Feeds

Identity brings Microsoft and Internet 2.0 together

Is Open ID the glue we need?

Security for virtualized datacentres

Microsoft isn't the only one taking an interest in Open ID. AOL, Yahoo! and Digg have all announced they'll accept Open ID credentials as a way of identifying users online.

But for Microsoft this is more than just a technology partnership. It could be the first real step towards creating the multi-platform, multi-system identity metasystem. Oh, and it could mean one less headache for web developers too.

Mary Branscombe asked Microsoft's Kim Cameron to identify why these deals matter.

Open ID doesn't replace other forms of identity and authorisation; with the identity metasystem, that's not the point. And CardSpace isn't replacing or re-engineering Open ID. When you use your Open ID to log into a site, you currently get redirected to fill in the Open ID provider. In future you'll be able to do that invisibly by using the CardSpace interface in Vista or IE 7 (and eventually in other browsers when they implement the information card system – there are projects under way for Safari and Firefox).

There are some identities you care deeply about; your credit card, the login to your company customer account system - anything with money or private information involved. You create others for the convenience of a website that wants to present you with relevant content (or often advertising). You have to fill in your details and set up a password – and the site has to accept and store those.

It's the latter that Open ID can replace, and do it more securely with CardSpace, according to Microsoft identity architect Kim Cameron.

"There is a continuum of use cases which goes from transferring a billion dollars and the other end is I want to go to your blog. If you have a single technology for that whole thing, it's absurd; it would be like using a nuclear weapon on a mosquito. SAML, WS-Federation and WS-Trust have been solving these very significant problems at the level of government and at the level of enterprise.

"We also have to be able to solve ID problems at the level of emerging services, at the RESTful level. I don't see these as opposite but as a continuum. We need a scalable identity architecture - scalable in terms of how easy it is to deploy."

When Brad Fitzpatrick of LiveJournal first came up with the idea of Open ID he wanted to avoid having either hundreds of passwords or consigning everything to a system like the old Microsoft Passport. Not only does LiveJournal already deal with issuing and managing identities for the thousands of users of its services (including Movable Type and Vox), it also has experience with developing code to support systems that scale.

Fitzgerald is also responsible for memcached, a memory caching system that speeds up database driven websites including Slashdot, Wikipedia, and Digg. Fitzpatrick welcomes Microsoft's involvement because with the combination of Open ID and CardSpace "users should get both convenience and security".

So far, open ID has favoured convenience, but a new assertion quality profile proposed after discussions with Cameron will add more protection from phishing. Cameron says he's often inspired by IBMer James Martin.

"He was a great thinker for IBM in the 80s and he said one thing that has never left my mind: every successful system will attract usage to the point where it becomes unsuccessful. When you're designing technology you have to keep that in mind. As Open ID becomes more successful it'll want to creep up scale and it will become unsuccessful because of these weaknesses. What I felt we had to do was build a mechanism right in from the beginning to deal with this success."

The profile allows the site accepting the Open ID to request a phishing resistant form of authentication – which you could provide through CardSpace using a smartcard or other secured token. That could make Open ID more attractive in the enterprise, and Cameron suggests Microsoft could support that.

"We might provide the option in our server identity products to emit and consume these high quality Open ID credentials. Because of the reach of our products it would help drive it towards the higher level of security without interfering with the reach of Open ID."

But even for the Web 2.0 sites that currently use Open ID, avoiding phishing is a good thing, and Cameron believes getting noticed by the "influencers" behind the sites is key to winning over developers to the idea of the identity metasystem.

"Using CardSpace to log into your Open ID home site: all of those companies are going to support that but they're also very interested in CardSpace Open ID cards so they'll really be part of the metasystem. LiveJournal could have an Open ID card - at that point you could never be phished."

Simplicity has been the key to Open ID's attraction. Development is simple because of the Open ID libraries available from JanRain – and so is deployment.

Instead of a public key or a Kerberos-style pre-distributed key the source of the trust is the URL, so a site doesn't need to worry about a pay-for certificate or an external IP address. Supporting CardSpace doesn't mean a lot of extra coding either, Cameron claims.

"You can decode a CardSpace in three lines of code. Now that Ping has released an Apache module, you can do it with no code and zero work; you just look in your environment and there are the assertions. Now the question is can the models be the same so that the programmer doesn't even know whether they are handling a self issued card or an Open ID? And that's really what we're going to do - make it so it just scales as necessary without changing the programming model." ®

Internet Security Threat Report 2014

More from The Register

next story
ONE MILLION people already running Windows 10
A third of them are doing it in VMs, but early feedback focuses on frippery
Sign off my IT project or I’ll PHONE your MUM
Honestly, it’s a piece of piss
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
Torvalds CONFESSES: 'I'm pretty good at alienating devs'
Admits to 'a metric ****load' of mistakes during work with Linux collaborators
Sway: Microsoft's new Office app doesn't have an Undo function
Content aggregation, meet the workplace ... oh
Do Moan! MONSTER 6-day EMAIL OUTAGE hits Domain Monster
Customers freaked out by frightful service
Ploppr: The #VultureTRENDING App of the Now
This organic crowd sourced viro- social fertiliser just got REAL
Return of the Jedi – Apache reclaims web server crown
.london, .hamburg and .公司 - that's .com in Chinese - storm the web server charts
NetWare sales revive in China thanks to that man Snowden
If it ain't Microsoft, it's in fashion behind the Great Firewall
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.