Identity brings Microsoft and Internet 2.0 together

Is Open ID the glue we need?

Combat fraud and increase customer satisfaction

Microsoft isn't the only one taking an interest in Open ID. AOL, Yahoo! and Digg have all announced they'll accept Open ID credentials as a way of identifying users online.

But for Microsoft this is more than just a technology partnership. It could be the first real step towards creating the multi-platform, multi-system identity metasystem. Oh, and it could mean one less headache for web developers too.

Mary Branscombe asked Microsoft's Kim Cameron to identify why these deals matter.

Open ID doesn't replace other forms of identity and authorisation; with the identity metasystem, that's not the point. And CardSpace isn't replacing or re-engineering Open ID. When you use your Open ID to log into a site, you currently get redirected to fill in the Open ID provider. In future you'll be able to do that invisibly by using the CardSpace interface in Vista or IE 7 (and eventually in other browsers when they implement the information card system – there are projects under way for Safari and Firefox).

There are some identities you care deeply about; your credit card, the login to your company customer account system - anything with money or private information involved. You create others for the convenience of a website that wants to present you with relevant content (or often advertising). You have to fill in your details and set up a password – and the site has to accept and store those.

It's the latter that Open ID can replace, and do it more securely with CardSpace, according to Microsoft identity architect Kim Cameron.

"There is a continuum of use cases which goes from transferring a billion dollars and the other end is I want to go to your blog. If you have a single technology for that whole thing, it's absurd; it would be like using a nuclear weapon on a mosquito. SAML, WS-Federation and WS-Trust have been solving these very significant problems at the level of government and at the level of enterprise.

"We also have to be able to solve ID problems at the level of emerging services, at the RESTful level. I don't see these as opposite but as a continuum. We need a scalable identity architecture - scalable in terms of how easy it is to deploy."

When Brad Fitzpatrick of LiveJournal first came up with the idea of Open ID he wanted to avoid having either hundreds of passwords or consigning everything to a system like the old Microsoft Passport. Not only does LiveJournal already deal with issuing and managing identities for the thousands of users of its services (including Movable Type and Vox), it also has experience with developing code to support systems that scale.

Fitzgerald is also responsible for memcached, a memory caching system that speeds up database driven websites including Slashdot, Wikipedia, and Digg. Fitzpatrick welcomes Microsoft's involvement because with the combination of Open ID and CardSpace "users should get both convenience and security".

So far, open ID has favoured convenience, but a new assertion quality profile proposed after discussions with Cameron will add more protection from phishing. Cameron says he's often inspired by IBMer James Martin.

"He was a great thinker for IBM in the 80s and he said one thing that has never left my mind: every successful system will attract usage to the point where it becomes unsuccessful. When you're designing technology you have to keep that in mind. As Open ID becomes more successful it'll want to creep up scale and it will become unsuccessful because of these weaknesses. What I felt we had to do was build a mechanism right in from the beginning to deal with this success."

The profile allows the site accepting the Open ID to request a phishing resistant form of authentication – which you could provide through CardSpace using a smartcard or other secured token. That could make Open ID more attractive in the enterprise, and Cameron suggests Microsoft could support that.

"We might provide the option in our server identity products to emit and consume these high quality Open ID credentials. Because of the reach of our products it would help drive it towards the higher level of security without interfering with the reach of Open ID."

But even for the Web 2.0 sites that currently use Open ID, avoiding phishing is a good thing, and Cameron believes getting noticed by the "influencers" behind the sites is key to winning over developers to the idea of the identity metasystem.

"Using CardSpace to log into your Open ID home site: all of those companies are going to support that but they're also very interested in CardSpace Open ID cards so they'll really be part of the metasystem. LiveJournal could have an Open ID card - at that point you could never be phished."

Simplicity has been the key to Open ID's attraction. Development is simple because of the Open ID libraries available from JanRain – and so is deployment.

Instead of a public key or a Kerberos-style pre-distributed key the source of the trust is the URL, so a site doesn't need to worry about a pay-for certificate or an external IP address. Supporting CardSpace doesn't mean a lot of extra coding either, Cameron claims.

"You can decode a CardSpace in three lines of code. Now that Ping has released an Apache module, you can do it with no code and zero work; you just look in your environment and there are the assertions. Now the question is can the models be the same so that the programmer doesn't even know whether they are handling a self issued card or an Open ID? And that's really what we're going to do - make it so it just scales as necessary without changing the programming model." ®

Combat fraud and increase customer satisfaction

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Oh no, Joe: WinPhone users already griping over 8.1 mega-update
Hang on. Which bit of Developer Preview don't you understand?
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
Ditch the sync, paddle in the Streem: Upstart offers syncless sharing
Upload, delete and carry on sharing afterwards?
New Facebook phone app allows you to stalk your mates
Nearby Friends feature goes live in a few weeks
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
prev story


SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.