Criteria for Evaluating External Identity Providers

Google

Yahoo!

Facebook

"user_id" (numeric, directed identifier) is not reassigned?

Six characters. Some complexity reqt or minimal dictionary check; specifics not clear.

App or SMS.

Limited to people with large numbers of followers.

ID; Name(s); gender; locale; timezone, link (to profile); Email; Friends (that also use this App)
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4fed4530-d4c2-4e2b-b76c-a54abe3d5997"><ac:plain-text-body><![CDATA[Others; is_verified; birthdate; age_range

Many are user-managed

Release generally by bundles. Apps request groups of data.

Granular at the "bundle" level. [Some elements also controlled by profile visibility settings in FB]

Lack of consent expressed with OAuth exceptions?
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="69770d80-e2c5-495d-81fd-f21e732c8f1a"><ac:plain-text-body><![CDATA[Receipt of data implies consent.

Not expressed?

Directed (older APIs versions=static)

For profit; social networking.

Reasonably strong

[https://www.facebook.com/legal/terms
]]></ac:plain-text-body></ac:structured-macro>
]
States users must provide accurate identity information (even when not verified)

None

Amazon

Twitter

Yes, accounts can be reassigned. This depends on if they were deleted, deactivated, or suspended but it is possible.

Your twitter numeric ID however does not changed.

Must be at least 6 characters. No specific requirements for special characters, capitalization, or numeric.

Yes. 2 Options: SMS Code, or challenge to Mobile App (Accept / Deny).

Limited to "highly sought after users." They "do not accept requests for verification from the general public".

Username, Language, TimeZone, Short Bio, Location, Website Link, Profile Photo, Verification Status,

Unstable. User controlled w/ little or no validation.

Bundled.

Controlled through application privacy settings.

All or nothing / followers only.

Implied through availability.

No.

Public.
NYSE: TWTR

Social Networking. Micro blogging.

Strong.

https://twitter.com/tos

None

LinkedIn

Must be at least 6 characters. No requirements for special characters, capitalization, or numeric. Recommendations are made.

Yes. Code sent via SMS.

No.

Depends on privacy settings but many are available: id, first name, last name, email, location.

Unstable. User controlled w/ little or no validation.

Bundled.

Controlled through application privacy settings.

Implied through availability.

Public.
NYSE: LNKD

"Professional" Social Networking.

https://www.linkedin.com/legal/user-agreement

None.

Premium Available.

Microsoft  

If account is closed, email address or user name (not the Microsoft account itself) may be recycled and assigned to another user.

User can opt to force password change every 72 days.
passwords 8-character minimum, case sensitive. May not reuse last password.

Phone app, Text msg. or phone call  for accessing sensitive account information such as password change. Two step verification can be set up when signing in on a new device. Security code to  app, phone or alternate email address.

None, except to verify control of 3rd party email address.

Display name;
Birthdate;
Gender;
Country/region;
Time zone;
email address;
telephone/text

User controlled

Bundles. Varies depending on service being accessed.

Subject to privacy practices for each app accessed.

http://windows.microsoft.com/en-us/windows/microsoft-services-agreement

UnitedID

Eric Goodman

No reuse/
reassignment ever

Ideally Silver compatible

Ideally

Varies by use case

Required: UserID;
Desired: User knowable UserID; confirmed contact address

Indefinite

Ideally granular

Ideally

SAML Attribute

SAML AuthnContext (and/or attribute?)

Static preferred. In some use cases static is required.

Non-user tracking/privacy preserving is ideal

Always good

???

$0 or low

NIST LoA 1

David Walker

Non-reassigned identifier available

Silver / LoA-2, but depends on use case.

Yes, but depends on use case

Depends on use case

Non-reassigned identifier, email

Documented

Documented

Yes

Documented

SAML AuthnContext (and/or attribute?)

Documented

Non-user tracking/privacy preserving is ideal

Always good

Documented

$0 or low

NIST LoA 1 (LoA 2 desired)

Mary Dunker

never reassign unique identifier

Comparable to Bronze or Silver - depending on use case

a desirable option

Varies by use case.   Important to publish ID Proofing, if any is done

R&S attributes

Document

Document

yes - required

SAML Attribute

SAML AuthnContext (and/or attribute?)

Document

Non-user tracking/privacy preserving is ideal

Good - Document

Document

$0

NIST LoA 1 

John Breen

No reuse 

Depends on use case.
Silver compatible but not necessary if use case does not require.

Support Required

By use case

non-reassigned id
e-mail
Optional: address, first, last.

Documented

Documented

Case by case. Some attr. no consent (unique id). 

SAML attribute

SAML AuthnContext (and/or attribute?)

Documented

Non-user tracking/privacy preserving is ideal

Good - provable via documentatioin/metrics

Documented
Can this conflict with campus privacy policy?

$0