« August 2005 | Main | November 2005 »

October 29, 2005

On SSO & Online Identity Management

Look around you. Look at the current state of the web. Look at Web 2.0. Look at social networks, online dating, classifieds, newspapers, etc . Every day a new site pops up promising to be the NextBigThang. Think about the acronym YASN. Why do people get frustrated after a while? Think about Orkut and Friendster. Remember when Friendster came out and it was the NextBigThang? After a while, Orkut popped up on the scene and some people flocked, while some scoffed and said, "why the hell would I go to the trouble of building a profile again, entering in all this personal information, etc. Did the adoption rate of Orkut suffer because of this fact? I think it's staying power did. Then came facebook, myspace, and many many more. Take a look at my facebook profile, it's probably out of date. Take a look at my match.com profile, it's probably out of date. Take a look at my AustinFilmFestival.net profile, the fest was just last week, but it's probably out of date. Contrast this with something like Yahoo! where you can move from service to service extremely easily since your personally relevant information is already persisted with Yahoo!.

Each one of these services has two flaws

1: You are required to create an account (username and password)
I forget usernames and passwords. If my usual username is taken on a site, I'm stuck using a one off. If a certain site has more stringent password requirements, my one password is useless and I need a one off. Until I embraced the "save this information in your browser" functionality, my method of logging into certain sites involved using the "forgot your username or password" link. EVERY TIME. Sometimes the username is your email address, sometimes its not. Sometimes your password has to be a maximum of 6 characters, sometimes it has to be 10 with numbers and capitals.

2: You are required to persist some sort of personally relevant information
Presumably, the personally relevant information that enables a rich experience on one site overlaps with what creates a rich experience on another site. This personally relevant information is the stuff that makes you you. It's your identity! So this begs the question: Why is your online "identity" decoupled from YOU, and replicated in so many different places?

Let's take the most basic example. If on Tuesday I pick up and move from Austin to San Francisco, why do I have to log in to 39 different web sites/services just to let people know? What happens when I

The solution to problem 1 is Single Sign On (SSO). SSO isn't a new idea. Remember passport? I believe that failed for the following reasons:
1: Passport was build by Microsoft. Many people don't trust Microsoft.
2: Passport charges websites lots of money to join their network.
3: Passport originally wanted to store your credit card information.
4: Passport solved problem #1, but didn't address #2.
5: Passport was tied into your 2 megabyte hotmail spam trap email address that you stopped using 6 months ago.

To solve problems 1 and 2, I propose the following. An online identity management network that is free to sites that want to use it and has some sort of structured way of representing data. When you create an account, you can enter as much personally relevant information as you like, which will then be stored online. Then you go over to friendster and decide to sign up. You then "log in" with your credentials and begin the registration process. Friendster then displays the list of personally relevant information that it would like to pull from your profile. Next to each item is a checkbox that allows you to autorize the release of that personally relevant information to Friendster. They know only what you want them to know. That's it. (Assume for now that when Friendster signs up with , they define a list of what sort of information they are interested in, and that is manually matched up to the profile schema. If a data category is requested that isn't represented in the schema, it is added.) Say your profile is empty. As you enter information into Friendster, it will sync back with your profile. Next, you sign up with MySpace. When you log in with your credentials, your info from Friendster is now available to be put into your MySpace profile. Now when I move, I can change either my Myspace profile, Friendster profile, or my profile, and the change will be persisted across all accounts.

The biz model
Often a web property is judged by its userbase or the "eyeballs" that they bring to the table. One of the major ways that MySpace/Friendster/Match makes money is by targeted marketing to their user base. is a free service to these sites, but you can sell access to the users (assuming the user has opted in to receiving offers from that partner). Then has built a huge network of "eyeballs" that can be valuable in many other ways.

The value prop to a web service/site/property
This isn't for the MySpace/Friendsters of the world. This is for the new, smaller challengers that can benefit from lower barriers to user adoption (not having to enter in as much information). Essentially what does is reduce their adoption/attrition risk. If I know that I don't have to retype all my info, I'll be more likely to join your community. If I know that I don't have to keep my profile current and up to date, I'll be more likely to continue to participate in your community.

The risks
Google Accounts. Yahoo!. Big players play in this world, but I don't think any of them are thinking about it from this angle.

Growth
One word: presence. You've got friends, your friends want to contact you. For example, I've got a cell/voip/work phone, 4-5 IM accounts, 6 email addresses, 3 snail mail addresses, and more. When you want to contact me, how do you decide whether to send me a text message, leave me a voicemail at work, ping my work email address, send a letter to my PO box, or dispatch a carrier pigeon my way? The network would know what services you're currently using, and allow your buddies to determine the best way to contact you. You shouldn't have to have my entire schedule and contact list memorized, let the network do the work for you.