Identity brings Microsoft and Internet 2.0 together

Is Open ID the glue we need?

Secure remote control for conventional and virtual desktops

Microsoft isn't the only one taking an interest in Open ID. AOL, Yahoo! and Digg have all announced they'll accept Open ID credentials as a way of identifying users online.

But for Microsoft this is more than just a technology partnership. It could be the first real step towards creating the multi-platform, multi-system identity metasystem. Oh, and it could mean one less headache for web developers too.

Mary Branscombe asked Microsoft's Kim Cameron to identify why these deals matter.

Open ID doesn't replace other forms of identity and authorisation; with the identity metasystem, that's not the point. And CardSpace isn't replacing or re-engineering Open ID. When you use your Open ID to log into a site, you currently get redirected to fill in the Open ID provider. In future you'll be able to do that invisibly by using the CardSpace interface in Vista or IE 7 (and eventually in other browsers when they implement the information card system – there are projects under way for Safari and Firefox).

There are some identities you care deeply about; your credit card, the login to your company customer account system - anything with money or private information involved. You create others for the convenience of a website that wants to present you with relevant content (or often advertising). You have to fill in your details and set up a password – and the site has to accept and store those.

It's the latter that Open ID can replace, and do it more securely with CardSpace, according to Microsoft identity architect Kim Cameron.

"There is a continuum of use cases which goes from transferring a billion dollars and the other end is I want to go to your blog. If you have a single technology for that whole thing, it's absurd; it would be like using a nuclear weapon on a mosquito. SAML, WS-Federation and WS-Trust have been solving these very significant problems at the level of government and at the level of enterprise.

"We also have to be able to solve ID problems at the level of emerging services, at the RESTful level. I don't see these as opposite but as a continuum. We need a scalable identity architecture - scalable in terms of how easy it is to deploy."

When Brad Fitzpatrick of LiveJournal first came up with the idea of Open ID he wanted to avoid having either hundreds of passwords or consigning everything to a system like the old Microsoft Passport. Not only does LiveJournal already deal with issuing and managing identities for the thousands of users of its services (including Movable Type and Vox), it also has experience with developing code to support systems that scale.

Fitzgerald is also responsible for memcached, a memory caching system that speeds up database driven websites including Slashdot, Wikipedia, and Digg. Fitzpatrick welcomes Microsoft's involvement because with the combination of Open ID and CardSpace "users should get both convenience and security".

So far, open ID has favoured convenience, but a new assertion quality profile proposed after discussions with Cameron will add more protection from phishing. Cameron says he's often inspired by IBMer James Martin.

"He was a great thinker for IBM in the 80s and he said one thing that has never left my mind: every successful system will attract usage to the point where it becomes unsuccessful. When you're designing technology you have to keep that in mind. As Open ID becomes more successful it'll want to creep up scale and it will become unsuccessful because of these weaknesses. What I felt we had to do was build a mechanism right in from the beginning to deal with this success."

The profile allows the site accepting the Open ID to request a phishing resistant form of authentication – which you could provide through CardSpace using a smartcard or other secured token. That could make Open ID more attractive in the enterprise, and Cameron suggests Microsoft could support that.

"We might provide the option in our server identity products to emit and consume these high quality Open ID credentials. Because of the reach of our products it would help drive it towards the higher level of security without interfering with the reach of Open ID."

But even for the Web 2.0 sites that currently use Open ID, avoiding phishing is a good thing, and Cameron believes getting noticed by the "influencers" behind the sites is key to winning over developers to the idea of the identity metasystem.

"Using CardSpace to log into your Open ID home site: all of those companies are going to support that but they're also very interested in CardSpace Open ID cards so they'll really be part of the metasystem. LiveJournal could have an Open ID card - at that point you could never be phished."

Simplicity has been the key to Open ID's attraction. Development is simple because of the Open ID libraries available from JanRain – and so is deployment.

Instead of a public key or a Kerberos-style pre-distributed key the source of the trust is the URL, so a site doesn't need to worry about a pay-for certificate or an external IP address. Supporting CardSpace doesn't mean a lot of extra coding either, Cameron claims.

"You can decode a CardSpace in three lines of code. Now that Ping has released an Apache module, you can do it with no code and zero work; you just look in your environment and there are the assertions. Now the question is can the models be the same so that the programmer doesn't even know whether they are handling a self issued card or an Open ID? And that's really what we're going to do - make it so it just scales as necessary without changing the programming model." ®

Security for virtualized datacentres

More from The Register

next story
Microsoft WINDOWS 10: Seven ATE Nine. Or Eight did really
Windows NEIN skipped, tech preview due out on Wednesday
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story


Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.