Feeds

Identity brings Microsoft and Internet 2.0 together

Is Open ID the glue we need?

5 things you didn’t know about cloud backup

Microsoft isn't the only one taking an interest in Open ID. AOL, Yahoo! and Digg have all announced they'll accept Open ID credentials as a way of identifying users online.

But for Microsoft this is more than just a technology partnership. It could be the first real step towards creating the multi-platform, multi-system identity metasystem. Oh, and it could mean one less headache for web developers too.

Mary Branscombe asked Microsoft's Kim Cameron to identify why these deals matter.

Open ID doesn't replace other forms of identity and authorisation; with the identity metasystem, that's not the point. And CardSpace isn't replacing or re-engineering Open ID. When you use your Open ID to log into a site, you currently get redirected to fill in the Open ID provider. In future you'll be able to do that invisibly by using the CardSpace interface in Vista or IE 7 (and eventually in other browsers when they implement the information card system – there are projects under way for Safari and Firefox).

There are some identities you care deeply about; your credit card, the login to your company customer account system - anything with money or private information involved. You create others for the convenience of a website that wants to present you with relevant content (or often advertising). You have to fill in your details and set up a password – and the site has to accept and store those.

It's the latter that Open ID can replace, and do it more securely with CardSpace, according to Microsoft identity architect Kim Cameron.

"There is a continuum of use cases which goes from transferring a billion dollars and the other end is I want to go to your blog. If you have a single technology for that whole thing, it's absurd; it would be like using a nuclear weapon on a mosquito. SAML, WS-Federation and WS-Trust have been solving these very significant problems at the level of government and at the level of enterprise.

"We also have to be able to solve ID problems at the level of emerging services, at the RESTful level. I don't see these as opposite but as a continuum. We need a scalable identity architecture - scalable in terms of how easy it is to deploy."

When Brad Fitzpatrick of LiveJournal first came up with the idea of Open ID he wanted to avoid having either hundreds of passwords or consigning everything to a system like the old Microsoft Passport. Not only does LiveJournal already deal with issuing and managing identities for the thousands of users of its services (including Movable Type and Vox), it also has experience with developing code to support systems that scale.

Fitzgerald is also responsible for memcached, a memory caching system that speeds up database driven websites including Slashdot, Wikipedia, and Digg. Fitzpatrick welcomes Microsoft's involvement because with the combination of Open ID and CardSpace "users should get both convenience and security".

So far, open ID has favoured convenience, but a new assertion quality profile proposed after discussions with Cameron will add more protection from phishing. Cameron says he's often inspired by IBMer James Martin.

"He was a great thinker for IBM in the 80s and he said one thing that has never left my mind: every successful system will attract usage to the point where it becomes unsuccessful. When you're designing technology you have to keep that in mind. As Open ID becomes more successful it'll want to creep up scale and it will become unsuccessful because of these weaknesses. What I felt we had to do was build a mechanism right in from the beginning to deal with this success."

The profile allows the site accepting the Open ID to request a phishing resistant form of authentication – which you could provide through CardSpace using a smartcard or other secured token. That could make Open ID more attractive in the enterprise, and Cameron suggests Microsoft could support that.

"We might provide the option in our server identity products to emit and consume these high quality Open ID credentials. Because of the reach of our products it would help drive it towards the higher level of security without interfering with the reach of Open ID."

But even for the Web 2.0 sites that currently use Open ID, avoiding phishing is a good thing, and Cameron believes getting noticed by the "influencers" behind the sites is key to winning over developers to the idea of the identity metasystem.

"Using CardSpace to log into your Open ID home site: all of those companies are going to support that but they're also very interested in CardSpace Open ID cards so they'll really be part of the metasystem. LiveJournal could have an Open ID card - at that point you could never be phished."

Simplicity has been the key to Open ID's attraction. Development is simple because of the Open ID libraries available from JanRain – and so is deployment.

Instead of a public key or a Kerberos-style pre-distributed key the source of the trust is the URL, so a site doesn't need to worry about a pay-for certificate or an external IP address. Supporting CardSpace doesn't mean a lot of extra coding either, Cameron claims.

"You can decode a CardSpace in three lines of code. Now that Ping has released an Apache module, you can do it with no code and zero work; you just look in your environment and there are the assertions. Now the question is can the models be the same so that the programmer doesn't even know whether they are handling a self issued card or an Open ID? And that's really what we're going to do - make it so it just scales as necessary without changing the programming model." ®

Boost IT visibility and business value

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
Intel's Raspberry Pi rival Galileo can now run Windows
Behold the Internet of Things. Wintel Things
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Eat up Martha! Microsoft slings handwriting recog into OneNote on Android
Freehand input on non-Windows kit for the first time
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.