Social- Networks Connect Services
Total Page:16
File Type:pdf, Size:1020Kb
COVER FEATURE SOCIAL- NETWORKS CONNECT SERVICES Moo Nam Ko, Gorrell P. Cheek, and Mohamed Shehab, University of North Carolina at Charlotte Ravi Sandhu, University of Texas at San Antonio New services such as Facebook Platform, in touch with users while they’re on these sites. Moreover, Google Friend Connect, and MySpaceID users can enjoy various applications with content from let third-party sites develop social appli- numerous third-party sites: users access social-networking cations without having to build their own sites, where they maintain their profiles; third-party sites social network. These social-networks con- retrieve these profiles, enrich the content, and return them nect services increase access to and enrich to the social-networking sites for consumption by the user user data in the Social Web, although they and, possibly, friends. For example, Facebook users can share music with friends, create playlists, and get concert also present several security and privacy alerts on their profile page by installing the third-party challenges. music application iLike (www.ilike.com). Major social-networking sites have begun launching ocial-networking websites let users build social social-networks connect services such as Facebook Plat- connections with family, friends, and cowork- form, Google Friend Connect, and MySpaceID that further ers. Users can also build profiles for storing break down the garden walls of social-networking sites. and sharing various types of content with These SNCSs let third-party sites develop social applica- others, including photos, videos, and mes- tions and extend their services without having to either Ssages. Updating user profiles with interesting content is a host or build their own social network. This extension form of self-expression that increases interaction in such allows third-party sites to leverage the social-networking sites. To encourage this interaction and provide richer con- site’s features. tent, social-networking sites expose their networks to Web For example, third-party sites can exploit the authenti- services in the form of online application programming cation services provided by a social-networking site so that interfaces. These APIs allow third-party developers to users need not create another username and password interface with the social-networking site, access informa- to access the third-party site; instead, users can draw on tion and media posted with user profiles, and build social their social-network credentials and established profile. applications that aggregate, process, and create content Users can also access third-party sites that leverage social- based on users’ interests. network user-profile content. The third-party sites retrieve Social-networking sites provide numerous applica- users’ profiles from the social-networking site to create tion services that can mash up user-profile data with an enhanced experience. In this way, they can increase third-party data. In addition, third-party sites can rapidly membership by providing more interesting content from distribute their services via social-networking sites to keep a variety of sources in a seamless manner. 0018-9162/10/$26.00 © 2010 IEEE Published by the IEEE Computer Society AUGUST 2010 37 COVER FEATURE Social-networks User data in the • Authorization governs access to user connect services Social Web data in the Social Web based on pre- Identity Identity defined authorization access rights; the authentication authorization API lets third-party sites Prole create new content and extract existing Authorization content from users’ Social Web data. Third-party Privacy policy site • Streams let third-party sites publish Streams Client Social graph to users’ activity streams and vice versa. Applications Content • Applications let third-party sites de- velop rich social features in the form of applications and thereby extend the Figure 1. Social-networks connect services framework. Social Web. The implementation of these APIs can vary widely with different protocols and technologies. Facebook Platform User data in services Facebook Facebook Platform Authentication Identity OAuth 2.0 Facebook Platform became gener- ally available in December 2008 under Authorization Prole OAuth 2.0 the Facebook Connect brand. (Facebook Third-party Privacy policy announced in April 2010 that it’s eliminat- site Open Stream ing the Facebook Connect brand as part Client Social graph of the launch of the Open Graph API; it’s Applications Content not clear at this point whether the com- • Open Graph • FQL • Social • FBML pany will replace it or call it something plug -ins else.) Since then, more than 80,000 third- • JavaScript • REST party sites have implemented it. Facebook Platform lets third-party sites integrate with Facebook and send information both ways to create more engaging and Figure 2. Facebook Platform services. richer social experiences on the Web. As Figure 2 shows, Facebook Platform allows SOCIAL-NETWORKS CONNECT SERVICES users to import their identity, profile, privacy