Windows Live ID: Announcements

Delivering Data Portability – Delegated Authentication SDK v1.0

Thu, 28 Feb 2008 15:00:25 GMT

Today the Windows Live™ ID team released the Delegated Authentication SDK v1.0, which provides a platform-neutral way for Web applications to access customers’ information from Windows Live services while customers remain in firm control of their own data. This release is part of a broader announcement of a whole set of releases from the Windows Live Platform team that are described by our boss David Treadwell in his blog posting today.

Windows Live Delegated Authentication is a feature that gives Windows Live ID customers the ability to consent to the scoped release of their personal information to particular Web sites in a reliable yet flexible manner. Customers grant (or withhold) consent by means of a straightforward user interface, as shown here:

Delegated Authentication is a way to grant access to personal information, but with more precise control over permissions and usage than the current binary decision (that is, fully on or fully off) that comes with the generally bad practice of handing over your account credentials to another Web site.

Simultaneously with the debut of Delegated Authentication, the Windows Live Contacts and Windows Live Photos teams have released updates to their services to use this new feature, enabling customers to permit other Web applications to access their photo albums or their Hotmail® / Messenger contact lists.

This is a big step in delivering real, user-centric data portability—giving Windows Live customers explicit control over releasing their information from Windows Live services and sharing that data with other applications that they want to use. The value of allowing software to access our personal data across multiple Web sites can be huge in terms of:

Time saved—who wants to keep contact lists up to date manually across a number of different e-mail accounts?
Possibilities created by combining data from different sources in new and innovative ways—for example, overlaying your friends’ latest home and work addresses with the details of your travel itinerary for an upcoming business trip could allow unexpected opportunities for reunions with people you haven’t seen for many years.

Windows Live Delegated Authentication is the strategic delegation platform for Microsoft Web properties, and is built on the proven, highly scalable technology used by the Windows Live ID authentication service.

Delegated Authentication is an evolution of the earlier prototype Cumulus PGUX Alpha release (a.k.a. Windows Live Data) seen at MIX07. The PGUX system will be phased out during the next six months, and during that time we’ll be working with any developers currently using the PGUX service to help them make the transition to the Windows Live ID Delegated Authentication system.

A white paper is available to provide a high-level overview of how Delegated Authentication works and how it can be implemented and used by Web application providers. More details are provided in the Delegated Authentication SDK documentation on MSDN®.

The SDK release includes sample applications for each of six different programming languages: ASP.NET, Java, Perl, PHP, Python, and Ruby. The use of this SDK is governed by the Windows Live Platform Terms of Service.

Delegated Authentication is the strategic programming model for consent-based data portability for all Windows Live services going forward. More Windows Live services will be releasing support for this feature in the coming months; the Resource Provider Directory shows the current list of Windows Live services that support Delegated Authentication and the status of each release.

Windows Live Delegated Authentication is both a powerful enabler of a new class of user-centered Web services, and also an opportunity for users to take back control of their own personal data and make informed decisions before releasing that data to other parties.

-- Jorgen Thelin, Senior Program Manager, Windows Live Identity Services

Some Typical Scenarios for Windows Live Delegated Authentication

Here are some scenarios that illustrate how Windows Live Delegated Authentication might be used.

Social Networking Address Book – A social network site can synchronize a customer’s Windows Live Contacts list with his or her “friends” lists from other social networking sites, to ensure that the customer can keep e-mail and contact information updated as friends change jobs or move around the country.

Family Photo Album – A family Web-site service could automatically retrieve the latest digital photographs from each individual family member’s personal photo-hosting account, to create an up-to-date snapshot of family activities.

Resources

· Understanding Windows Live Delegated Authentication white paper

· Windows Live ID Delegated Authentication SDK

· Windows Live ID Delegated Authentication SDK documentation

· Windows Live Platform Terms of Service

· Windows Live Delegated Authentication - Resource Provider Directory

· Windows Live ID - Development Support Forum

· Windows Live ID Developer Home Page

· Windows Live Contacts Developer Home Page

· Windows Live Photo APIs Developer Home Page

· David Treadwell’s Windows Live Platform Announcement blog posting

Adding our RSS feed to live.com

Fri, 21 Jul 2006 21:01:36 GMT

You can use this handy link to add our RSS feed to live.com:

http://www.live.com/?add=http://winliveid.spaces.live.com/feed.rss

Get on the Live Messenger Beta automatically

Fri, 05 May 2006 03:26:44 GMT

If you aren't already on the Live Messenger beta, what are you waiting for? Get on it so you can get the much talked about Windows Live Sign-in Assistant to get multi-user support on the new Windows Live sign-in.

