New protocols and services change the face of online privacy

In the old days (roughly 1 to 2 years ago) you were required to create a new user account if you wanted to start using a new Web service like Facebook or FriendFeed. Once you created your account you frequently had the option to see which of your friends and contacts also used the service and add them as contacts on that service. You could also invite them to join you there.

Find people - FriendFeed.png

The way you did both of these things is you gave the service access to your address book or contacts list in your email account (it could have been Outlook, Gmail, Yahoo! Mail and others) using your username and password for your email account. At this point you were at the new service’s mercy and you trusted it not to abuse your trust and spam your contacts or, worse, hijack your account and lock you out. If all went well you were able to populate your new friends list with your friends from your other services and effectively take your community with you.

There are two problems here. The first is that you had to expose your email account’s (or other primary service’s) username and password. While most major services take their users’ personal information seriously and wouldn’t abuse that personal information, there are many more services that would and they would do this in a number of ways including spamming your contacts in your name, using your email account. The second problem is that you also had to create yet another account on the new service and the more accounts you create the more complicated your identity and account management process becomes.

A number of protocols have emerged which address this challenge employing a common technique. It began with OpenID which is a free, single digital identity which users could take advantage of to sign in to services that support OpenID without having to create a new account every time. According to the OpenID site:

OpenID eliminates the need for multiple usernames across different websites, simplifying your online experience.

You get to choose the OpenID Provider that best meets your needs and most importantly that you trust. At the same time, your OpenID can stay with you, no matter which Provider you move to. And best of all, the OpenID technology is not proprietary and is completely free.

For businesses, this means a lower cost of password and account management, while increasing site visitor registration conversion rates. OpenID lowers user frustration by letting users have control of their login.

For geeks, OpenID is an open, decentralized, free framework for user-centric digital identity. OpenID takes advantage of already existing internet technology (URI, HTTP, SSL, Diffie-Hellman) and realizes that people are already creating identities for themselves whether it be at their blog, photostream, profile page, etc. With OpenID you can easily transform one of these existing URIs into an account which can be used at sites which support OpenID logins.

OpenID is growing quickly and becoming more popular as large organizations like AOL, Facebook, France Telecom, Google, LiveDoor, Microsoft, Mixi, MySpace, Novell, Sun, Telecom Italia, Yahoo, etc. begin to accept and/or provide OpenIDs. Today, it is estimated that there are over one billion OpenID enabled user accounts with over 40,000 websites supporting OpenID logins.

OpenID addresses the second problem I outlined above because once you have your OpenID account set up, you can use your OpenID to sign in to new services that support OpenID. At first there weren’t many compatible services but this has changed fairly recently and OpenID has become more widely supported on services like Plaxo and Google Friend Connect as well as in content management systems like Drupal (which this site runs on).

OpenID doesn’t really help address the first problem, namely providing some form of secure authentication with your pre-existing services. This is where another protocol called OAuth comes in. So what is OAuth?

Many luxury cars today come with a valet key. It is a special key you give the parking attendant and unlike your regular key, will not allow the car to drive more than a mile or two. Some valet keys will not open the trunk, while others will block access to your onboard cell phone address book. Regardless of what restrictions the valet key imposes, the idea is very clever. You give someone limited access to your car with a special key, while using your regular key to unlock everything.

Everyday new website offer services which tie together functionality from other sites. A photo lab printing your online photos, a social network using your address book to look for friends, and APIs to build your own desktop application version of a popular site. These are all great services – what is not so great about some of the implementations available today is their request for your username and password to the other site. When you agree to share your secret credentials, not only you expose your password to someone else (yes, that same password you also use for online banking), you also give them full access to do as they wish. They can do anything they wanted – even change your password and lock you out.

This is what OAuth does, it allows the you the User to grant access to your private resources on one site (which is called the Service Provider), to another site (called Consumer, not to be confused with you, the User). While OpenID is all about using a single identity to sign into many sites, OAuth is about giving access to your stuff without sharing your identity at all (or its secret parts).

These two protocols (or protocols approximating them) have been implemented by a number of popular services and companies such as Google, Twitter, Plaxo and Facebook which uses its own authentication process called Facebook Connect. Google’s implementation of these technologies has taken the form of Google Friend Connect which gives Google, Plaxo, Twitter and OpenID users a simple way to connect to Friend Connect enabled services (an example is the Friend Connect widget on this site in the sidebar which enables Friend Connect users to join a community built around this site and interact with contacts also using Friend Connect). This introductory video explains how Friend Connect works:

When it comes to privacy and protection of your personal information these technologies save you needing to expose your access credentials to multiple services and increasing the risk that your privacy and security could be compromised in the process. Of course it does mean you are forced to rely on these gateway services even more and trust that they will keep your personal information secure. A failure to do so could compromise your privacy across a wider range of services.

Newer protocols like Portable Contacts make it easier to introduce your friends to new services without exposing your credentials in the process. Google’s implementation of Portable Contacts goes a long way towards addressing the first problem I outlined above and I believe we can expect to see more implementations like this going forward.

Services like Friend Connect also potentially remove the need to protect new users’ personal information from site owners who would otherwise need to take responsibility for users’ personal information which they disclose when joining their sites. Of course these site owners still collect other bits of personal information so Friend Connect (or Facebook Connect if it is similarly implemented) is not absolution from the obligation to protect personal information but it does help with some of the more sensitive categories of personal information. These technologies provide alternatives to the traditional model which required users to disclose more and more of their personal information to more and more services. The models aren’t perfect just yet but they certainly help.

Published by Paul Jacobson

Enthusiast, writer, Happiness Engineer at @automattic. I take photos too. Passionate about my wife, Gina and #proudDad.

%d bloggers like this: