Aehso’s Output

The word ‘open’ has been abused terribly in recent months (I’m looking at you OpenSocial and you AT&T/Verizon) but the recently completed OpenID 2.0 and OAuth Core 1.0 specifications are truly open. They really should be on the radar of every self respecting web developer that works on websites/APIs that require authentication (OpenID) and authorization/access-control (OAuth). Both are integral to any hope we have of evolving the existing world wide web into a truly open social network (or the giant global graph as timbl now calls it)

If you are looking for primers then you need go no further than Simon Willison’s How To use OpenID screencast (5 mins) and Explaining OAuth.

That said, minimal OpenID implementations won’t solve all authentication headaches. Phishing is a problem so I suspect OpenID enabled sites will need to employ white list providers as Tim and Dare highlighted this a while back.
.
Now we (the web community that is) need two things to happen.

1. We need the big online identity silos like Google, Yahoo!, Microsoft Live, Facebook and MySpace – the sites whose login page average web users trust – to step up to the plate and act as OpenID providers.
2. We need the big API sites like Google Maps/Charts/Base/…, Microsoft Live, Yahoo!/Flickr, Facebook to start working on enabling OAuth access to their APIs.

Note the overlap in the two lists above – yep, those guys own this part of the web. Which will be brave enough to move first? With final specifications in hand, no excuses, please go forth and implement and lets end this www account/data access hell we all live in.

aehso beacon, facebook, google, microsoft, oauth, openid, yahoo

Perhaps past-history now that they have implemented the great off switch but it helps explain why organizations like MoveOn got so riled (btw, here’s a game, find the link in the Facebook/Zuckerberg blog post)

It’d still be even better if their javascript stopped sending requests to Facebook servers anyway…

aehso beacon, facebook

Jay Goldman has written up a great deconstruction of the Facebook Beacon Javascript. The Facebook developers have jumped through a few hoops to accommodate the XSS restriction in browsers while implementing Beacon.

Whatever about the privacy concerns that are currently being actively discussed, this non-trivial javascript pattern for sharing data will most likely be used in many other cross site integrations in the future – the absence of a requirement on the client website to implement a complex backend integration is quite compelling…

aehso beacon, facebook, javascript, privacy, xss