XAuth, Google’s attempt to head off Facebook’s domination of online content sharing, is fraught with problems. It appears to be built with good intentions, allowing smaller social services to persist in a Facebook- and Twitter-dominated world. But unlike OAuth, the standard many of those services use today to link publishers’ websites to their services and which allows any website to work directly with any identity provider, XAuth actually stands in between the two and directs traffic. And that spells trouble. I should know. I’ve tried what they’re doing before.
I was the CTO of Sun Microsystem’s Liberty Alliance, where we invented the concept of federated identity, and am the inventor on the patent that covers federated identity. We first attempted to do the exact same thing –stand in between the websites and the identity providers in order to provide a seamless interaction.But no one wanted a single third party in that position — least of all privacy advocates. Instead, we delivered a specification that is very similar to how OAuth works today. Trying to evolve OAuth so that it becomes a service that intermediates direct relationships is a nonstarter.
The thesis of XAuth is that there are too many login and sharing services for a publisher to choose from, and that XAuth would only show the ones that are relevant to a user. This is the same principle as Google’s OpenSocial platform for developing social applications. OpenSocial’s creators posited that there were too many social networks for developers to choose from, so Google would provide a single open API that would access multiple social networks. We all know how that played out – there is only one social network that matters anymore.
The point of logging in and sharing is to share with friends. If people are all on one social network, why do they need to choose from a list of 20 providers to share? Most publishers offer logging in and sharing via Facebook and Twitter, which are both very easy to implement, and they get to service the vast majority of their customers.
I believe it is no coincidence that XAuth is launching right before Facebook’s F8 conference, its annual gathering for developers. The aim of XAuth is not to make it easier for users to login and share information, but to curb the inroads that Facebook is making into Google’s core advertising business. Facebook’s $500 million in estimated annual revenue is still small compared to Google’s $23 billion. But Facebook has steadily progressed over the past year, passing Google first in terms of minutes spent online, and recently in terms of unique visits.
Why should Google be so worried about Facebook? It really boils down to an obvious truth. Facebook is about people, and Google is about the algorithm. And who uses computers? People. And the algorithm doesn’t even work anymore. Search for “futon” and take a look at all of the results that have been gamed by advertisers. Who can tell you what a futon is the most comfortable? Not Google.
By spreading Facebook features into websites, Facebook will learn who is using which sites and what content is popular for which types of people. Websites will increase registrations, increase pageviews, increase sales, and most importantly be able to display much more highly targeted ads. The ads that Facebook displays next to profiles are way more targeted than the ads that Google thinks someone might like based on the content of a page.
To better understand the urgency of XAuth, I’ve included a table laying out current and upcoming Facebook features that publishers will love to integrate into their sites and that will displace some of Google’s most lucrative features. The people at Google are not stupid, and they will have to pull more tricks out of their hat than just XAuth.
|Current/Future Facebook Feature||Replaced Google Feature||Benefit to Publisher||Benefit to Facebook|
|Facebook Connect||Google Friend Connect||Increased registrations and logins.||Learn which sites are popular and how they are visited.|
|Facebook Search||Google Site Search||Returns what products and content is popular within a social network, increasing pageviews and sales.||Learn what products and search terms are popular.|
|Facebook Like||Google Buzz||Posts content to newsfeeds drawing traffic from friends.||Learn in real time what content is popular and viral.|
|Facebook Banner Ads||Google DoubleClick||Higher CPMs since social and profile targeting are better than content or behavioral targeting.||Google’s banner ad revenue.|
|Facebook Text Ads||Google AdSense||Higher CPMs since social and profile targeting are better than content targeting.||Google’s text ad revenue.|
Can the algorithm evolve to beat the people? If it doesn’t, Google could face a Facebook-dominated world. Here’s an illustration of what one popular publisher, the Huffington Post, might look like after Facebook takes over. It’s Google’s worst nightmare.