{"id":607,"date":"2006-10-09T21:12:19","date_gmt":"2006-10-10T05:12:19","guid":{"rendered":"\/?p=607"},"modified":"2006-10-09T21:22:48","modified_gmt":"2006-10-10T05:22:48","slug":"bbauth-and-openid","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=607","title":{"rendered":"BBAuth and OpenID"},"content":{"rendered":"

From commented.org<\/a>, here's a thoughtful piece<\/a> by Verisign's Hans Granqvist on Yahoo's BBAuth:<\/p>\n

Yahoo! released its Browser-based authentication<\/a> (BBAuth) mechanism yesterday. It can be used to authenticate 3rd party webapp users to Yahoo!\u00e2\u20ac\u2122s services, for example, photo sharing, email sharing.<\/p>\n

Big deal, huh?<\/p>\n

The kicker is this though. You can use BBAuth for simple single sign-on (SSO). Most 3rd party web app developers would love to have someone deal with the username and password issues. Not storing users\u00e2\u20ac\u2122 passwords mean much less liability, much less programming, much less problem.<\/p>\n

Now Yahoo! gives you a REST-based API to do just that.<\/p>\n

It will be interesting to see how this plays out against OpenID<\/a>.They are both very similar. Granted there is some skew: OpenID is completely open, both for consumers and providers of identity.<\/p>\n

However, from my own experience, OpenID consumers (a.k.a. relying parties) seem to want only one thing, perhaps two or three:<\/p>\n