December 01, 2008

Facebook Connect and the Attraction of Web SSO

Joseph Bachana
  • Linkedin
  • Twitter

Here is an article on TechCrunch that caught my attention today. The article presents how MySpace and Facebook are offering integrated login services to other third-party social network applications like Twitter, Stumbleupon, socialmedian.com, digg.com and the like.

At the end of the day this is about single sign on (SSO), which is always beneficial. However, the login and password pair should be treated as sacrosanct -- in essence, by some trusted organization whose mandate is at its core to protect core personal data that may travel along with the login/password.

Nowhere can anyone demonstrate to me that either MySpace or Facebook have the core mandate to protect user privacy. In fact, their growing business models may actually prove antithetical to the users core privacy, since these social networks (and others) will continue to build revenues around 3rd party organizations that want access to the networks' user base.

The secondary elephant-in-the-room issue is that social networks may or may not have robust enough security models to even allow for secured and protected data. Any system that allows a user to create a profile with a pets or kid's name as a password is not, in my mind, a secure enough platform. Since both Facebook and MySpace have been hacked frequently enough over the past year alone, I think this is still cause of concern that tens of millions of people may not be adequately aware of as they post personal contact information and pictures of their children as well as connect with people they think they know but who may be Internet predators.

I'm not trying to be the harbinger of gloom and doom here, since I enjoy these and many other social networking platforms. I just think the larger concern with Facebook connect and the like is that people may be making assumptions about how their private data is being protected, when it may not be. I'd love to hear your feedback on this matter.

Posted at 05:55 pm by Joseph Bachana

I think the eventual winner of the SSO wars will be Google. They have done it organically by starting with Gmail (a password everyone who appreciates their privacy keeps pretty safe) and integrating all the other services (Reader, Picasa etc.) directly into the model. In fact, within the Google family of sites, YouTube's weak integration is very jarring. I would never trust a social networking site to be the provider/maintainer of my SSO for "important stuff", but for things like Digg.com and Twitter (at best ephemera) I could see being happy if they shared a cookie so I wouldn't have to remember a password for them.

More Blogs From Author:

Request a Consultation

Testimonials

”The DPCI team understood the challenges of the project and delivered exceptional results.  We look forward to working with them on other projects in the future.“

- Michael Mainiero, Director of Web Services, New York University Medical Center