Webmonkey » F8

Facebook Adopts Open Standard for User Logins

Michael Calore — Thu, 22 Apr 2010 01:53:57 +0000

SAN FRANCISCO — As we predicted, Facebook is switching to an open standard to handle user authentication across its entire platform of connected websites and applications.

Facebook is ditching its proprietary Facebook Connect system, which lets people use their Facebook username and password to log in to other sites around the web. In its place, the company will implement OAuth 2.0, an open source (and soon to be IETF standard) protocol for user authentication.

Viewed along side the barrage of other major announcements unleashed by Facebook at its F8 developer conference here on Wednesday, the move may only seem like a minor data point. But it is one with the potential to make a broad and deeply significant impact on the social web.

Right now, users expect three choices for logging in to a site with an existing ID: Facebook Connect, Twitter or OpenID. That forces publishers to implement three separate systems — one for OpenID, one for Twitter, which uses OAuth, and one for Facebook, which uses Facebook Connect. But once OAuth 2.0 is up to speed and more sites move over to it, things get simpler for site owners.

Where there used to be three options — Facebook Connect, OAuth and OpenID — there will now only be two. And the two that are left are both open source.

There are still details involving token management, auto-registration and other bits of complex backend plumbing to be sorted out, that Wednesday’s events don’t change.

But the move towards OAuth is a step towards interoperability the social web sorely needs. Most importantly, it will be easier to build pathways connecting OAuth and OpenID, since both are fully transparent, open standards and the proprietary Facebook Connect system has been removed from the equation. The switch paves the way for further integrations between existing technologies.

During a panel discussion about OAuth on Wednesday afternoon, Facebook engineer Luke Shepard said that by adopting OAuth, he hopes Facebook will “help drive it to become such a core part of the web, all the tools will end up supporting it.”

Twitter also recently began supporting OAuth 2.0 with last week’s launch of @anywhere, its suite of social-interaction tools.

But what about OpenID? It was one of the key technologies responsible for pushing the idea of single sign-on forward, so why isn’t Facebook supporting it yet?

“Developers aren’t asking for OpenID,” Shepard said when the question was posed to the panel. “They’re explicitly asking for us to make logins simpler and easier, not for us to implement OpenID. So now we’re doing that by implementing OAuth 2.0, because it’s simple and easy. Adding OpenID on top of it would just add a layer of complexity nobody is asking for.”

OpenID is indeed very complex, and because of that, it suffers from usability problems that have kept it from being widely adopted.

“It’s very easy to do user authentication over OAuth 2.0,” Shepard said.

Panel moderator David Recordon, who develops open technologies at Facebook, asked the audience of about 60 or 70 people: “How many of you here want Facebook and Twitter to adopt OpenID?”

Five people raised their hands (I was one of them).

Another panelist, Raffi Krikorian from Twitter, quipped, “That answers your question right there.”

Krikorian did offer a ray of hope for OpenID, though, noting that browser makers may provide the missing links that solve OpenID’s complexity problem.

“Since the browser exists in between the web service and the user, it makes perfect sense for the browser to handle those identity-management tasks,” he said. “I think that would be a huge step forward for the web.”

Another panelist, Yahoo’s Allen Tom, another long-time OpenID advocate, agreed that browser makers could definitely help fix OpenID’s UI problems.

“If browsers can eliminate the confusion in the whole authorization flow around OpenID, that would be ideal.”

See Also:

Adding Facebook ‘Like’ Buttons to Your Site Is Damn Easy

Michael Calore — Wed, 21 Apr 2010 21:27:49 +0000

I want to offer a quick look inside the technology behind Facebook’s Open Graph initiative to show how easy it is to mark up your website and let Facebook users interact with it.

This is only a part of the broad Open Graph strategy the company announced at its 2010 F8 developer conference. (Read our full coverage of the keynote).

Basically, Facebook is offering up a set of widgets — it calls them Social Plug-ins — that you can drop into any web page to make that page more “Facebooky.” There’s a Like button, a Recommendations widget that shows what other pages people’s friends are reading, an Activity Stream widget that shows a simplified version of the visitor’s personal Facebook news feed, and a Facebook Bar, a toolbar site owners can float at the bottom of the screen that serves all of these things at once.

Using the Open Graph widgets, you can incorporate some of Facebook’s key social interaction features into any page on the web.

