Yahoo! OpenID and OAuth 1 Allen Tom Yahoo! Membership Architect OpenID Foundation Board

OpenID – Authentication OAuth – Authorization OAuth-WRAP – next generation OAuth 2

Yahoo! and the Open Web Yahoo! OS: Initiative to open up Yahoos services to 3 rd party developers and partners OpenID: Opens Yahoos Membership platform to all websites – Users who have a Yahoo Account can log in with it at any website that accepts OpenID OAuth: Authorization protocol (access control) for Yahoo Data and APIs – Contacts (Address Book) – Yahoo Mail – Yahoo! Updates (Activity Streams) 3

Yahoo OpenID + OAuth 4 Yahoo users can sign into websites using their Yahoo ID via the OpenID Protocol Users can authorize data access via Oauth Share your Yahoo Address Book Let the 3 rd party update your Status Upload photos

Authentication, continued… My YahooID is My OpenID identifier is OpenID lets me prove that I control 5

Yahoo OpenID Example Login to the HuffingtonPost.com using your Yahoo ID 6

7 Click Log In

8 Click the Yahoo! Button

9 Login screen is bypassed if the user is already logged into Yahoo (more then 90% of the time) Login screen is bypassed if the user is already logged into Yahoo (more then 90% of the time)

10 OpenID: Authentication Name Address Profile Picture OpenID: Authentication Name Address Profile Picture OAuth: API access to Web Services

11 Yahoo ID Yahoo Profile Picture

12 Huffington Post can post to my Profile using OAuth

Attribute Exchange RPs may optionally ask for user data via the Attribute Exchange Extension (supported by all major OpenID Providers) – Name – Address – Profile Picture – Age – Gender – Location 13

14

Why is Yahoo supporting OpenID? Have a stronger relationship with our users – Users are Yahoos #1 asset Yahoo IDs are more valuable – used for logging into Yahoo and other websites More insights into user behavior on Yahoo and everywhere else – Needed for ad targeting and content personalization Open Standard: – No need to invent yet another auth protocol – Can leverage industry best practices – Open Source libraries, documentation – Developers can implement the same interface across all Ops Yahoo/Google/AOL are almost completely interoperable 15

Why should sites accept OpenID? New user on boarding experience is getting increasingly difficult – Username/password – Name/ address – Profile Picture – Location – Gender – Friends – CAPTCHA Security, Abuse, Account Recovery can be outsourced to the OpenID Provider Virtuous Cycle – user engagement drives referral traffic back to the RP New users already have a reputation – Abuse, expertise, etc Content and Ads can be personalized and relevant even on the first visit 16

17 Allen Tom – OAuth – OAuth-WRAP-WG