Disclaimer: This blog post does not reflect future product announcements, technical strategy or advice from my employer. Disregard this disclaimer at your own risk.
In my previous post Some Thoughts on Open Social Networks, I gave my perspective on various definitions of "open social network" in response to the Wired article Slap in the Facebook: It's Time for Social Networks to Open Up. However there was one aspect of the article that I overlooked when I first read it. The first page of the article ends with the following exhortation.
We would like to place an open call to the web-programming community to solve this problem. We need a new framework based on open standards. Think of it as a structure that links individual sites and makes explicit social relationships, a way of defining micro social networks within the larger network of the web.
This is a problem that interests me personally. I have a Facebook profile while my fiancée has a MySpace profile. Since I’m now an active user of Facebook, I’d like her to be able to be part of my activities on the site such as being able to view my photos, read my wall posts and leave wall posts of her own. I could ask her to create a Facebook account, but I already asked her to create a profile on Windows Live Spaces so we could be friends on that service and quite frankly I don’t think she’ll find it reasonable if I keep asking her to jump from social network to social network because I happen to try out a lot of these services as part of my day job. So how can this problem be solved in the general case?
This is exactly the kind of problem that OpenID was designed to solve. The first thing to do is to make sure we all have the same general understanding of how OpenID works. It's basically the same model as Microsoft Passport Windows Live ID, Google Account Authentication for Web-Based Applications and Yahoo! Browser Based Authentication. A website redirects you to your identity provider, you authenticate yourself (i.e. login) on your identity providers site and then are redirected back to the referring site along with your authentication ticket. The ticket contains some information about you that can be used to uniquely identify you as well as some user data that may be of interest to the referring site (e.g. username).
So how does this help us? Let’s say MySpace was an OpenID provider which is a fancy way of saying that I can use my MySpace account to login to any site that accepts OpenIDs . And now let’s say Facebook was a site that accepted OpenIDs as an identification scheme. This means that I could add my fiancée to the access control list of people who could view and interact with my profile on Facebook by using the URL to her MySpace profile as my identifier for her. So when she tries to access my profile for the first time, she is directed to the Facebook login page where she has the option of logging in with her MySpace credentials. When she chooses this option she is directed to the MySpace login page. After logging into MySpace with proper credentials, she is redirected back to Facebook and gets a pseudo-account on the service which allows her to participate in the site without having to go through an account creation process.
Now that the user has a pseudo-account on Facebook, wouldn’t it be nice if when someone clicked on them they got to see a Facebook profile? This is where OpenID Attribute Exchange can be put to use. You could define a set of required and optional attributes that are exchanged as part of social network interop using OpenID. So we can insert an extra step [which is may be hidden from the user] after the user is redirected to Facebook after logging into MySpace where the user’s profile information is requested. Here is an example of the kind of request that could be made by Facebook after a successful log-in attempt by a MySpace user.
openid.ns.ax=http://openid.net/srv/ax/1.0openid.ax.type.fullname=http://example.com/openid/sn_schema/fullnameopenid.ax.type.gender=http://example.com/openid/sn_schema/genderopenid.ax.type.relationship_status=http://example.com/openid/sn_schema/relationship_statusopenid.ax.type.location=http://example.com/openid/sn_schema/locationopenid.ax.type.looking_for=http://example.com/openid/sn_schema/looking_foropenid.ax.type.fav_music=http://example.com/openid/sn_schema/fav_musicopenid.ax.count.fav_music=3openid.ax.required=fullname,gender,locationopenid.ax.if_available=relationship_status,looking_for,fav_music
which could return the following results
openid.ns.ax=http://openid.net/srv/ax/1.0openid.ax.type.fullname=http://example.com/openid/sn_schema/fullnameopenid.ax.type.gender=http://example.com/openid/sn_schema/genderopenid.ax.type.relationship_status=http://example.com/openid/sn_schema/relationship_statusopenid.ax.type.location=http://example.com/openid/sn_schema/locationopenid.ax.type.looking_for=http://example.com/openid/sn_schema/looking_foropenid.ax.type.fav_music=http://example.com/openid/sn_schema/fav_musicopenid.ax.value.fullname=Jennaopenid.ax.value.gender=Fopenid.ax.value.relationship_status=Singleopenid.ax.value.location=Seattle, WA, United Statesopenid.ax.value.looking_for=Friendsopenid.ax.value.fav_music=hiphop,country,popopenid.ax.update_url=http://www.myspace.com/url_to_send_changes_made_to_profile
With the information returned by MySpace, one can now populate a place holder Facebook profile for the user.
The question at the tip of your tongue is probably “If we can do this with OpenID today, how come I haven’t heard of anyone doing this yet?”. As usual when it comes to interoperability, the primary reasons for lack of interoperability are business related and not technical. When you look at the long list of Open ID providers, you may be notice that there is no similar long list of sites that accept OpenID credentials. In fact, there is no such list of sites readily available because the number of them is an embarassing fraction of the number of sites that act as Open ID providers. Why this discrepancy?
If you look around, you’ll notice that the major online services such as Yahoo! via BBAuth, Microsoft via Passport Windows Live ID, and AOL via OpenID all provide ways for third party sites to accept user credentials from their sites. This increases the value of having an account on these services because it means now that I have a Microsoft Passport Windows Live ID I not only can log-in to various Microsoft properties across MSN and Windows Live but also non-Microsoft sites like Expedia. This increases the likelihood that I’ll get an account with the service which makes it more likely that I’ll be a regular user of the service which means $$$. On the other hand, accepting OpenIDs does the exact opposite. It actually reduces the incentive to create an account on the site which reduces the likelihood I’ll be a regular user of the site and less $$$. Why do you think there is no OpenID link on the AOL sign-in page even though the company is quick to brag about creating 63 million OpenIDs?
Why would Facebook implement a feature that reduced their user growth via network effects? Why would MySpace make it easy for sites to extract user profile information from their service? Because openness is great? Yeah…right.
Openness isn’t why Facebook is currently being valued at $6 billion nor is it why MySpace is currently expected to pull in about half a billion in revenue this year. These companies are doing just great being walled gardens and thanks to network effects, they will probably continue to do so unless something really disruptive happens.
PS: Marc Canter asks if I can attend the Data Sharing Summit between Sept. 7th – 8th. I’m not sure I can since my wedding + honeymoon is next month. Consider this my contribution to the conversation if I don’t make it.
Now playing: Wu-Tang Clan - Can It Be All So Simple