RSSEU regulators call for tighter privacy provisions on OpenID, Facebook
By Tim Conneally | Published June 18, 2009, 5:44 PM
The Article 29 Working Party, the same group that fought with Google over its search log data, could take similar action against developers that utilize open identification platforms such as Facebook Connect, Google Friend Connect, and Microsoft Live ID, which use open identification protocols such as OpenID and OAuth.
According to an "unpublished opinion paper" that Financial Times got its hands on, the group believes third-party developers building apps that use data from sites such as Facebook and Twitter should be subject to tougher privacy and data protection regulations.
The group reportedly discussed stricter regulations on corporate marketers who use social networks as marketing tools, and even talked about placing stricter regulations on private citizens who simply have large numbers of friends.
In keeping with the old saying, "It's not what you know, it's who you know," an individual with access to tons of users' personal information does have a powerful tool at their fingertips.
We heard similar sentiments from EU Commissioner for Consumer Affairs Meglena Kuneva last March, when she spoke out about user profile security, and how that personal data is far more exploitable than any search records. Kuneva did not place demands on individual sites to tighten up their own policies, but rater called for policy reform on the EU's end.
It's funny that they wish to challenge OpenID, when most sites that use OpenID-based authentication only use it for that -- authentication. I wish to avoid knowing even user's password in my site's database, no matter how encrypted it is; that way, the user can forget he's even a user on my site, and doesn't have to enter any kind of password. OpenID is cool. Some extensions to it may not be, but the basic OID is cool and not invasive to privacy.
Score: 0
|Tim - I understand your second paragraph: that is pretty much exactly the message of the FT's article - but how do you draw the connection between that and OpenID/OAuth? I'm interested to know if you have seen any indication from the Article 29 group that it's the authentication mechanisms they are concerned about, as opposed to the exposure of users' personal data to third parties by social networking sites.
Score: 0
|