The Live Messenger Beta used to be "invite only", but thanks to Leah Pearlman from the Messenger team, here's a link you can use to automatically get accepted into the beta program:

http://ideas.live.com/signup.aspx?versionId=0eccd94b-eb48-497c-8e60-c6313f7ebb73

then sign in with the Windows Live ID that you use for Messenger. After you see the "congrats" message, go to http://ideas.live.com to download the latest Live Messenger beta.

-Trevin Chow, Lead Program Manager

Sign-in support for multiple IDs

Tue, 02 May 2006 22:46:16 GMT

Do you have multiple Windows Live ID accounts? Do you use the same Windows account with more than one person? Do you switch between these accounts frequently? If you answered yes to these questions, you’re in for some good news!

Today we are shipping the Windows Live Sign-in Assistant which is an Internet Explorer add-on that comes included with Windows Live Smart Clients, such as Windows Live Messenger. The goal of this add-on is to help make your sign-in experience faster and more convenient for users that have more than one Windows Live ID account.

Easily choose which account you want to use

Multiple Windows Live ID accounts are often used on a particular computer, either because multiple people share a computer (like in a family home), or, because you are an individual user with multiple accounts (for example, separate accounts for ‘work’ and ‘home’). A key feature that Windows Live ID sign-in experience will offer is the ability for our users to save multiple credentials on their machine. These multiple accounts will be shown as a list on the sign-in page – you’re even able to save your password for each of these accounts, eliminating the need to re-type your password everytime you want to change your identity! (Note: if you use a shared/public computer, we do not recommend saving your password) Take a look at this screenshot taken from one of our test environments:

(click to enlarge):

True Password Persistence!

Before the Windows Live Sign-in Assistant, the ‘save my password’ option caused your sign-in state to be persisted across multiple browser sessions (it was a persistent cookie), but hitting “sign-out” at any page would delete the cookie and the next time you wanted to log in, you were prompted for your password again.

This was a frustrating experience for users.

With the Sign-in Assistant installed, the ‘save my password’ box will work just like it does in Messenger – it will keep the password in a local credential store (we use the Windows Credential Manager). If you’ve chosen to save your password, all it takes to sign in is a single click on the appropriate user tile. This is a huge improvement over the previous experience. We’ve also made it very easy for you to remove your saved password, just click on “remove” link and the member name and password are deleted from the credential store. You are in still in control of when your credentials are saved.

One credential list shared by Windows Live smart clients and browser applications

The list of users that is shown on the sign-in page is actually the same saved user list used by Windows Live desktop applications, meaning that if you save a credential in Windows Live Messenger, it will be shown by your browser on the Windows Live ID sign-in page! If you choose to “save my password” on the Windows Live sign-in page, your username and password will show up on the user list in Windows Live Messenger. This will unify the experience across Windows Live ID enabled applications. This also means that choosing “remove” on the Windows Live Sign-in page will remove the saved ID/password for all applications on your machine. This is a fundamental shift from our previous sign-in experience and different from other sign-in experience you may be using. However, the upside of this is that it unifies all the Windows Live services and clients as a single product under Windows Live ID.

How can you get the Sign-in Assistant, and when can I start using the new UI?

You can get the Windows Live Sign in Assistant with the upcoming version of Windows Live Messenger 8.0 Beta (you can sign up for the beta at http://ideas.live.com). Make sure you check the box on install that says “Windows Live Sign-in Assistant”. The enhancements will be seen only on Windows Live sites which have the new Windows Live Sign-in UI enabled (checkout Lynn’s previous post on the new sign-in experience).

How does it work?

The Sign-in Assistant consists of two components – an ActiveX control and a browser helper object. These components provide an interface to our sign-in UI that allows it to make calls to the Windows Live ID client runtime libraries. Using those libraries, we are able to enumerate and perform functions on the accounts stored in the Windows Live common credential store. The common credential store is stored within the Windows Credential Manager and is where all of your Windows Live ID accounts get stored when you say “remember me” in Windows Live Messenger. In short, the BHO/ActiveX allows us to unite the user list between all Windows Live apps to enable rich scenarios without the limitations of HTTP cookies.

What are the implications to installing the Sign-in Assistant?

Installing the Sign-in Assistant simply means your sign-in experience will be more convenient and faster, especially for users who have more than one Windows Live ID. The sole purpose of the Sign-in Assistant is to enhance the Windows Live ID sign-in experience. The Sign-in Assistant contains no spyware, does not track your surfing patterns or behavior and is not related to the delivery of advertisements. If you decide that the Sign-in Assistant is not for you, you can disable it by going to the Tools menu in IE, selecting “Manage Add-ons”, highlighting “Windows Live Sign-in Helper”, and then choosing “Disable” in the settings box. Alternatively, you can remove it permanently by using the “Add/Remove Programs” dialogue in the Control Panel (it shows up as “Windows Live Sign-in Assistant”). That said, we hope that you’ll like the enhanced sign-in experience and choose to keep the Sign-in Assistant running!

That’s all for now

We’re very excited about the richness of the sign-in experience and the scenarios we’ll be able to unlock in the future, including authentication state transfer from the web to a desktop client (we’ll post more on this in the near future)!

Make sure you check the “install windows live sign-in assistant” box when you install the upcoming version of Windows Live Messenger 8.0 beta and don’t forget to leave us feedback (good or bad) after you’ve tried it out.

-Mark Wong and Erren Lester, Program Managers

FAQs

New! Q: I installed the Live Messenger beta and the Windows Live Sign-in Assistant but I only see a single user on the sign-in screen. What's going on?

A: For those having troubles getting the multi-account feature on sign-in, it's likely because you are either (a) using a browser other than Internet Explorer, or (b) previously installed a Live Messenger beta with an old build of the Sign-in Assistant.

If you fall into (a), you can solve it by using IE :) We wanted to support more browsers in this initial release, but had to make some feature cuts along the way to ensure we shipped on time. We are actively looking at increasing non-IE browser support in the future.

If you fall into (b), use "Add/Remove Programs" in Control Panel and uninstall both Live Messenger and The "Windows Live Sign-in Assistant". Then you can reinstall the official Live Messenger Beta from http://ideas.live.com. This official beta version will install the correct, and working, version of the Sign-in Assistant for you.

Q: You have 2 components, a BHO portion and an ActiveX control, what does the BHO component do?

A: The BHO inspects some of the traffic to and from the login.live.com domain during sign-in. The BHO only acts when data is coming from or going to this domain. We do not save or track your internet usage. We only do things like save passwords and get and save authentication states.

Q: Oh, ok, so you save my passwords and use them to help me sign-in at Live.com. What other passwords does Microsoft monitor and save?

A: None, we only look and save your Windows LiveID information, and only if you explicitly choose ‘remember me’ or ‘remember my password’. If you don’t have the Sign-in Assistant installed, our behavior is the same as in the past strictly utilizing HTTP cookies. We will never store, save, or otherwise interact with any data that is not directly relevant to authentication with a Windows Live ID. For more information about how our service handles your personal information, check out the official Microsoft Online Services privacy policy.

New sign-in UI.. it's alive!

Fri, 28 Apr 2006 21:59:47 GMT

Today we are rolling out a new sign-in experience for Windows Live sites like Live.com, Ideas, Mail, Expo, Favorites and Custom Domains. This is the next step in our Windows Live ID deployment.

When our team first started working on Windows Live ID, we were really excited because it gave us an opportunity to rethink the sign-in experience. In the past, signing in has been cumbersome for users. The user knows that they are who they say they are, but they have to prove it by remembering an ID and password and typing them in. When you have a service that operates at such large scale as Windows Live ID, delaying users even a few seconds with a poor experience can result in a net loss of thousands of hours wasted across the world per year. We take the responsibility to deliver a good sign-in experience very seriously.

You can see the following improvements to the Windows Live sign-in experience today:

Clean and simple: The first thing you may notice about the Windows Live sign-in page is that it is a very clean, simple experience. Our goal here was to strip any non-essential information off the page so that there is nothing to distract users from the process of signing in.
Consistent: We had a great opportunity to do this with Windows Live because Windows Live web sites have a common look and feel. The page will have the same clean format no matter what Windows Live site you visit.
Fast: Another advantage of the clean, simple experience is that it is very fast. Our goal is to get you through this page as fast as possible, so you can get on with your life and read your e-mail :). We’ve measured the page load time to be reduced by more than 50%!

Finally, you don’t need to sign up for a new account to sign in to Windows Live sites. You can use your existing Hotmail, MSN, or Passport account.

