Blog
Hybrid Onboarding
Tuesday, November 3, 2009
Do you operate a website and wish you could increase the percentage of users who finish the registration process? As discussed on Google's
main blog
, Google has been working with Plaxo and Facebook to improve the registration success rate for Gmail users. We now see success rates as high as 90%, compared to the 50-60% rate that most websites see with traditional registration mechanisms. This result was achieved using a combination of our
OpenID
,
OAuth
and
Portable Contacts
APIs. While those APIs have been available for over a year, we have added a number of refinements based on our experience with Plaxo and Facebook. Our documentation now has information on those new features, including:
OpenID User Interface Extension 1.0 (including the ability to display the favicon of the website)
x-has-session, which is an enhacement to checkid_immediate requests via the UI extension. If the request includes "openid.ui.x-has-session," it will be echoed in the response only if Google detects an authenticated session
Support for the US Government's GSA profile for OpenID
PAPE (Provider Authentication Policy Extension) to support forced password reprompts
Support for not only Google Accounts, but also our Google Apps customers, as discussed on the
Enterprise blog
For more details, please refer to our
OpenID
documentation.
While these technologies are all standards-based, the methods for how to combine them to achieve this success rate are not obvious, and took a while for the industry to refine. More information is available in the
Hybrid Onboarding Guide
, but below is a quick summary of some of the best practices for this hybrid onboarding technique:
The technique is primarily for websites with an existing login system based on email addresses.
It also assumes the website will send email to users who are not yet registered, whether it is through traditional email marketing or social network invitations.
The website owner then needs to choose a small set of email providers such as Yahoo and Google that support these standards.
Whenever the website sends email to a user at one of those providers, any hyperlinks that promote registration at the website should be modified to communicate the email address (or at least domain) of the user back to the website's registration page.
If the registration page detects a user from one of these domains, it should NOT start the traditional process of asking the user to enter a password, password confirmation, and email. Instead, it should prominently show a single button that says "Sign up with your Google Account" — where Google is replaced with the name of the email provider.
If the user clicks that button, the website should use the OpenID protocol to ask the email provider to authenticate the user, provide their email address, and optionally ask for access to their address book using the hybrid OpenID/OAuth protocol and the Portable Contacts API. More details about this flow are available on the
OpenID blog.
Once the user returns to the website, it can create an account entry for the user. The website can also mark the email address as verified without having to send a traditional "email verification" link to the user. If the website received the user's permission to access their address book, it can now download it and look for information about the user's friends.
In the unusual case where an account already exists for that email address, the website can simply log the user into that pre-existing account.
For any newly registered user, the website should then display a page that confirms the user is registered and that indicates how they should sign in in the future.
To make the login process simple, the website should modify their login box to include a logo for each of the trusted email providers it supports, or use one of the other
user experiences for Federated Login.
If a user clicks the email provider button, they can again be sent to that provider's site using the OpenID protocol. When the user comes back, the website can either detect that they previously registered, or if it is a new user, the website can create an account for them on the fly.
In some cases the account may already exist for that email address, but it was not initially registered using OpenID. In that case, the website can simply log the user in to that pre-existing account.
By Eric Sachs, Product Manager, Google Security
Labels
#freeandopen
#GooglePlay #AndroidDevStory #PlayStore #DeveloperConsole #StoreListingExperiments
#io12
#io13
#io14
#io15
#io16
#io2012
#io2013
#io2014
+1
20% project
3d
about.com
accessibility
Administrative APIs
AdMob
Ads
adsense
advogato
africa
agpl
ajax
ajax apis
ajax search
ajax search books news apis
all for good
amarok
analytics
android
Android Studio
android wear
apache
api
apis
apis console
apis explorer
apis. charts
app engine
app indexing
app indexing api
App Invites
apple
apps
apps script
asia
atom publishing protocol
Auth
authentication
authsub
awards
axsjax
barcodes
beacon
beacons
bespin
best practices
bigquery
blogger
book search
books API
bootcamp
browser
building ajax apps
buzz
c++
caja
caldav
calendar
camino
campfire one
caption
cardboard
CardDAV
cast
chinese
chrome
chrome apps
chrome dev summit
chrome devtools
chrome experiment
chrome extensions
chrome os
chrome web store
chromecast
chromium
chronoscope
cifs
classes
classroom api
client libraries
closure tools
cloud
cloud datastore
cloud platform
cloud portability
