problem that has effectively locked my wife out of her account.

The problem? I accidentally registered her account with the wrong email address. My wife uses an email provider that supports multiple email domains and without thinking I used the wrong domain. Now it appears that Evernote has chosen to only support resetting passwords via an email message and that, using an email address that was never verified. So my wife can ask for as many "reset emails" as she wants, but she will never receive them and Evernote does not appear to provide any other mechanism to reset a password.

While I'm very frustrated with my own mistake in setting up the account, I can't believe that Evernote would allow password reset flows with unverified email addresses.

OpenID Foundation Community Board Election

Wow! A year has passed and once again the OpenID Foundation is holding an election for 5 new Community Board members. This is a great opportunity to participate in an organization that is making a difference in consumer facing identity standards. I'm excited about the opportunities for both Account Chooser (simplifying the user experience) and OpenID Connect (expanding the set of use cases for federated identity). I am again running for one of the community board seats and would greatly appreciate your vote.

If you are not a member, joining the OpenID Foundation is easy and only costs $25/year. Here is my nomination statement.

I am the Chief Architect for Consumer Identities at AOL Inc. and a long time OpenID supporter. My history starts with AOL (my employer) being one of the first major identity providers to support OpenID 1.0. I have contributed to the OpenID 2.0 specification along with a number of the OpenID 2.0 extensions. I’m now an active contributor to the OpenID
Connect specifications. In addition, I have experience participating in a number of industry standards organizations (OIDF, IETF, OASIS, Kantara Initiative) working on identity related protocols and specifications.

I am very excited about the technology currently under development within the OpenID Foundation such as Account Chooser and OpenID Connect. Account Chooser has the opportunity to significantly simplify the login experience for many of today's internet users. In concert with Account Chooser, OpenID Connect addresses a very broad range of both social and enterprise use cases. Keeping Authentication separate from Authorization is important to the development of user flows that truly scale. In addition, allowing for both Authentication and Authorization in the same flow will streamline federated identity experiences.

As a community member of the OpenID Foundation board, I will work to ensure both technical excellence in the specifications and broad adoption of the OpenID protocols.

For broad adoption of OpenID Connect and Account Chooser, we need have deployment by early adopters as well as show business value to both Identity Providers and Relying Parties. In addition, we need to define best practices for new user flows introduced by identity federation such as account recovery, temporary access (when the user's IdP is "down") and forgotten IdP. These are areas of focus for me in the coming year.

To vote just click here!