OAuth as a sign in (to Twitter) got me thinking

Eran Hammer-Lahav just posed about Twitter’s new “Sign in with Twitter” (documentation) functionality which is powered by OAuth (not Open ID).

It is quite a neat solution, you can both authenticate into a site and grant them permission for them to party on your twitter account

If you are interested in OAuth or Open ID (or the OAuth+OpenID Hybrid) read the post and check out the comments.

Someone tried this with Windows Live ID Del Auth

This reminded me of when I recently saw a customer using the Windows Live ID Delegated Authentication SDK to capture a address book, user’s profile and a static identifier for the user.

It was interesting because they chose to use DelAuth instead of Live ID Web Auth for the authentication mechanism. This meant that instead of using the unique user id (per application) the site was using the CID/LID which is a public identifier for the user (not their Live ID) – the customer had used DelAuth for something we never intended it would be used for.

Moreover, the user experience was a little funky:

• When a user lands on consent.live.com they are granting permission for an application to access their data. We think this is a pretty serious action. Currently DelAuth requires that you have entered your password in the last 15 minutes (i.e. you can’t use cached credentials via the Sign In Assistant which is installed on hundreds of millions of PCs).  This meant you couldn’t be silently or one click signed in.
• DelAuth cannot be co branded (Web Authentication can be). By customization I mean the relying party’s colors/logos etc. (similar to the www.xbox.com sign in).

What does the Sign In with Twitter look like

Below are screenshots of signing in with Twitter (they offer both traditional forms based auth and signing in with Twitter via OAuth).

I authenticated to twitter about an hour ago and got this screen (2nd is if I'm not authenticated)

And after I am in I see my picture, name and actions i can do.

Difference between Twitter’s OAuth implementation and Windows Live ID Delegated Auth

You may notice a difference here between the twitter consent screen and Microsoft’s consent screen:

• When using DelAuth from Microsoft the third party is required to provide a privacy statement
• we provide the choice of duration of delegation
• on a per offer basis we may provide per item ACL’ing of which items are shared
• a link to the screen where users can revoke permissions from apps