OpenID: Now more powerful and easier to use! 10


Google, Yahoo!, and MySpace have launched support for the OpenID OAuth Hybrid Protocol, which combines OpenID authentication (sign in) with OAuth authorization (access control) into a single interface. Websites that accept OpenID can now let the hundreds of millions of users who already have either a MySpace, Google, or Yahoo! account sign in and enable two-way data sharing of their profile, contacts, and activities, without having to register a new site-specific account or to share their password.

Plaxo is one of the earliest adopters of OpenID, allowing their users to sign into Plaxo using an OpenID enabled account with just a couple mouse clicks. Instead of requiring first-time Plaxo users to manually verify their email address by sending a verification email, Plaxo uses OpenID Attribute Exchange to verify Yahoo! and GMail email addresses without forcing users to wait at their mailbox for the verification email to arrive. Building on their successful experience with OpenID, Plaxo is experimenting with the Hybrid Protocol: A portion of new users who sign up for Plaxo using either a GMail or Yahoo account can now sign into Plaxo with their OpenID and authorize two-way data sharing of their Contacts and Activities via the Hybrid Protocol. You can read more about how this works on the Plaxo blog.

plaxo_hybrid_popup “OpenID+OAuth hybrid onboarding is the state-of-the-art for connecting users and sites across the emerging Social Web,” says Joseph Smarr, CTO of Plaxo and Board Member of the OpenID Foundation. “Google, Yahoo!, and MySpace all have massive userbases and expertise in consumer-friendly design, along with a rich set of APIs. So this is a major milestone in making the Social Web more open and interoperable.”

Another trailblazer in the OpenID space is JanRain, whose RPX service powers the l
ogin and registration flows for their customers, including Qype and MySears. Using the OpenID protocol, users can sign into RPX-enabled websites with an account that they already have. Now that RPX supports the Hybrid Protocol, sites integrating with RPX can now let users sign in with one of their existing accounts and share their Profile. In addition, these sites can also receive massive referral traffic by syndicating their user activities back to their OpenID Provider to be viewed by their friends and contacts at Yahoo!, Google, or MySpace.

mysears_openid_popupNot only are we making OpenID more powerful, we’ve been taking steps to make OpenID easier and less confusing to use. The traditional OpenID “redirect” user experience has been criticized for taking a user away from the site during the login process. The OpenID User Interface Working Group has been chartered to make OpenID more user friendly, and we’re glad to announce that Yahoo!, Google, and MySpace now support the Popup UI as defined in the OpenID User Interface Extension. Sites that want to preserve their context and keep the user on their site can open a small popup window to complete the OpenID authentication flow. In order to help prevent phishing, the User Interface extension requires that the popup be displayed in an independent browser window with the address bar clearly displayed.

uservoice_popup_uiOpenID gives users control over their data and makes it possible for sites to build a single interface that can reach virtually all potential users. Because OpenID is an interoperable open standard, sites that accept OpenID can reuse the same interface and code to accept identities from a wide variety of OpenID Providers, including Google, AOL, MySpace, and Yahoo!. This makes it possible for virtually anyone to sign in to a site using an account that they already have.

It’s been an exciting month for OpenID, with recent news about our involvement in the Open Government Initiative, and now with support for Hybrid and the Popup UI. Stay tuned for more exciting news as we continue to improve OpenID!

P.S. If you’d like to meet the folks working on OpenID, OAuth, and the Open Stack, please join us at the Internet Identity Workshop in Mountain View, CA this November.

Allen Tom
Architect, Yahoo! Membership
OIDF Community Board Member

  • http://bkkissel.myopenid.com/ Brian Kissel

    Its great to see the innovations and improvements in data access, security, convenience, and user experience that the major OpenID providers have been deploying.

    These are some concrete examples of the benefits to website operators and end users of adopting open standards including OpenID and OAuth.

    The federal government has adopted OpenID to increase citizen engagement in the political process, allow government agencies to serve their constituents better, provide for more transparency in the government, and lower costs by adopting open standard technologies.

    Intiatives like the ones that Allen describes above are example of how OpenID and related platforms are helping government, commercial, and not profit organizations leverage their web channels more effectively.

  • http://www.jasjeet.com Jasjeet Thind

    This is a well written article, Allen! The OpenId/Oauth hybrid will also improve the user experience as less steps are involved. The federal government adoption should also encourage adoption increase across the internet.

  • http://bassistance.de Jörn Zaefferer

    When will I be able to use my email address (here, joern.zaefferer@gmail.com) as my OpenID?

    In other words: Why does an OpenID have to be a URL? I know that Google is an OpenID-provider, but I have no easy way to figure out the correct URL for my Goolge OpenID. When a site doesn’t have an extra Google-button just for that, I can’t use it, because it won’t accept any non-URL as an OpenID.

    I think OpenID can really take off once you allow the user to enter his email address, and do the lookup of the current URL yourself (for Google it seems to be https://www.google.com/accounts/o8/id), instead of forcing the user to figure it out.

  • Zbinyor

    I am currently building a website and would love to allow my partners/members/followers to sign in using the open ID concept. How can I do that. Do I need any script to be placed on my website’s pages?

  • http://murciamarketing.com Paul Gailey Alburquerque

    Jörn: still available at the moment to view at least is the emailtoid.net initiative however i cannot vouch if this is in development due to parent company issues.

  • OpenIdFan

    Is there usability analytics of the providers of how many users use facebook/google/yahoo/openid /twitter etc
    when using OpenID

    thanks
    OpenIdFan

  • Pingback: Some links for light reading (29/9/09) « davidmcdonald.dyndns.org:1973

  • http://increasevideoviews.com Joseph Daniels

    I know this may sound stupid, but I have never actually used Openid.

    After reading this post, although it’s very old, I think I am going to give it a go :)

  • http://www.ibsi-us.com IT Support Tampa

    finally we will be able to use SSO in the form of OpenID

  • http://www.társkereső.hu Társkereső

    I love the OpenID its very easy to use and extremely user friendly. Whats next in 2011 im wondering…