W3C home > Mailing lists > Public > public-xg-socialweb@w3.org > May 2010

Fwd: [OpenID board] Why Connect?

From: Dan Brickley <danbri@danbri.org>
Date: Tue, 25 May 2010 11:11:23 +0200
Message-ID: <AANLkTimTiSzB85b3Y8Jdg3DMS3GxZQfaXlPB8NNYXUz2@mail.gmail.com>
To: public-xg-socialweb@w3.org
There is an interesting debate going on in the openid-specs mailing
list, regarding future paths for "OpenID" (as brand, and as
technology), including its relationship with OAuth. See below for a
sampler, and some perspective on what those looking to OpenID are
hoping to get from it.


---------- Forwarded message ----------
From: Brian Kissel <bkissel@janrain.com>
Date: Tue, May 25, 2010 at 7:04 AM
Subject: RE: [OpenID board] Why Connect?
To: Eran Hammer-Lahav <eran@hueniverse.com>, Dick Hardt
<dick.hardt@gmail.com>, Nat Sakimura <sakimura@gmail.com>
Cc: openid-specs@lists.openid.net, Joseph Smarr <jsmarr@google.com>,
Robert Harles <rharles@searshc.com>, "OpenID Board (public)"
<board@lists.openid.net>, Daniel Jacobson <DJacobson@npr.org>,

I won't purport to know the answer to some of the tough questions
we're wrestling with here, but do agree with Eran that whatever we do
should be "market driven."  To that end, what I'd really like to hear
is from existing and prospective RPs who are following this list.
We’ve had plenty of input from OPs and technologists.  If we don't
have enough input from RPs on this list, how do we get it?  I’ve seen
a post or two on this thread recently saying that we’ve evolved beyond
the point where a few folks can say “we know what’s best for the
market” and others will follow.  I agree with that sentiment, we need
broader involvement and feedback, not necessarily on the
specifications, but on the MRDs and PRDs that should be the precursors
to our specifications work.

I spoke with Daniel Jacobson of NPR today who is the chairman of the
Adoption Committee, and a prospective RP, and asked him to provide his
input to this discussion – which he will be doing shortly.  I've also
asked Rob Harles of Sears and Marc Frons of the NY Times, both OIDF
board members, to provide input. At Janrain we're talking to existing
and prospective RPs every day.  While each have some unique
requirements, many have similar objectives and concerns.  Here's my
take so far, but would really like to hear from other existing and
prospective RPs across a range of applications: social web,
enterprise, ecommerce, government, news & media, etc.

·         They want something that is backward and forward compatible
if possible.  Ripping and replacing core technologies is painful.  If
we’re going to make changes that break backwards compatibility (which
it sounds like both OpenID V.Next and OpenID Connect have the
potential of doing), let’s make sure that the new platform is
extensible enough to support future expected use cases and expanded
functionality – richer industry/application specific data, security
enhancements, commerce enhancements, reputation management, multiple
platforms (PC, mobile, game consoles, etc.)  If we do end up having to
break backward compatibility, let’s make sure we have a clear and
consistent migration path that’s as seamless as possible for existing
RPs.  This doesn’t mean that the baseline lowest common denominator
platform should be complex and difficult to deploy (to the contrary),
but it should support extensions and enhancements that enable broader
used cases than the lowest common denominator.

·         They want a clear message on how all the related
technologies can and should work together: OpenID, OAuth, SREG, AX,
Portable Contacts, Activity Streams, Open Social, Artifact Binding,
Contract Exchange, Discovery, UX Extension, etc. – both functionality
and timing (roadmap).

·         They want something that is easy to deploy and maintain, and
intuitive and compelling for end users.  They can accept that for
advanced features, additional effort and complexity will likely be

·         They would like to see OPs behave in a consistent and
predictable way as they evolve and enhance their services.  If OPs
behave erratically and without clear and timely communications, it’s
harder to buy into the ecosystem.

I hope I’ve accurately captured some of the feedback we’ve been
hearing and if not I trust that the RPs that are monitoring this list
will provide their feedback and recommendations.

I’d encourage each of us who is monitoring this list to invite more
RPs (existing and prospective) to the discussion.




Brian Kissel

CEO - JanRain, Inc.


Mobile: 503.342.2668 | Fax: 503.296.5502

519 SW 3rd Ave. Suite 600  Portland, OR 97204

Increase registrations, engage users, and grow your brand with RPX.
Learn more at www.rpxnow.com

-----Original Message-----
From: openid-specs-bounces@lists.openid.net
[mailto:openid-specs-bounces@lists.openid.net] On Behalf Of Eran
Sent: Monday, May 24, 2010 7:01 PM
To: Dick Hardt
Cc: Joseph Smarr; OpenID Board (public); openid-specs@lists.openid.net
Subject: RE: [OpenID board] Why Connect?

> -----Original Message-----

> From: Dick Hardt [mailto:dick.hardt@gmail.com]

> Sent: Monday, May 24, 2010 6:20 PM

> To: Eran Hammer-Lahav

> Cc: Allen Tom; David Recordon; Joseph Smarr; OpenID Board (public);

> openid-specs@lists.openid.net

> Subject: Re: [OpenID board] Why Connect?



> On 2010-05-24, at 6:08 PM, Eran Hammer-Lahav wrote:


> > The question is:

> >

> > Is the OIDF interested in taking the lead in building an identity layer for

> OAuth 2.0?

> >

> > I'm willing to bet that if the answer is no, it will be the beginning of the end

> for OpenID. OAuth 2.0 + identity will fully cover the OpenID 2.0 use cases in a

> cleaner, more secure way.


> OpenID Connect as currently envisioned misses many of the internet identity

> use cases.

And covers most of the ones desired by those currently implementing
OpenID. For those using OpenID 2.0 today, this proposal offers a full
and significantly better replacement. This proposal is 100%
market-driven, which is not something I can say about OpenID now or in
the past. This proposal is driven by developers, providers, and end

> >

> > This is very much an issue of timing. If the problem is the name, call it the

> "OAuth Identity Framework",


> OpenID Connect has very little to do with OpenID, and lots to do with OAuth.

> That sounds like a better name.

True if you define OpenID as nothing but a protocol. But if that is
your definition, I think OpenID best days are behind it. People don't
care about protocols, they care about products. I think it would be a
mistake for the OpenID foundation to let OAuth take over such a huge
chunk of the current OpenID use cases.

> > leaving OpenID to be whatever the v.next WG decides it will be a year or

> two from now.


> That sounds like a challenge I am will to take on. :)

Well, that's something the foundation will have to figure out. All I
can do is offer my perspective.



specs mailing list



specs mailing list
Received on Tuesday, 25 May 2010 09:12:04 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 20:22:09 UTC