The most important Social Plug-in, and the one we’ll no doubt see the most use of, is the Like button. Put it on your page, and if a Facebook user visits your site and clicks on it, a link to your page gets added to their activity stream. Suddenly, all of their friends can see that link, click on it and be led directly to your page. When that second person arrives, the Like button is personalized for them — it shows which of their friends have already clicked it, and when they click on it, a link to your page gets added to their stream.

There are actually two versions of the Like button, one that uses an i-frame and one that uses JavaScript.

The i-frame version

For the simple i-frame version, it’s one line of code:

You can generate your own bit of i-frame code for any URL of your choosing (and tweak the parameters) using the tool at the bottom of this page on Facebook’s developer site

The content inside the i-frame is hosted by Facebook, and Facebook can detect whether the user is logged in or not using a cookie. If the person is logged in to Facebook, the stuff in the i-frame is personalized for them. It shows a list of their friends who have also liked the page. If they’re not logged in, they’ll be prompted to log in or to join.

The JavaScript version

The slightly more complicated JavaScript version of the button utilizes two other bits of Facebook technology: the XFBML fb:like tag and Facebook’s JavaScript SDK.

You get all the same personalization features as the i-frame version, so each logged in Facebook user who visits your site sees which of their friends have clicked the “Like” button, and a link to your site gets shared across their social graph. Also like the i-frame version, you can tweak the parameters however you want.

But the JavaScript version offers some extras. In the code above, you can also see there’s a show-faces flag that will show the profile pictures of your friends who have clicked on the Like button.

The JavaScript version also gives your visitors the chance to add a comment to the link when they click on the Like button.

If a user is not logged in to Facebook when they visit your site, you can authenticate them automatically using OAuth 2.0, which Facebook now supports. Full details are here.

Tag up your page

When a user Likes your page, it does more than just pass the link around. If you’re a band, or you run a site for a movie, you can add some semantic markup to your page that tells Facebook the type of thing your page represents. That way, if I go to your movie page and “Like” your movie, Facebook can easily add a link to your movie’s website in my profile. If I keep a list of my favorite movies in my Facebook profile, a link to your public website will be added there, where it belongs.

This part is optional, but it’s recommended. Just add some Open Graph meta tags to your page so Facebook knows what you are. There are four that are required, the rest are gravy. You can claim your entity’s identity by picking the most relevant content type. The list is long — musician, sports team, blog, drink, hotel, movie, book, city, cause — so whatever your page represents, Facebook can understand it and deal with the link properly when somebody clicks your Like button.

Get used to it

Like buttons are a step up from the other sharing buttons that have been on the web for years. Unlike those for Digg and Twitter, which just display a blind count of aggregate clicks from everyone on the social network, the Facebook Like button shows you how your friends are interacting with the page you’re on.

We can certainly expect other social networks to pick up on this model and start serving up lists of your friends, and maybe even their faces, along side their own social widgets.

As if the number of icons and little doo-dads at the bottom of blog posts wasn’t distracting enough…

See Also:

Facebook Shows Off New Tools to Socialize the Entire Web

Facebook Shows Off New Tools to Socialize the Entire Web

Michael Calore — Wed, 21 Apr 2010 18:07:19 +0000

SAN FRANCISCO, California — Facebook is launching a new suite of tools that bring the Facebook social experience to any site on the web.

The company is releasing a set of products called Social Plugins, which any web publishers can drop into their website using one very simple line of code. These plug-ins will let visitors “Like” news stories, photos and so on. Once a user likes something, it instantly gets added to the appropriate section of their Facebook profile.

The plug-ins are part of a new Facebook initiative to make every website on the internet sharable across its network, something the company is calling the Open Graph.

The announcements were made by Facebook CEO Mark Zuckerberg and platform engineer Brett Taylor at the company’s F8 developer’s conference taking place here Wednesday.

Facebook will roll out the Like buttons Wednesday morning, and Zuckerberg boldly estimates that within 24 hours, there will be one billion Like buttons across the web.

Facebook has often been branded as the next AOL, a website that basically recreates several experiences available on the open web — chat, e-mail and link sharing — behind a closed gate. But with Wednesday’s Open Graph announcements, the company is giving website owners a bigger door into Facebook’s closed system using simple HTML tools and by incorporating open standards into its authentication system.

Zuckerberg, speaking with his trademark brand of stiff, awkward enthusiasm, calls the new Open Graph initiative “the most transformative thing we’ve ever done for the web.”

A grand platitude, certainly, but one of the most transformative shifts in Facebook’s policies, as it enables sites to more easily link up their content on the open web with the Facebook ecosystem and access its 400 million active users.

