Google OpenID 2.0

» see google.com/accounts/o8/id as it lived, on the wayback machine

~ the obituary ~

OpenID 2.0 was built on an idea that sounds strange now: your identity on the web is a URL, and you prove you own it by sending the browser to whoever hosts it. No account on the site you are signing into and no password handed over, just a redirect to a provider you already trust and a redirect back saying yes, this is them. On 29 October 2008 Google became one of those providers, and overnight the largest pool of logged-in accounts on earth was available to any site willing to speak the protocol.

Google was a provider and only ever a provider. You could use a Google account to sign in elsewhere; you could never use anything else to sign into Google. Yahoo and AOL lit up their own endpoints around the same time, and the result was the login screen everyone remembers from that era, a row of vendor buttons sitting above the ordinary email field, each one a different provider with the same promise.

The end came on a published timetable rather than in an announcement nobody saw. From 12 January 2015 Google began turning off silent re-approval for more and more users, so returning visitors got a consent screen they had not seen in years. On 23 February auto-approval went off for everyone. On 23 March the grace parameter developers had been passing to delay the pain stopped working. On 20 April 2015 the endpoint itself shut down and started serving a static error page to every request. Google's own farewell post went up the next day and put it flatly: support has ended, and clients attempting to use these services will begin to fail.

I have clicked the Google button on login screens for most of my adult working life, which means I used this protocol for years and never once saw the part that made it interesting. The URL-as-identity idea stayed in the developer layer and never reached the people typing. What reached everybody was a button, and a button does not care what is behind it.

~ the case file ~

~ the promise ~

The thing OpenID 2.0 could do that nothing since can do: delegation. You put two link tags in the HTML of your own homepage, pointing at whichever provider you were using that year, and from then on your identity was your own domain name. Switch providers and you edit the HTML; everyone who knows you as that URL still knows you as that URL.

Almost nobody did this. It required owning a domain and editing its head section, which describes maybe one web user in a thousand. For the other 999 the protocol was indistinguishable from a convenience button, which is why it could be replaced by a convenience button with nothing visibly lost.

~ the shutdown timetable ~

What makes the 2015 shutdown worth recording is how much work it pushed onto other people. Every site that had taken Google up on the offer in 2009 now had to implement a different protocol or lose a chunk of its users' ability to log in at all, and sites that stored the OpenID identifier as the primary key had to match old identifiers to new ones before the endpoint went dark. OpenStreetMap's maintainers worked through exactly that problem in the open, and Tom Hughes summarized the replacement in one line in February: it is a completely new system based on OAuth, and not really OpenID at all.

~ what came after ~

OpenID Connect, the thing Google moved everyone to, is the standard today and is in most respects better: it is a thin identity layer over OAuth 2.0, and it is what sits behind every Sign in with Google button on the modern web. It also requires you to register your application with the provider and hold credentials issued by them. In the 2008 version, any site could start speaking to any provider on the day it felt like it, without registering an application or holding anyone's key.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »