#oneid

So, you ever go to a website and it allows you to sign up for the service and create an account using your Google, or Apple, or Facebook login? That's called Third Party Authentication. What it does is it uses your valid account on a website that has a strong authentication process to prove that you're a unique human being.

You log in to these third party sites (i.e. Google) via their authentication process, they (Google) return a unique token to the website (whatever site is using the third party auth). The token can be verified again to confirm it says "yes, this person's legit", and the website uses this process to authenticate/create your account with their service.

This is kind of hard to explain without getting technical, so you can compare it to, say, using your passport to verify your identity when you try to open a bank account. The bank trusts the passport, provided by a another institution, as verification that you are who you claim to be.

Anyways, Yahoo saw that Google was providing 3rd Party Authentication, and since they're Google's biggest competitor (ha!) they assumed people want a Third Party Authentication service from Yahoo too! Sign in to your favorite websites, using Yahoo!

So they made OneID! OneID was the name of their Third Party Auth. And they wanted all of their internal properties to use it, including Tumblr. The thing is, it only works if you have a Yahoo email address. Not a lot of people on Tumblr have yahoo email addresses. So, to make it easy for Tumblr, they had it set up so that when you use OneID to create a brand new account on Tumblr, you're given a Yahoo email address too! Who wouldn't want that?!

Well, Tumblr users didn't. At least that's what Staff assumed because Tumblr was, well, a bunch of teens and young adults who were net-savvy enough to not be caught dead using Yahoo anymore. Moreover, the sign-up process for OneID was, uh, way more rigorous than Tumblr.

To sign up for Tumblr, you need an email address, a password, and you have to tell them your age. Not your birthday, just your age. That's all Tumblr has ever needed, and was all they ever wanted to ask for from a user. The age was necessary because of laws about using the internet under the age of 13, and of course verifying if you're over 18 (because Tumblr had porn at the time).

To sign up for OneID, though, you had to, well, provide your Yahoo email address, or choose the name of your new Yahoo email address that was about to be bestowed upon you. You needed a password of course. And you needed to provide your date of birth. And your phone number. And, of course, most importantly, your gender. Male or female, please.

Staff took one look at this and saw the shitstorm coming down the mountain. Yahoo wanted your gender for marketing purposes, of course, but Tumblr knew that their users wanted to be as anonymous as possible. Moreover, OneID drops a "male or female?" gender check at signup and anyone who fell outside the gender binary was going to be angry. Staff did not want to anger its generally more progressive userbase than Yahoo's (old people? scammers?).

So, two problems:

1. Tumblr had to use OneID, they didn't have a choice

2. It was going to require all this extra info from new users

3. Yahoo wanted to force existing Tumblr users who signed up to use Tumblr with the regular registration process to re-sign up for Tumblr using OneID

It quickly turned into three problems.

Staff dug their heels in, hard. This was a herculean coordination between high-level stakeholders in the engineering organization, run of the mill engineers, marketing people, support staff, trust and safety, anyone who could find a reason to slow this project down or block it stepped in.

After months of going back and forth, Staff managed to convince Yahoo not to require a phone number for the OneID process, but Yahoo insisted on the gender check. So they compromised by providing a third, "fill in the blank" option where you could type in whatever gender you wanted. By this time, engineers had slowed the progress as much as they could, but enough work was done so that it was ready for initial, internal testing.

I was working on the testing part. Myself and other engineers ensured that the OneID on Tumblr internal test was going to be extremely rigorous! And it would take a while. I mean, it's gotta be secure, it's user authentication, right? First thing we noticed: it was broken as hell. I wish I could remember the technical details, but, at this point it's been too long. Myself and other engineers coordinated massive bug hunts, encouraging as many people within the company to test it as much as possible. You know, to be extra sure it worked properly, and to find as many bugs as they could.

The process found tons and tons of bugs, of course. One of the more curious ones was this: we noticed that if you set your gender as "female", or set your gender as the "fill in the blank" option, you'd get the same type of posts recommended to you during the Tumblr onboarding process. We asked Yahoo why this was happening, and it turned out that they just treated all accounts that chose the "fill in the blank" option as "female" on the backend. Great job, Yahoo. No one would have noticed that. And no, it was never fixed. It was considered "working as expected".

After a drawn-out testing process and more bugfixing, it was finally approaching production readiness. Keep in mind that, during this whole time, Staff was begging leadership not to do this. There were regular, very critical questions about OneID at All Team meetings where David Karp had to force a smile and talk about how great OneID will be for Tumblr. This project was Marissa Mayer's pet project and, ultimately, Staff could not stop it.

The last-ditch effort to block this was to suggest we roll out OneID slowly, using an A/B test, and compare how many people completed accout registration for Tumblr via OneID, vs how many completed account registration for Tumblr via the existing registration process. Can you take a guess as to what the results were?

OneID's new account signup (aka conversion) rates were abysmal. This resulted in more setbacks, negotiations, and tweaks on Yahoo's end to try to encourage users to finish the sign up process. But the users who ended up in the test bucket where they were forced to sign up with OneID never showed better conversion rates.

Then, one day, on slack, after much anticipation and rumors, our Director of Engineering made an announcement to everyone in the org:

"Yahoo authorized us to remove OneID from Tumblr".