<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:D="DAV:" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-mailStijl17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:115566956;
mso-list-template-ids:1720643300;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
-->
</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="NL" link="blue" vlink="purple">
<div class="Section1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Great initiative to share the usability research. I fully disagree with the “fact of life” statement. (For the short term your suggestion is
the “best of bad”)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">For the long term:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Did we see it as a fact of life to have all logo’s of telco providers on the RP’s website when introducing a “call now” button?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Do we present all bank logo’s on the RP’s website when we introduced a “Pay now” button?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Do we put all Internet Provider logo’s on the RP’s website if there is a “download now” button?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Looking at the above and parallels with other industries I still think we miss a role within our OpenID model.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Current situation for OpenID : one-t-one relationship between RP’s and IDP’s<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Preferred situation in a Network Type Model: RP’s have a relation with acquirers, acquirers have a relation with IDP’s<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Just like banks, energy, ISP’s, Telco’s etc..
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Please bring the important role of the acquirer within OpenID discussions and work on a cooperative scheme for:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Business/ governance<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Rules & regulations<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Business model<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Brand & licensing<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Specification & certification<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Application<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Functionality<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Semantics<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Message standards
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Infrastructure<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Protocols<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Connectivity<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- Security<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">- ...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Kick<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">-------------------------------------------------------------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Kick Willemse<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Product Manager<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">e-mail:
</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><a href="k.willemse@diginotar.nl"><span lang="EN-US" style="color:blue">k.willemse@diginotar.nl</span></a></span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">weblog:
<a href="http://www.papierloos.nl/"><span style="color:blue">http://www.papierloos.nl</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">DigiNotar B.V.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Vondellaan 8<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">1942LJ Beverwijk<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">telefoon: 0251-268888<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Van:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> general-bounces@openid.net [mailto:general-bounces@openid.net]
<b>Namens </b>Eric Sachs<br>
<b>Verzonden:</b> maandag 13 oktober 2008 20:46<br>
<b>Aan:</b> OpenID List<br>
<b>Onderwerp:</b> [OpenID] Combining Google & Yahoo user experience research<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">In September/October both Google and Yahoo posted some Usability Research on Federated Login:<o:p></o:p></span></p>
<div style="margin-left:30.0pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">Google <a href="http://sites.google.com/site/oauthgoog/UXFedLogin"><span style="color:#551A8B">Presentation</span></a> at OpenID Foundation on September 18, 2008<o:p></o:p></span></p>
</div>
<div style="margin-left:30.0pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">Yahoo <a href="http://developer.yahoo.com/openid/bestpractices.html"><span style="color:#551A8B">UX Research</span></a> on their IDP endpoint<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><br>
Both companies have been asked for suggestions on how to merge the feedback from these two sets of research. Allen Tom & I have been exchanging mail about how to do that, and here is one way to merge the set of conclusions:<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
margin-left:36.0pt;text-indent:0cm;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">Based on the test Yahoo & Gmail have done earlier in the year, we already both believe that any "login" buttons have to include the brand of the IDP
and must be right next to the login box. While that might not scale nor promote the OpenID technology brand, that is just the fact of life. <o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
margin-left:36.0pt;text-indent:0cm;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">For RPs who currently use E-mail based logins, they can maximize adoption by using either the Google or Yahoo UX suggestions along with education/re-education
screens. However this requires that the IDP also verifies the user's email.<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
margin-left:36.0pt;text-indent:0cm;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">The Google UX option will enable RPs to trust the most IDPs, but the Yahoo UX suggestion will make the process the simplest for users of the few IDPs
that are listed below the login box. So the best solution may be for RPs to combine our two UX suggestions by using the Google UX for the login box, but still include buttons for a very small number of IDPs under the login box.<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
margin-left:36.0pt;text-indent:0cm;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><span style="mso-list:Ignore">4.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">From the data we have gathered, buttons work best if they are (1) just below the login box (either the password or sign-in button), (2) contain the
full name of the E-mail provider (not just logo), and (3) the set of buttons is no wider then the login box. That generally means a max of 2 buttons for a regular username/password login box, and a max of 3 buttons for the <a href="http://buy.com/" target="_blank"><span style="color:#7799BB">buy.com</span></a> style
login box Google suggests.<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
margin-left:36.0pt;text-indent:0cm;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><span style="mso-list:Ignore">5.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">An RP can use one-off protocols for a few big IDPs (like @<a href="http://hotmail.com/" target="_blank"><span style="color:#7799BB">hotmail.com</span></a>),
but OpenID is a good fit for RPs that want to support a large number of IDPs.<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal">This suggested combination was based off the two publicized research reports, along with one other old study Google had done. In that study I took Netflix's login page and added a Gmail & Yahoo signin button below it. For that study,
I used a modified Yahoo BBAuth confirmation page that indicated the user's E-mail would also be shared. As you would expect based on Yahoo's research, none of them clicked the Gmail or Yahoo buttons. However, what I did was create a fake "upgrade to federated
login" prompt that they were shown after signing in. Four of the six testers chose to go through the wizard, and the other two said they might skip it if they were trying to do something quick, but they would want to come back later and do it. The "upgrade
wizard" took them through the flow of federated login. Once users were sent back to Netflix, I then showed an "education" screen where I told users that in the future they should click the yahoo or gmail buttons below the login box. I then distracted them
for a while pretending I was done with the test, and then said "oh, i forgot to test one more thing, can you just sign in again one more time?" Of the 6 users, 4 typed their Gmail/Yahoo E-mail and password into the Netflix login boxes (just like in Yahoo's
UX research), and only 2 remembered the "education" screen they had just seen a few minutes ago. For the 4 who forgot, I then reshowed them a modified version of the education screen that asked them to please use this method in the future, with a button to
go to Yahoo/Gmail to finish their current login attempt. Those 4 were all slightly embarrassed, but all said the re-education screen was good, and that they liked the fact that once they got trained, they would no longer see it. One thing I had planned to
test was to ask people to sign up for Netflix instead of sign-in, and then on the signup screen once they typed a Yahoo or Gmail address, I would use JavaScript to suggest that they "upgrade" to federated login instead of creating yet another password. I
never did that in this scenario, but we did something very similar in the Google research we publicized.<span style="font-size:10.0pt;
font-family:"Arial","sans-serif";color:black"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";
color:black">After reading the details of Yahoo's research, I realized that this old study was half-way between the suggested UX of Google and Yahoo's published reports.
The only difference between this old study and Google's suggested UI is that we changed the login box to the new style described in our research. However that technique still uses an education/re-education screen, and it had the same % of users who forgot
the education the first time. That technique also uses the idea of prompting existing yahoo/gmail users to "upgrade" to federated login, as well as looking for new accounts that users try to create for yahoo/gmail addresses, and redirect them to the federated
login flow. So the list of conclusions above suggests how these different user studies could be merged.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">p.s. This summary is also posted to <a href="http://sites.google.com/site/oauthgoog/UXFedLogin/CombineGoogYahoo">http://sites.google.com/site/oauthgoog/UXFedLogin/CombineGoogYahoo</a> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Eric Sachs<br>
Product Manager, Google Security<o:p></o:p></p>
</div>
</div>
</body>
</html>