Google and Data Portability: a two pronged approach or fork in the road?

Google announces enhancements to Google Friend Connect while also showing another way of remote login and bringing over contacts at an OpenID meeting hosted by Facebook... Confused? Me too.

Oh it used to be so simple. Google came out early as a supporter of open standards in Data Portability, turning over its various initiatives in this space, like OpenSocial, to non-profit for greater good. Facebook took an opposing view and launched Facebook Connect, enabling webmasters everywhere to add code to their sites giving Facebook users the ability to login to any site using their existing identity and of posting their activity back to Facebook. Google answered with its own equivalent, Google Friend Connect. People everywhere debated which was better and came out declaring which camp was getting their support support (by the way, although Facebook Connect is more functional, Google Friend Connect one it on open standards support).

Fast forward six months and things look different. Facebook Connect and Google Friend Connect still exist (and get enhancements, see below), but Facebook has since joined the OpenID crowd -- although it is yet to make FBC OpenID compliant. Weirder still, Google, seemingly having won over its main rival in the space to its way of thinking, now seems to be promoting two alternatives to cracking the same nut.

First off, Google Friend Connect hasn't gained much traction since it was announced last year, mainly because it doesn't do much. Yes, people can log into your site using their Google identity (as used for GMail, Adwords etc.) but the GFC elements are really standalone on a site, with no integration with any existing user identities you may have. In other words, if you already get people to log in then they now do it twice. And you don't get any of the credentials that go with the identity, as they are only ever really logging into GFC, albeit on your site. Mainly to comment and add ratings. Pretty lame stuff compared to a more functional and useful Facebook Connect.

Well Google is attempting to make GFC even more enticing for website owners by enabling the addition of a "Social Bar", which can appear at the top or bottom or your site's pages, providing the login, commenting and ratings capabilities within it. It can be deployed on single web pages or across the whole site. Its aim is to make GFC's features easier to apply across a site without being too intrusive. I've taken a look and it seems to do that job well, although it doesn't add any new features to the capability set (more info here: http://googlesocialweb.blogspot.com/2009/02/social-bar-for-your-site.html). Although we have GFC support on my our own WeCanDo.BIZ website, we won't be adding the Social Bar as I don't wish it to be that intrusive -- we have our own login which takes presendence as it has more functionality behind it. I can see how the GFC Social Bar would work for sites without any user accounts on it currently, however -- it's a quick and easy way to add social elements to a simple website.

With this initiative underway, it was perhaps surprising then that at the recent regular OpenID get together, this time hosted by Facebook, Google and social network aggregator Plaxo showed a hybrid of OpenID, OAuth and Google Contacts API which does a much better job of achieving what most people expected Google Friend Connect might offer them.

In essence the new OpenID workflow enables users of other sites -- it was Plaxo in this instance -- to login to OpenID, a portable identity they should be able to use anywhere, with just a few clicks and no need for passwords, an important advancement compared to the complex usernames and passing back and forth that has hampered OpenID's adoption to date. Further, during the authentication process, you also have the option of specifying you want to bring your Google Contacts (whatever THEY are!) over to the site to establish a relationship with them on the new site. Just what everyone has been asking for, although many would rather see the repository of user identities and contacts -- the "social graph" -- held by a trusted independent third party. More information on the hybrid here: http://www.readwriteweb.com/archives/google_plaxo_openid_oauth_usability.php.

So which of these should website owners be using to "socialise" their websites? Well, OpenID implementations available today should be avoided as they are just too complex. Facebook Connect is the only thing you can use today enabling true authentication into a sites own login using an existing identity with the ability to bring existing connections, and it's nice and simple -- but the chance it may be re-architected to support OpenID concerns me that anything you add to your site today may need replacing soon. The new way to authenticate using OpenID as shown by Google with Plaxo has great potential, although Google hasn't released the code to developers to enable the est of us to do it -- it's just a demo for now. Which means they'll continue to flog Google Friend Connect in the meantime, possibly with a limited shelf life if their plans do include releasing the much better alternative above.

My recommendation? It's likely that OpenID and OAuth will win out, but hold off for now until the main movers and shakers decide how its best done. Moving on this now will mean a short term and compromised solution when everyone else seems happy to sit and wait.

I'd love to read your own thoughts on this.

UPDATE: Just read some further articles on the OpenID User Experience summit hosted by Facebook and noted an interesting presentation by Google's Breno de Medeiros. His subject? How there needs to be a neutral 3rd party method of figuring out who users' identity providers are without asking them explicitly, something like how the DNS system works. I agree in part -- although, as posted above, most people would rather see the neutral 3rd party issuing the identities and holding the social graph. If no one can agree on that then a DNS type approach helps. This does, unfortunately, muddy the Data Portability waters further though -- and make the likelihood that we'll see a stable way forward in the short-term less likely. Keep holding off!

Ian Hendry
CEO, WeCanDo.BIZ
http://www.wecando.biz