If you’ve had the misfortune to use MSN Messager, Hotmail or Microsoft’s MSDN services, you’ll be familiar with their centralised authentication system – Passport. Although I’ve signed up for a couple of Passport accounts professionally in my time at one job or another – I’ve always kept away from it on a personal basis. I’ve signed up in order to get a Messenger account, but used a throw-away email address and gave no other personal information. The simple reason is that I don’t trust Microsoft with the information, and in particular the context in which a centralised system holds that data. Not due to any general anti-Microsoft feeling, but simply because their track record isn’t good with keeping such data safe, and I also question their motives in holding it. I’m not going to rant on about it, but suffice to say I’ve made the personal choice not to make great use of that particular ‘service’.
So when I heard about Six Apart’s new centralised authentication system TypeKey I was a little skeptical. Six Apart are pitching the service as a method of battling comment spam, flooding and so on. The idea as I understand it (and to be fair, only marketing information exists so far) is that to post a comment on a TypeKey enabled blog, the user must have a TypeKey account/identity. If they already have one, the posting a comment is super-easy as the blog can fetch the user’s details automagically. Very convenient if you’re already signed up – and a pain the arse if you’re not. Still it would, in theory, cut down on spam. TypeKey will be integrated into the forthcoming version of MovableType, with APIs available shortly afterwards for developers to integrate the service with their own apps.
However, just as with Microsoft Passport, you have to question what’s happening with the data. Six Apart use carefully selected language to focus the security debate around that of keeping email addresses secure and not sending spam. This is far from being the issue – as you have to keep in mind the fact the Six Apart will potentially have the capability to track your movements around the web, with each TypeKey site you hit phoning home and logging your presence. I’m not one to get paranoid about this sort of thing from a privacy point of view, however, the data Six Apart could collect would be commercially extremely valuable and here we are handing it over for free. I don’t object to being spied on for giggles, but I object to people profiting from selling data about me without asking me first.
Of course, there are issues with a centralised service should that service become unavailable through attack, mismanagement or just bad luck. See Dean’s thoughts on this issue.
For me, I’d like to ask Six Apart the following
- If you’re going to collect and use data for any other purposes than system maintenance, be explicit in stating that use and its purpose. Let the user opt-in with full knowledge of the implications.
- If you’re not going to use the data for purposes other than system maintenance, please roughly outline how this service is maintained financially, and how it can be sustained. (will it be around in 12 months?)
- If you’re not going to use the data for purposes other than system maintenance, please outline the technical factors which are limiting you doing this.
A system like this could be excellent, but could also be a complete disaster. To be centralised, the system will have to prove itself to be trustworthy both technically and ethically. I worry that Six Apart are being a little presumptuous in respect of that trust.
Comments
One of Mark’s points is that Six Apart are a company trying to make a buck, and that this is their right. Of course it is – but if it’s a free service that costs them real money to run, where are they making that buck? If they’re not going to sell data, then they should have no problems stating that that is the case.
And if they’re all above board, good luck to them. As I’ve stated, this could be an excellent system. (and very useful too).
Oh Christ. Not everything a company does must produce a direct and measurable ROI. Obviously, TypePad and other MT 3.0 features give site owners more control over their own sites. That enhances the attraction of the platform and keeps it viable which helps SixApart in the end.
Make sense?
Add to that the marketing needed to actually get people to trust Six Apart, and the possible devastating effect this could have on their business. For me, that’d be too large a gamble to take for only indirect ROI.
See where I’m coming from?
This isn’t to say that I’m against the scheme – just questioning it. Due diligence.
Drew wants SixApart to clear some murky areas, shed some light on it. The privacy concerns that Drew raises should be cleared by any company that handles user data be it the well intentioned SixApart or the Microsofts.
No central key-holder but you still get to log into many different sites using just one user/password combo.
Sometimes I can’t get to sleep when I’ve got a new server and I’m not sure I remembered to set the logrotate params correct or something stupid… I can’t imagine why someone would want to be responsible for such a system. Its not like Passport where the people responsible are hidden by the corp… This is a tiny corp.
“Cant we all just calm the fuck down? Its only a press release.”
And Atom is only an alpha release.
Is there really a future for this stuff? I mean if MS can’t succeed at something – who can ;)
Atom is a draft that’s out there and usable. TypeKey is just an announcement at this stage. The point is that you can only criticize TypeKey so much until people can actually use it and see how it works or fails. Lots of good ideas and good products might have looked terrible on paper. What matters is implementation.