http://simonwillison.net/2008-01-07T23:33:39+00:00Simon Willison2008-01-07T23:33:39+00:002008-01-07T23:33:39+00:00https://simonwillison.net/2008/Jan/7/projection/#atom-tag

<p><a href="http://www.readwriteweb.com/archives/flickr_to_authenticate_openid.php">Via ReadWriteWeb</a>, view source on <a href="http://www.flickr.com/photos/simon/">a Flickr photostream page</a> and search for "openid" and you'll be rewarded with the following snippet:</p> <pre><code class="html">&lt;link rel="openid2.provider" href="https://open.login.yahooapis.com/openid/op/auth" /&gt;</code></pre> <p>Which means that Flickr pages will very soon be able to act as <a href="http://openid.net/">OpenIDs</a>. The provider isn't up and running just yet though; try authenticating with your Flickr OpenID on <a href="http://jyte.com/auth/login">Jyte.com</a> and you'll get the following message:</p> <blockquote><p> Hey there! You have stopped by a bit sooner than we had expected. This feature is still being tested, so please check back in a few days. </p></blockquote> <p>The URL of the server is interesting as well: it suggests that Yahoo!'s OpenID support is designed from the start to apply to more than just Flickr. I wouldn't be at all surprised to see similar links start to crop up on all kinds of other Yahoo! properties - anything that has a page which can be considered to represent a user account. This would make a lot of sense, because <strong>OpenID is good for more than just authentication</strong>. The OpenID protocol allows a user to assert ownership of a URL. This can be used for SSO-style authentication, but it can also be used to prove ownership of a specific account to some other service, a concept I've been calling <em>identity projection</em>.</p> <p>If users can easily project their Flickr, Upcoming or del.icio.us identities to other sites, developers can start to build all kinds of neat things. Mashups for one get a whole lot more interesting when new users can easily bring their existing profiles from other sites with them. With any luck we'll see Yahoo! start to adopt <a href="http://oauth.net/">OAuth</a> for authenticated API calls (which is itself based in part on the <a href="http://www.flickr.com/services/api/auth.spec.html">Flickr auth API</a>) in the not too distant future, opening up even more possibilities.</p> <p>A common misconception about OpenID is that it's only really useful if users stick to using one identity. I'd be happy to see every one of my online profiles acting as an OpenID, not for SSO authentication (I'll pick one "primary" OpenID to use for that) but so that I can selectively cross-pollinate some of my profiles to new services.</p> <p>Back to Yahoo!, another interesting new URL is <a href="https://me.yahoo.com/">https://me.yahoo.com/</a>. Again, there's not much to see at the moment but it looks to me like this will become an endpoint for OpenID 2 directed identity. James Henstridge <a href="http://blogs.gnome.org/jamesh/2007/10/23/openid-20/">provides a useful explanation here</a>, but the short version is that you'll be able to enter "me.yahoo.com" in to an OpenID field on a site and have Yahoo! pick an obfuscated, unique OpenID for your interactions with that site. This protects your privacy by preventing anyone from outside of Yahoo! from correlating your behaviour across multiple OpenID-enabled services, similar to how Yahoo!'s current <a href="http://developer.yahoo.com/auth/">BBAuth API</a> provides applications with an opaque hash rather than a user's Yahoo! screen name.</p> <p>It looks like Yahoo! will only be supporting OpenID 2 and won't provide a fallback for OpenID 1.x consumers. This means you won't be able to use your Flickr OpenID on many existing consumer sites (including this blog), at least until they get around to updating their libraries. I expect Yahoo!'s implementation to be a major influence in encouraging OpenID 2 adoption.</p> <p>It's three weeks short of a year since I <a href="http://simonwillison.net/2007/Jan/27/idproxy/">launched idproxy.net</a>, which provides Yahoo! account holders with a third-party OpenID via the BBAuth API. I couldn't be happier to see Yahoo! taking steps towards cutting out the middle man.</p> <p>Tags: <a href="https://simonwillison.net/tags/bbauth">bbauth</a>, <a href="https://simonwillison.net/tags/flickr">flickr</a>, <a href="https://simonwillison.net/tags/identityprojection">identityprojection</a>, <a href="https://simonwillison.net/tags/oauth">oauth</a>, <a href="https://simonwillison.net/tags/openid">openid</a>, <a href="https://simonwillison.net/tags/openid2">openid2</a>, <a href="https://simonwillison.net/tags/yahoo">yahoo</a></p>

2006-10-31T16:51:17+00:002006-10-31T16:51:17+00:00https://simonwillison.net/2006/Oct/31/menuism/#atom-tag

<p><strong><a href="http://menuism.wordpress.com/2006/10/31/use-the-yahoo-sign-in-to-join-its-easy-as-pie/">Menuism on Y! BBAuth</a></strong></p> 70% of new users chose to use their Yahoo! account rather than create a new one. <p>Tags: <a href="https://simonwillison.net/tags/bbauth">bbauth</a>, <a href="https://simonwillison.net/tags/menuism">menuism</a>, <a href="https://simonwillison.net/tags/yahoo">yahoo</a></p>

2006-09-29T19:21:12+00:002006-09-29T19:21:12+00:00https://simonwillison.net/2006/Sep/29/yahoo/#atom-tag

<p><strong><a href="http://developer.yahoo.com/auth/">Yahoo! Browser-Based Authentication</a></strong></p> This is a Really Big Deal. Yahoo! has over 200 million /active/ user accounts. <p><small></small>Via <a href="http://developer.yahoo.net/blog/archives/2006/09/our_users_can_b.html">Yahoo! Developer Network blog: Our Users Can Be Your Users Too</a></small></p> <p>Tags: <a href="https://simonwillison.net/tags/bbauth">bbauth</a>, <a href="https://simonwillison.net/tags/yahoo">yahoo</a>, <a href="https://simonwillison.net/tags/ydn">ydn</a></p>