Yahoo To Open Up Email Authentication

Aditi.Tuteja writes, "Yahoo has announced it will give away the browser-based authentication used in its email service, considered to be the company's 'crown jewels.' Yahoo made the announcement ahead of a 24-hour 'Yahoo Hack Day,' where it had invited more than 500 mostly youthful outside programmers to build new applications using Yahoo services. Considering the different needs of its huge user base (257 million people use Yahoo Mail), Yahoo has decided it can't build or buy enough innovation, so they are enlisting the worldwide developer community." The code will be released late in 2006. Yahoo notes that there are 'no security risks' since they keep absolute control of usernames and passwords.

Comments

Good for Yahoo

[lewp]

In their struggle to maintain relevance in the face of Google, Yahoo has really done a complete 180 from the days when their main service was a manually-reviewed index of websites. They've had the good sense to keep their noses out of (e.g. Flickr), and they've made some cool products/technologies available to the developer community for free.

Google gets all the press nowadays, but Yahoo's been pretty cool lately as well. Props!

OpenID ?

[johnjones]

could they not just conform to a standard ?

regards

John Jones

Re:OpenID ?

[Frosty Piss]

could they not just conform to a standard?

They do conform to a standard, just not the standard you're talking about.

jewlery

[macadamia_harold]

Yahoo has announced it will give away the browser-based authentication used in its email service, considered to be the company's 'crown jewels.'

If that's one of their 'crown jewels', would their hosting service be considered the "family jewels"?

'No security risk'

[SeaFox]

Yahoo notes that there are 'no security risks' since they keep absolute control of usernames and passwords.

Why does the phrase "famous last words" come to me when I hear that. I can almost imagine it being spoken by Hammond in Jurrasic Park when he's talking about how safe the attractions are and that it's impossible for the dinosaurs to breed.

I forsee an explot being developed or maybe someone will just write a new "service" that makes use of Yahoo's systems that also happens to pass the username/pass to a more nafarious author.

Remember, the tool is only as safe as the operator. AOL's search didn't even ask for people to enter their Social Security Numbers.

Re:Yahoo for yahoo.

[Anonymous Coward]

Hiring the world to do thier work. BRILLIANT!

I really wish people wouldn't do this crap. It's not Mom and Pop's Search Engine Co. It's frigging Yahoo. If you want programmers, pay some damn programmers.

DARPA Grand Challenge, sure. Nobody's getting your crap for free when you're done. GPL, sure. They only get it if they give back. But stupid competitions like this just feed cash into the already-cash-filled pockets of corporations. Not that corporations making money is a bad thing, but we don't need to hand them more for driving down programmer wages.

It's part of a trend

[joeflies]

Microsoft's tried to own identity by offering 3rd party authentication through Passport, and now shifted towards IDCard/LiveID. Google has already opened up their authentication

Ultimately this comes down to who are users going to flock to as their primary id on the internet - and thus users will use it to log into 3rd party applications which lie outside of microsoft/google/yahoo. The bigger question, though, is how come these companies are going to "own" your id instead of federate it.

BTW, Yahoo has offered authentication services through other apps back in March.

Re:But Yahoo email login work with FF passwords?

[closetphilosopher]

I don't know about Yahoo, but for other websites that prevent password saving, use the bookmarklet at http://www.squarefree.com/bookmarklets/forms.html to change the form parameters before you submit it.

Insanely brilliant

[dedazo]

Think about this - you can now integrate a full-blown email client into your application (CMS, corporate, portals, etc) by simply writing around what will probably be a thin WS/RPC wrapper. Branding can't be far behind, and Yahoo will probably use the insertion of (hopefully) unobtrusive ads to finance it. Higher-level customers can probably do much more, including getting rid of ads. Maybe the service will even work with other domains. Now John Coder can offer a real email client in his app with minimal effort.

It remains to be seen if they can pull this off, but it's nice to see this type of innovation and broad steps coming from somewhere other than Google. I like Google, but they need the competition or they'll start to stagnate. Competition is good!

Re:Crown jewels?

[Schlemphfer]

>Come on Yahoo...is that authentication code really a crown jewel?

The code isn't the crown jewel. What's of enormous value is the database of 250 million established Yahoo ID's.

Suppose I want to open my blog up to comments. These days, I'd be nuts to allow non-account-holders to post, since I would be overwhelmed with comment spam. How many of my users will be willing to register a brand new username and password with my site's custom code? But if you've already got a Yahoo ID, that's all you'll need to go right ahead and post on my blog. See? The barriers to participating on my site have dropped almost to nothing, all because of Yahoo's pre-existing database of 250 million users.

This is a win all the way around. It's a win for Yahoo, since it makes it more valuable for people to own a Yahoo ID. It's a win for me, since I don't need to generate custom code and maintain a database for user passwords. And it's a win for my users, who can now comment on my blog with little or no hassle.

The losers? Sites like typekey.com, who were created to offer the same feature that Yahoo is about to offer, but who don't have the crown jewel of 250 million user accounts.

(Obligatory)

[stuuf]

The great thing about standards is that there are so many to choose from...