policy, social User data is composed of three types of information. graph, and content from Facebook to third-party sites. Identity data describes who I am in the Social Web, includ- Authentication is by far the most used Facebook Plat- ing my identity, profile information, and privacy policy. form component. This API enables third-party sites to Social-graph data represents who I know in the Social Web, leverage Facebook as an identity provider. For example, including my friendship connections with descriptions Digg.com, a social news website where users can share such as family, coworker, colleague, and so on. Content content, doesn’t require new members to register and data represents what I have in the Social Web, including create a profile. Instead, as Figure 3 shows, they can use my messages, photos, videos, and all other data objects their existing Facebook profile to authenticate (steps 1 and created through various Social Web activities. 2); once authenticated, new users can extend their social For social-networking sites to be able to share user Social graph to the third-party site and invite friends—or link to Web data with third-party sites, a secure and reliable SNCS them, if they’re already members—to join them on Digg. framework is required. As Figure 1 shows, this framework com (step 3). consists of a collection of four categories of APIs that allow Facebook Platform leverages OAuth 2.0 for authentica- third-party sites to interface with the social-networking site: tion and authorization. OAuth 2.0 is a simplified, improved version of the Open Authorization standard (http://oauth. • Identity authentication proves users’ identity; users net) that lets third-party sites obtain authorization tokens can authenticate using their existing accounts from from Facebook. First, a user of the third-party site au- various identity providers to include the social- thenticates using Facebook as an identity provider. Next, networking site. Facebook issues a token that lets the third-party site 38 COMPUTER access the user’s basic profile information in- cluding name, picture, gender, and Friend List. The third-party site can request extended per- missions depending on User authenticates using the specific application Facebook credentials requirements—for exam- ple, to access the user’s Wall, the space on the Step 1 Step 2 user’s Facebook profile where friends can post Step 3 messages. The third-party site can also apply Face- Figure 3. Digg.com authentication via Facebook Platform. New users can leverage their exist- book users’ privacy policy ing Facebook profile to authenticate (steps 1 and 2); once authenticated, they can extend their settings. For example, if social graph to the third-party site and invite their friends—or link to them, if they’re already members—to join them on Digg.com. Alice doesn’t allow Bob to access her content on Facebook, then Bob wouldn’t be allowed to access Alice’s used to integrate third-party sites using Facebook Platform content on the third-party site. along with numerous tools for developers to build social The Open Stream API lets third-party sites read and applications. Facebook Markup Language (FBML) is a pro- write to users’ activity streams—for example, short mes- prietary variant of HTML, and Facebook Query Language sages on new events. This API supports multiple-stream (FQL) provides a quick and easy mechanism to query Face- publishing methods as well as the Atom feed standard. book user data without using API methods. Third-party sites can read content from users’ activity streams in addition to publishing to their activity streams. Google Friend Connect For example, Facebook users can share their activities on Released at approximately the same time as Facebook third-party sites with their friends on Facebook through Platform, Google Friend Connect also makes it easy to the News Feed feature. share profile, social-graph, and content data with third- Facebook provides a series of APIs to assist developers party sites (www.google.com/friendconnect). As Figure in creating social applications that interface with third- 4 shows, its decentralized approach to integrating social party sites (http://developers.facebook.com/docs). The and nonsocial websites relies on open standards such as primary API is Open Graph, which lets third-party applica- OpenID (http://openid.net), OAuth, and OpenSocial (www. tions read and write content objects—photos, friends, and opensocial.org). so on—and the connections among them in Facebook’s OpenID lets users authenticate to third-party sites using social graph. The API is simple in that it allows access to credentials issued by a supported OpenID identity pro- content objects via URLs. For example, with proper au- vider such as Google or Yahoo. This API prevents users thorization, http://graph.facebook.com/FBUserID/friends from having to go through the new-member registration will provide access to FBUserID’s friends. Facebook also process. After initial authentication, users can select their provides support for the Representational State Transfer existing profile from a profile provider site like Plaxo.