Here's a post by Scott Kveton, CEO of JanRain, that sums up a meeting we had during the week. JanRain is one of the driving forces behind OpenID, and produces the libraries that a lot of people are integrating into their websites and blogs. JanRain also operates MyOpenId, an identity service that works with OpenID software.
You want to know about the JanRain World Headquarters? Energy radiates from everywhere. Beside our conference table was a very impressive can of Bad Idea Repellant, which seems to have done its job.
For what it's worth, I really liked these people. They are real engineers. They are committed to getting an identity layer in place.
I explained my concerns about the current OpenID proposal and phishing, and they not only ACKed; they had ideas about how to move quickly to change things.
Against this background it was clear how CardSpace could be one important way of strengthening their system and integrating it with others. Meanwhile, I conveyed my enthusiasm for the great simplicity of their proposal.
We talked about public (omnidirectional) and private (unidirectional) identifiers and we all agreed that both were necessary in different contexts. We talked about how OpenID managed Cards could provide CardSpace with strong new capabilities around public personas for web services.
Then the conversation got pretty technical, and I showed a profile of WS-Trust that didn't involve use of a SOAP stack or anything complicated. But over to Scott:
The JanRain engineers were interested in learning more about CardSpace. We’ve heard about it, seen Kim talk and even read his proposal on a way to integrate OpenID and CardSpace. However, we didn’t know enough about the technology to comment on it either way. Also, we wanted to hear more than just marketing hype and hand waving; we wanted some code. Kim and Mike did not disappoint … 🙂
CardSpace is an identity meta-system that you use to manage InfoCards. InfoCards are like the cards in your wallet except these cards you present to sites that you want to visit to identify yourself with. I really believe that Mike and Kim have their hearts in the right place and the technology looks solid. It looks like Microsoft has learned a lot since their last foray into identity. I think OpenID and CardSpace could really compliment each other quite nicely as well as help address the phishing concerns that have become so prevalent.
The CardSpace InfoCard manager is an interface that comes up when the user is presented with a site that supports InfoCard login. Instead of giving the user a login form in the browser that might be phished, the user is presented with a dialog that allows them to deliver an InfoCard for the site they are trying to login to. This dialog is single-modal; you are locked out of doing anything else unless you complete the task at hand. This follows along with what Mike Beltzner shared on the OpenID general list and the difficulties in fighting phishing:
I can also sum things up for you even more succinctly:
– users are task oriented, driving to complete the goal the quickest way possible
– users pay more attention to the content area than the browser chrome
– users don’t understand how easy it is to spoof a website
Kim went through several code examples where we could see how it all worked. Forget SOAP, forget complicated. There is no hook back to the mothership with this technology. As a matter of fact, OpenID and CardSpace could work together quite easily.
CardSpace is really good at handling the issues around phishing and personal privacy. But what if I don’t want to be private about certain things? I like that I can identify myself as me to lots and lots of different sites and I don’t mind if people correlate that data. As a matter of fact, I like it. Wouldn’t it be nice to have an OpenID tied to my InfoCard then? One of the greatest reasons OpenID is succeeding is that its a destination. Its a unique place on the Internet where you can learn more about who I am. Coupled with microformats you start to see some interesting possibilities. CardSpace doesn’t do the public side very well and both Kim and Mike admitted this. This is an interesting possibility for OpenID IMHO. Not only that, it could be done without any changes to sites that already support OpenID. You’d get the benefits of OpenID’s strengths while leveraging the anti-phishing and privacy mojo that CardSpace has.
We already have some great technology for changing the chrome in Firefox and discussions are on-going with Mozilla about how we can integrate this further and have it truly baked in (hopefully they’ll look at Dmitry’s thoughts on this). We’ve got the CardSpace code that is now shipping on Vista and available for Windows XP. We’ve got lots of options for fighting phishing and protecting privacy with more on the way. All of these solutions play to each technologies strengths and actually just might be what we need to get to the identity holy land.
3 thoughts on “Scott Kveton on InfoCard / OpenID convergence”
Comments are closed.