This new sign-in UI you'll see today isn't the last thing you'll see from the Windows Live ID team -- more innovative features are coming! Next week we’ll have more information from more members of our team on how the sign-in UI was implemented as well as more exciting features you’ll see in the coming months in the sign-in experience for Windows Live.

- Lynn Ayres, Mark Wong, Trevin Chow, Erren Lester, Brian Perrin and Brian Kramp

Windows Live ID deployment

Thu, 27 Apr 2006 01:59:08 GMT

Question #1: What service has over 300 million users and does nearly a billion authentications per day?

Answer: Windows Live ID!

Question #2: What service is being deployed right under your nose, while still maintaining its stellar availability?

Answer: Windows Live ID!

That's right, we’re nearly complete with our deployment of the Windows Live ID service! It's a good thing that you haven’t noticed, otherwise we would have been in serious trouble since it would have meant something went wrong :)

The first thing to point out is that all the sign-ins will start going to our new URL, which is login.live.com. The second thing is that you'll notice in the footer of our "classic" sign-in UI are the words "Windows Live ID" :)

Our new sign-in experience that I've mentioned before will begin to light up over the next week or so at partners like Live Mail, Expo and www.live.com. In fact, Lynn Ayres, one of the PMs on our team responsible for user experience and design of the new Windows Live ID Sign-in UI will be blogging very soon on this very topic in the next few days.

Stay tuned for more info!

-Trevin Chow, Lead Program Manager

Windows Live ID whitepaper

Mon, 17 Apr 2006 09:54:04 GMT

Fresh off the press on MSDN is our whitepaper on the Windows Live ID service. This is a great primer on Windows Live ID, how it is positioned within the Identity Metasystem and what you can look forward to in the future with respect to the platform.

Some excerpts to wet your appetite:

"The Windows Live ID service is the next-generation version of a system that does over 22 billion authentications per month and is used to access a large set of online services operated by Microsoft and its close partners"

"The current plan is that Windows Live ID will support both self-issued and third-party managed [InfoCards] as a mechanism to authenticate users when accessing Windows Live services. Subsequently, Windows Live ID will also issue managed cards to enable users to use their Windows Live ID with third parties."

"To simplify integration on both the server side and the client side, the Windows Live ID service will release software development kits (SDKs) later this year. In addition, the Windows Live ID service uses industry standard protocols. For cloud server-to-server scenarios, the Windows Live ID service exposes programmatic interfaces by way of SOAP services."

Whitepaper: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnlive/html/winliveidserv.asp

-Trevin Chow, Lead Program Manager

The beginning of Windows Live ID

Tue, 11 Apr 2006 22:06:49 GMT

Welcome to the Windows Live ID team blog! This is our inaugural “Hello World!” post to introduce Windows Live ID.

Windows Live ID is the upgrade/replacement for the Microsoft Passport service and is the identity and authentication gateway service for cross-device access to Microsoft online services, such as Windows Live, MSN, Office Live and Xbox Live. Is this the authentication service for the world? No :-) It's designed for use with Microsoft online services and by Microsoft-affiliated close partners who integrate with Windows Live services to offer combined innovations to our mutual customers. We will continue to support the Passport user base of 300+ Million accounts and seamlessly upgrade these accounts to Windows Live IDs. Partners who have already implemented Passport are already compatible with Windows Live ID.

Windows Live ID is being designed to be an identity provider among many within the Identity Metasystem. In the future, we will support Federated identity scenarios via WS-* and support InfoCards.

For developers we will be providing rich programmable interfaces via server and client SDKs to give third party application developers access to authenticated Microsoft Live services and APIs.

Over the next few weeks as we complete our deployment, you will see the Windows Live ID service come alive through our respective partners sites and services. The first thing you’ll notice as early as today is that the word Passport is being replaced by Windows Live ID. But it isn't a rebranding exercise -- there is stuff going on under the hood. This will be more understandable in the coming weeks and months when you start seeing the new, exciting Windows Live sign-in UI. Not only is the page load time significantly reduced, but you will see some really cool innovative features that we’re sure you’ll love :)

What do you need to do as a consumer? Nothing! Just keep logging into your Windows Live and MSN services as you normally do. Or try out some new ones at ideas.live.com.

We'll be sharing more about Windows Live ID here as it rolls out...for all those interested in identity and authentication service, come on back. And let us know what you think!

-Trevin Chow, Lead Program Manager