“With these tools, any web page can become a Facebook page,” Taylor says. “If you don’t like the way Facebook pages look, just make your own. Add the Like buttons and the Open Graph elements and you’ve got a page that’s fully integrated into Facebook.”

Central to the experience is the Like button. Websites can add them by dropping in an i-frame, and when a Facebook user clicks on it, it’s the same as them clicking on a Like button inside Facebook. Facebook knows who the person is, because it can now see a user’s logged-in state via a cookie.

There’s also a Recommendations plug-in, which shows you a curated list of content on the site you’re visiting that you might be interested in.

It’s not just a blind list of the 10 most-read or most-e-mailed articles on the site, Taylor explained, but a socially curated list based on what you are interested in.

Third is an Activity Stream plug-in, which shows you what your friends are up to and Liking around the web.

The new social plug-ins offer instant personalization to any website, Zuckerberg says. “You can have a user who’s never been to your site before and present them with a totally personalized experience.”

The final widget is a Facebook Bar, a toolbar website publishers can float at the bottom of their site’s user interface (again with an i-frame) to make these sharing features more visible. It also has elements that let users send Facebook mails or hold chat sessions.

To handle user authentication across all of these pieces on the web, Facebook is adopting the OAuth 2.0 standard — an open-source industry standard that’s already being used by Twitter and other social networks. We expected something like this and predicted it in our pre-conference coverage.

During a press conference after the keynote, Zuckerberg and Taylor said that Facebook will be ditching the Facebook Connect brand. Connect will be replaced by OAuth 2.0, and all authentication will be handled by the various Open Graph tools, which utilize the standard.

“It’s an industry standard and it’s super easy,” Taylor said of OAuth, “You can implement it in about five minutes, as opposed to five days for our old authentication system.”

Facebook is also giving websites a new way to identify themselves using semantic HTML. The new markup tells Facebook what type of real-world object your site represents. So, if you run a band website, you can add semantic HTML tags that tell Facebook a bit about the band: we are called Throbbing Monkeys and we are from San Francisco. So, when a Facebook user clicks on the Like button embedded on your page, the band gets added to the “Music” section of their profile.

Best of all, the link that appears on the user’s Facebook profile will lead directly to the website where the Like button was clicked — a first.

“For the first time, the Likes and Favorites on my profile page are linked to sites off of Facebook.com,” Bret Taylor said. He earned a round of applause.

Finally, Faceboook is also dropping the policy that forbids outside applications from holding on to user data for more than 24 hours. This was a controversial policy to begin with, since it prevented developers from making anything (like an RSS reader or a photo-browsing app) that let the user keep things like status updates any longer than a day.

“This is just a technical restriction that we’re lifting,” Taylor says. “It doesn’t change any of the rules around what you can and can’t do with the user data.”

Facebook is offering real-time user action updates as part of the new Graph API, which makes it easier for developers to consume user’s activity streams.

Brett Taylor, who walked through the real-time features of the Graph API is part of the team that built FriendFeed, which Facebook aquired last year. Taylor says there aren’t any plans to develop FriendFeed any further, but that Facebook will keep it alive.

UPDATED at 2:30pm PDT to include details about OAuth and Facebook Connect.

See Also:

Facebook Tags Everyone at F8 with RFID Chips

Michael Calore — Wed, 21 Apr 2010 16:41:59 +0000

Meet your friendly Facebook RFID tag.

Here at Facebook’s F8 developer’s conference, each attendee has a small plastic token attached to their badge. Inside the token is an RFID chip. On the back, there’s a ten-character unique ID code. We’ve all been instructed to go to facebook.com/presence and enter our personal code to activate it.

Once your token number is linked to your Facebook account, you can walk around to each of several readers set up around the venue here. There’s an RFID chip inside this little blue piece of plastic, and at each reader, that chip gets scanned and some sort of post goes up on your Facebook profile’s Wall.

There’s a photo booth — scan your chip and it snaps a photo of you and uploads it to your account. There are gaming lounges, and you can become a fan of whatever company or game is sponsoring that lounge by tapping your chip against the reader.

It’s possible there’s some tie-in to a larger presence-sharing announcement coming later on at the conference. Or, it could just be something born from a keg-fueled discussion by some engineers, as the Presence site on Facebook says.

Either way, as soon as it was explained to me what this little blue dongle was doing hanging off of my badge, my first thought was, “It begins…”

Up Next For Facebook: Expect More Open Interactions

Michael Calore — Tue, 20 Apr 2010 19:57:03 +0000

Facebook essentially copies a bunch of services that are already available on the open internet — chat, e-mail, media sharing, profiles — for its 400 million active users. But it also provides tools to help those users interact with each other while they’re outside Facebook’s walls, and there are signs the company is ready to make those tools more open and more easily integrated into other websites and applications.

