Feeds

Identity brings Microsoft and Internet 2.0 together

Is Open ID the glue we need?

Choosing a cloud hosting partner with confidence

Microsoft isn't the only one taking an interest in Open ID. AOL, Yahoo! and Digg have all announced they'll accept Open ID credentials as a way of identifying users online.

But for Microsoft this is more than just a technology partnership. It could be the first real step towards creating the multi-platform, multi-system identity metasystem. Oh, and it could mean one less headache for web developers too.

Mary Branscombe asked Microsoft's Kim Cameron to identify why these deals matter.

Open ID doesn't replace other forms of identity and authorisation; with the identity metasystem, that's not the point. And CardSpace isn't replacing or re-engineering Open ID. When you use your Open ID to log into a site, you currently get redirected to fill in the Open ID provider. In future you'll be able to do that invisibly by using the CardSpace interface in Vista or IE 7 (and eventually in other browsers when they implement the information card system – there are projects under way for Safari and Firefox).

There are some identities you care deeply about; your credit card, the login to your company customer account system - anything with money or private information involved. You create others for the convenience of a website that wants to present you with relevant content (or often advertising). You have to fill in your details and set up a password – and the site has to accept and store those.

It's the latter that Open ID can replace, and do it more securely with CardSpace, according to Microsoft identity architect Kim Cameron.

"There is a continuum of use cases which goes from transferring a billion dollars and the other end is I want to go to your blog. If you have a single technology for that whole thing, it's absurd; it would be like using a nuclear weapon on a mosquito. SAML, WS-Federation and WS-Trust have been solving these very significant problems at the level of government and at the level of enterprise.

"We also have to be able to solve ID problems at the level of emerging services, at the RESTful level. I don't see these as opposite but as a continuum. We need a scalable identity architecture - scalable in terms of how easy it is to deploy."

When Brad Fitzpatrick of LiveJournal first came up with the idea of Open ID he wanted to avoid having either hundreds of passwords or consigning everything to a system like the old Microsoft Passport. Not only does LiveJournal already deal with issuing and managing identities for the thousands of users of its services (including Movable Type and Vox), it also has experience with developing code to support systems that scale.

Fitzgerald is also responsible for memcached, a memory caching system that speeds up database driven websites including Slashdot, Wikipedia, and Digg. Fitzpatrick welcomes Microsoft's involvement because with the combination of Open ID and CardSpace "users should get both convenience and security".

So far, open ID has favoured convenience, but a new assertion quality profile proposed after discussions with Cameron will add more protection from phishing. Cameron says he's often inspired by IBMer James Martin.

"He was a great thinker for IBM in the 80s and he said one thing that has never left my mind: every successful system will attract usage to the point where it becomes unsuccessful. When you're designing technology you have to keep that in mind. As Open ID becomes more successful it'll want to creep up scale and it will become unsuccessful because of these weaknesses. What I felt we had to do was build a mechanism right in from the beginning to deal with this success."

The profile allows the site accepting the Open ID to request a phishing resistant form of authentication – which you could provide through CardSpace using a smartcard or other secured token. That could make Open ID more attractive in the enterprise, and Cameron suggests Microsoft could support that.

"We might provide the option in our server identity products to emit and consume these high quality Open ID credentials. Because of the reach of our products it would help drive it towards the higher level of security without interfering with the reach of Open ID."

But even for the Web 2.0 sites that currently use Open ID, avoiding phishing is a good thing, and Cameron believes getting noticed by the "influencers" behind the sites is key to winning over developers to the idea of the identity metasystem.

"Using CardSpace to log into your Open ID home site: all of those companies are going to support that but they're also very interested in CardSpace Open ID cards so they'll really be part of the metasystem. LiveJournal could have an Open ID card - at that point you could never be phished."

Simplicity has been the key to Open ID's attraction. Development is simple because of the Open ID libraries available from JanRain – and so is deployment.

Instead of a public key or a Kerberos-style pre-distributed key the source of the trust is the URL, so a site doesn't need to worry about a pay-for certificate or an external IP address. Supporting CardSpace doesn't mean a lot of extra coding either, Cameron claims.

"You can decode a CardSpace in three lines of code. Now that Ping has released an Apache module, you can do it with no code and zero work; you just look in your environment and there are the assertions. Now the question is can the models be the same so that the programmer doesn't even know whether they are handling a self issued card or an Open ID? And that's really what we're going to do - make it so it just scales as necessary without changing the programming model." ®

Internet Security Threat Report 2014

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Entity Framework goes 'code first' as Microsoft pulls visual design tool
Visual Studio database diagramming's out the window
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.