Slashdot Mirror
Yahoo To Open Up Email Authentication
Aditi.Tuteja writes, "Yahoo has announced it will give away the browser-based authentication used in its email service, considered to be the company's 'crown jewels.' Yahoo made the announcement ahead of a 24-hour 'Yahoo Hack Day,' where it had invited more than 500 mostly youthful outside programmers to build new applications using Yahoo services. Considering the different needs of its huge user base (257 million people use Yahoo Mail), Yahoo has decided it can't build or buy enough innovation, so they are enlisting the worldwide developer community." The code will be released late in 2006. Yahoo notes that there are 'no security risks' since they keep absolute control of usernames and passwords.
In their struggle to maintain relevance in the face of Google, Yahoo has really done a complete 180 from the days when their main service was a manually-reviewed index of websites. They've had the good sense to keep their noses out of (e.g. Flickr), and they've made some cool products/technologies available to the developer community for free.
Google gets all the press nowadays, but Yahoo's been pretty cool lately as well. Props!
Game... blouses.
How many of those 257 million users are spambots?
...social websites allowing their users to customize the css templates of their profile pages. There would surely be a few good innovations but like 70% of my friends "customized profile pages", most would visually painful enough that.. arrghhh..!! *head explodes*
Does this mean that I'll be finally able to login into Yahoo email with the built-in password handling in Firefox?
If so, I'll believe it when I see it.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Geez.... their spam filters are non-existant.
could they not just conform to a standard ?
regards
John Jones
Come on Yahoo...is that authentication code really a crown jewel? I am no coder but really wonder whether that title fits what the subject is here. What if we find that most if not all of this authentication code was lifted from BSD?
Yahoo has announced it will give away the browser-based authentication used in its email service, considered to be the company's 'crown jewels.'
If that's one of their 'crown jewels', would their hosting service be considered the "family jewels"?
Push Button, Receive Bacon
Why does the phrase "famous last words" come to me when I hear that. I can almost imagine it being spoken by Hammond in Jurrasic Park when he's talking about how safe the attractions are and that it's impossible for the dinosaurs to breed.
I forsee an explot being developed or maybe someone will just write a new "service" that makes use of Yahoo's systems that also happens to pass the username/pass to a more nafarious author.
Remember, the tool is only as safe as the operator. AOL's search didn't even ask for people to enter their Social Security Numbers.
Hiring the world to do thier work. BRILLIANT!
I really wish people wouldn't do this crap. It's not Mom and Pop's Search Engine Co. It's frigging Yahoo. If you want programmers, pay some damn programmers.
DARPA Grand Challenge, sure. Nobody's getting your crap for free when you're done. GPL, sure. They only get it if they give back. But stupid competitions like this just feed cash into the already-cash-filled pockets of corporations. Not that corporations making money is a bad thing, but we don't need to hand them more for driving down programmer wages.
Ultimately this comes down to who are users going to flock to as their primary id on the internet - and thus users will use it to log into 3rd party applications which lie outside of microsoft/google/yahoo. The bigger question, though, is how come these companies are going to "own" your id instead of federate it.
BTW, Yahoo has offered authentication services through other apps back in March.
It remains to be seen if they can pull this off, but it's nice to see this type of innovation and broad steps coming from somewhere other than Google. I like Google, but they need the competition or they'll start to stagnate. Competition is good!
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
The Webmail extension for Thunderbird can access Yahoo Mail and also updates regularly. However its so easy to update extensions that I don't mind.
If you want Yahoo-->IMAP, just setup an IMAP server (or an account with a provider like Fastmail) then setup a TB rule to move the Webmail onto your IMAP server.
What happens to IT staff/ techos that make millions themselves through stock options in the late 90s?
You become lazy rich yuppies (see the yahoo ceos daughter on mtv? gawd) and your brain turns into drivel that cannot
innovate.
Go on a 4week engineering brain storm trip, no girls, no CC cards, no email to your wifes.
That will give you 5 years of engineering brillians between 10 smart people.
How hard is it to kill all the bots/fake accounts? how about killing all accounts with a prefix of 5 or more digits or AAAAA prefixes.
Suspend millions of them, and if there is no real person requesting it be turned back on its a bot, no response in 90 days, rm -rf the damn
account.
Or is yahoo claiming 250 million users, yet its only 90million real people and the rest bots?
Liberty freedom are no1, not dicks in suits.
The great thing about standards is that there are so many to choose from...
Everyone is born right-handed; only the greatest overcome it
Phishing is a BIG problem with Yahoo (and other big websites) plenty of users lose control of their Yahoo! IDs (granted they are not so bright, as seen by the average IQ of people who responded to this post).
I would hate for a phishing attack on Yahoo to make my site vulnerable. And with more and more websites popping up Yahoo! signups, it just makes it easier for someone to spoof the form on their site and gather passwords.
In the Favor of Y! they have taken good steps against phishing attempts, but it still happens a lot.
So now if i login to Yahoo, every jerk with a website can read that cookie and know who i am, right?
stuff |
It works pretty well, though I'm not all that big a fan of the process of logging in. The process goes like this:
This all seems reasonable, but I think I'd like to see the ability to set a pref so that you don't have to confirm every time. Other than that it does lower the barrier to entry for a site/service.
You have to choose the level of acccess when you register your app. When I registered the choices were (from memory):