cloud services
cloud sql
cloud storage
cms
CocoaPods
code for educators
code jam
code review
code-in
codeedu
coffee with a googler
collada
commerce
community
compression
compressorhead
computing heritage
conferences
contacts api
contest
contextual gadgets
conversations
couchdb
countdown to I/O 2012
courses
creative commons
cricket
crisis response
cryptography
css
css3
custom search
custom search api
danish linux forum
dart
datastore
design
devart
develop
developer
developer expert
developers
developers. meetup
devfest
devfest developer chrome maps social wave apps
discovery service
django
dns
docs
documentation
documents list api
dojo
doodles
dot net
doubleclick
dreamweaver
Drive
drupal
eclipse
eclipsecon
eddystone
education
email
EMEA
enterprise
event
events
evolution
execution api
extensions
faster web
featured
feeds
finance
Firebase
Firebase Analytics
Firebase Cloud Messaging
firebug
firefox
firevox
fitness
font api
fosdem
freebsd
freenet
Fridaygram
fusion tables
gadgets
games
gcc
GDA
gdata
gdd07
gdd08
gdd09
GDD11
GDE
gdg
gdl
gdl weekly
gears
geo
geolocation
geoserver
getpaid
ghop
git
github
gmail
Gmail APIs
gnome
gnome women's summer outreach program
Go
goo.gl
Google
Google APIs
google apps
google apps api
google apps for your domain
google apps marketplace
google buzz
google cast
google chart api
google checkout
google chrome
Google Cloud Messaging
google cloud storage
google code
google code project hosting
google code search
google code university
google compute engine
google data apis
google data protocol
google developer day
google developer days
Google Developers Academy
Google Developers Live
Google Developers site
Google Developers University Consortium
google docs
google doctype
Google Drive
google earth
google fit
Google Fonts
google friend connect
google gadgets
google gears
google grants
google health
Google I/O
Google Identity Platform
google io
google mashup editor
Google Noto fonts
google play services
Google Science Fair
Google sheets
Google Spreadsheets API
google storage
google summer of code
Google tech talk
google technoloy user groups
google tv
google visualization api
google wallet
Google Wave
google web elements
google web toolkit
google.org
google+
googlecast
googleio
googlenew
googlewebelements googleio
GPE
green linux
gsoc
gtags
gtug
guest post
guice
gulp
GWSOP
gwt
hackathon
hacking
hackthon
hangouts
haproxy
hg
hibernate
howto
hpux
html
html5
I/O Extended
I/O Live
ical
identity
ietf
ignite
igoogle
iguanas
iiw
image search
Imara
in-app payments
internationalization
internet explorer
internet of things
interviews
ios
iOS SDK
ipad
iphone
israel
jaiku
java
javascript
jetpack
joomla
joomladayus2007
joomladayusa
karaoke
KDE
KDE 4.0
kernel
kernel summit
khronos
kids
kml
korean
labs
latitude
lca
lessons
licenses
linux
linux foundation
linux summit
linux virtual server
linuxconf eu
LoCo
london
mac
MacFuse
machine learning
maps
maps apis
Marketplace
material design
MDL
meetup
mercurial
MIT CSAIL
mobile
mod_pagespeed
Moderator
MOOC
mozilla
mylar
myspace
MySQL
mythtv
named
narratives
native client
nearby
netbsd
non-profit
nonsense
nosql
notifications
nss
O3D
oauth
OAuth playground
objective-c
OCaml
ocr
ODF
oha
OOXML
open data
open source
open source blog
open web
openajax alliance
opengl
openid
opensocial
openssh
openssl
oreilly
orkut
oscon
oscon2007
osi
oss devs
ossjam
osx
pactester
page speed
payments
performance
phone
photos
picasa
picasa web
places API
play services
playground
plone
plone sprint
podcast
polymer
portugal
posix
PowerMeter API
prediction api
preview
programming
project hosting
Project Loon
Project Tango
proximity
pubsubhubbub
py3k
python
python sprint
rails
random hacks of kindness
reader
Remote Config
research
result snippets
rhino
salesforce
samba
sandbox
scalability
screencast
sdk
search
security
service worker
Sheets API
shindig
shopping
sidewiki
sign-in
silverstripe
sitemaps
sites api
sixapart
sketchup
Smart Lock for Passwords
soap search api
soc
social
social graph
solaris
souders
spa2007
spdy
speakers
speed
speed tracer
standards
startup
storage
Street View
student programs
students
stuff
subscribed links
subversion
summer of code
SVG
sxsw
syndication
tasks API
templates
testing
themes
tool
tools
topp
training
tranparency
transit
translate
tutorials
tv
ubiquitous computing
ubiquity
ubucon
ubuntu
Udacity
unit test
unix
video
videos
Vim
virtual keyboard
virtual reality
visualization
VR
Wearables
web animations api
web components
web designer
web exponents
web fonts
web performance
web platform docs
webfonts
webgl
webmaster
WebP
website optimizer
weekly roundup
WhiteHouse.gov
Who's at Google I/O
windows
windows programming
Winter of Code
wtm
xauth
yahoo
youtube
zlib
zurich
ZXing
Archive
2016
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2015
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
2014
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2013
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2012
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2011
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2010
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2009
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2008
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2007
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2006
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2005
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Subscribe
Google
on
Follow @googledevs
Visit
Google Developers
for docs, event info, and more.
