Google has just released Google Account Authentication. My initial reaction: great technology for rich clients and web sites acting acting on behalf of the user, but deepens the Google identity silo.

The Web 2.0 crowd had started to use Google accounts for SSO, and this enables consumption of light weight web services in a reasonably secure manner. I’m keen to read what the black hats think of the approach.

The Google Account Authentication for installed apps is a bold move to standardize an API for working with installed applications. Unfortunate that it is domain centric. The user has to provide their Google credentials. Clearly the easy, safe choice that creates more value for the user’s google credential. Also makes it harder for any identity management technology to manage the Google credential.

Google Account Authentication for Web-Based Applications looks like it is opening up the SSO mechanisms that Google has been using across their various properties so that other properties can get a token to act on behalf of the user.

Hopefully Google will want to participate in the Web Authentication Enhancement BOF at 66th IETF in Montreal in a few weeks so that we can work to make these mechanisms more generalized. If nothing else, Montreal is a great city to visit this time of year!
In my OSCON 2005 Keynote on Identity 2.0, I predicted the web services aspect of Web 2.0 would be a driver for Identity 2.0 — perhaps that is becoming true? Hopefully Google is not just going to deepen the identity silo they are are currently creating, but will work with others to help realize Identity 2.0.