Google IO - Google Wave And Socializing Your Web Using Open Authentication - Oauth and OpenID

Sumit Kataria
Sumit Kataria

on

June 1, 2009

Google IO - Google Wave And Socializing Your Web Using Open Authentication - Oauth and OpenID

Last week was quite interesting, I happened to show up at Google IO developer Conference 2009. Committing to writing about the entire Google IO event in a single post is a tough job, so friends here is a succinct post covering the topics that seems most exciting to me.

1. Google wave:

As many may have read already, Google announced a new Internet-based communications and collaboration platform Google Wave in the second day's key note talk at Google IO. Google Wave seems to be an integrated communications platform that brings together email, chat, twitter, social networks, photo-sharing, and collaborative editing features. Google describes a 'wave' as "equal parts conversation and document" and the Wave team basically sees it as a replacement for email and other collaboration tools. Google's announcement of wave was the most exiting technical demonstration I ever been to, it was full of cheers, applause and whistling, evidence of the excitement about this new product which could revolutionize the world of emails, instant messaging, photo sharing, blogging, social networking and intranet communications.

How Google Wave Works

In Google wave you add people to a new wave and now you can communicate and work together with richly formatted text, photos, videos, maps, and more in there. They can insert a reply or edit the wave directly. Wave's concurrent rich-text editing, where you see on your screen nearly instantly what your fellow collaborators are typing in your wave. That means Google Wave is just as well suited for quick messages as for persistent content — it allows for both collaboration and communication. You can also use "playback" to rewind the wave and see how it evolved. Video from Google IO keynote talk

Google wave is build upon Google toolkit in HTML5 and the code is open source as a way to encourage the developer community to get involved. Google wave includes rich text editors which supports drag and drop from desktop, word by word translators to provide effective communication between different languages. Google Wave is also a rich set of open APIs that allow developers to embed waves in other web services, and to build new extensions that work inside waves. This means you can integrate any of your existing services to waves using its extensible api in a very secure wave.

2. Socializing your web using open authentication - OAuth and OpenID

As participation on social networking websites increases, the need for open authentication is becoming more obvious. Open authentication means more user friendly authentication on websites.
A year ago Plaxo and Google start working upon an OpenID/OAuth Hybrid Extension which is quite stable and successful now. Combining OpenID and OAuth based authorization, this new extension to the OpenID protocol reduces the number of redirects between the OpenID Provider and the consuming site, the Relying Party, if access to further data from the provider is required or desired. This technical reduction of redirects also benefits users as they don’t have to first authenticate with their OpenID, and in a second step grant the Relying Party access to more data like address books. eg. http://googlecodesamples.com/hybrid/ This hybrid of OAuth and OpenID has worked really well for Plaxo as it delivered 92% success rate - where people prefer to sign in using their google accounts. Here is a presentation by Joseph Smarr, of Plaxo where he discusses how implementing OpenID/OAuth Hybrid Extension with google and other open social platforms helped Plaxo to increase no of active users and traffic. Video to above session will be posted at http://josephsmarr.com/2009/05/29/the-social-web-an-implementers-guide-google-io-2009/ soon.
Recently MySpace launched MySpaceID which is a new open authentication platform allowing MySpace users to grant permissions to other external websites in order to display information available from a user's profile - such as user pictures, status, etc. It allows users to:
  • Connect MySpace profile data to partner sites
  • Find MySpace friends on a partner site (Now available)
  • Register on partner sites using their MySpace URL
  • Publish activities from partner sites to MySpace
  • Syndicate activities on MySpace to partner sites
MySpace has decided to provide it as an open component with multiple library support means this could be implemented on any php, python etc. based web/desktop/mobile platform. I found MySpaceID developers most exited about their JavaScript library (which is about to be released in this week) as it will make it easier to integrate MySpaceID with any existing platform with minimal code. You just need to add few lines of java script code to your page and people can login to your website using their MySpaceID. MySpace uses OAuth for all data sharing and authentication which could be implemented to browser based as well as mobile based applications. more details are at
http://lynk2.me/qwg
An obvious question arises: Why I should implement MySpaceID or Facebook Connect or any other open authentication to my website? Well the answer is simple:
  • It will drive more traffic to you sites
  • Open standard authentication systems are easy to implement
  • More users will register happily on your website as its just one click away
  • Users don't have to remember more usernames and passwords
AttachmentSize
Not So Relevant - Sign in.jpg57.45 KB

Share it!

I found MySpaceID developers most exited about their JavaScript library (which is about to be released in this week) as it will make it easier to integrate MySpaceID with any existing platform with minimal code. Good post.

I can see the benefits of "open authentication" for website owners, but I'm still troubled by the advantages for the user ... Convenience is a powerful driver, but which are the hidden risks of using the same set of credentials to access multiple websites? There is a trade-off between convenience, privacy and security that cannot be easily assessed by the average user. If I decide to use my Google/Facebook/MySpace/... account as my main identity on the web, I'm increasing the level of trust in the issuer. And I would prefer not to give too much power to ID providers. My (very biased) advice is to use long-and-strong passwords and never re-use them. Do I sound stallman-esque? ;-)