The social network has already seen great success with Facebook Connect, its authentication system other websites can use to let their visitors log in using their Facebook username and password, then leave comments or share items with their Facebook friends with a single click. They can also hop around between websites and apps without creating a new account at each stop.

Facebook Connect has certainly fueled the explosive growth of social interaction across hardware and software platforms, as it helps Facebook friends notify each other of their activities on other social websites, the movies they’re renting, or the high score they just got on their favorite iPhone game.

Facebook Connect was first announced in 2008 at F8, Facebook’s developer conference. The next F8 is taking place Wednesday in San Francisco, and Facebook CEO Mark Zuckerberg is expected to announce the next phase of his company’s plans to further extend its sharing platform during his keynote address.

The Facebook Connect system isn’t entirely open — a key reason for its existence is to feed social sharing traffic back into Facebook. But it has much in common with other emerging open standards like OpenID and OAuth. Most social websites use a mix of both Facebook and non-Facebook options to handle user authentication, and Facebook Connect is not fully interoperable with competing technologies.

But several recent events point to Facebook making its own platform work better with open technologies. Last year, the company joined the OpenID Foundation and it began partially supporting the technology by allowing users to log in to Facebook using OpenID credentials. Also last year, the company hired David Recordon, one of the key architects of OpenID and OAuth, and purchased FriendFeed, a website that aggregates people’s social activities. Soon after acquiring FriendFeed, Facebook released its Tornado sharing framework under an open-source license.

Facebook wouldn’t comment on any upcoming announcements when contacted for this story. However, outside developers remain hopeful that the company will continue to grow its sharing platform by making it work in tandem with other open technologies already in place.

Igor Pusenjak has incorporated Facebook Connect into Doodle Jump, the popular mobile game he co-created. Doodle Jump, which has over 3 million users on the iPhone and Android, uses Facebook Connect to allow players to share their high scores with their friends on Facebook. Pusenjak will be speaking on a panel at F8 called “Mobile + Social: Connecting the Dots.”

Pusenjak welcomes the possibility that Facebook could be moving towards open standards for user authentication like OAuth and OpenID by making them work better with Facebook Connect.

“Anything that can help reduce a number of passwords that need to be remembered and info that needs to be typed will both help the end users and small business,” he says in an e-mail. “Many people today are reluctant to create yet another account just to make one purchase.”

As if expecting such a development, the web-based chat site Meebo debuted its own entry into simplified authentication and sharing on Monday. It’s called XAuth, and it allows users to share links with their friends on some pretty large and powerful networks — Google, Microsoft, Yahoo and MySpace were part of the initial launch.

While Meebo says XAuth will eventually be released under an open source license, there are currently several unanswered questions about its design and its privacy implications that may hold it back.

As far as what else to expect from F8, there’s been some speculation that Facebook will provide its users with tools to better share their location. We noted this in March. Others may be anticipating this announcement, too — Google revamped its location-based search and advertising products Tuesday, and Twitter launched a new location-aware feature called “Places of Interest” at its Chirp developer’s conference last week. Both of these rely on users’ location data.

Twitter is actually an exemplar of how open standards can succeed in social sharing. The “Tweet This” buttons currently littering the web use OAuth to let people connect their Twitter accounts to whatever website or app they are using. Also launched at Chirp is @anywhere, a system web publishers can incorporate into their sites to make it easier for readers tweet and add followers directly from a website’s pages. It also uses OAuth.

Raffi Krikorian, the tech lead on the Twitter API team, says his company is active in developing the OpenID and OAuth 2.0 specifications. He thinks the broader adoption of open standards on the social web lead to better interaction between websites and third-party apps.

“We [at Twitter] want to make things more open, and more standard,” he says in an e-mail. “We want to make it easy for application developers to talk to us, and if that has a side effect of talking well with others, then that’s awesome.”

Krikorian is appearing on a panel at F8 that’s billed as a “Fireside chat about open technologies” on the social web. Also appearing on the panel are Allen Tom from Yahoo and Luke Shepard, Naitik Shah and David Recordon from Facebook.

Facebook’s F8 takes place Wednesday in San Francisco. Webmonkey will be at the show bringing you breaking news from Facebook and reactions from developers. Follow us on Twitter, become a fan on Facebook and subscribe to our Events category for real-time coverage.

See Also: