HelloWorld Information Cards

One of the most important things about the Information Card paradigm is that the cards are just ways for the user to represent and employ digital identities (meaning sets of claims about a subject). 

The paradigm doesn't say anything about what those claims look like or how they are encoded.  Nor does it say anything about the cryptographic (or other) mechanisms used to validate the claims. 

You can really look at the InfoCard technology as just being

  1. a way that a relying party can ask for claims of “some kind”;
  2. a safe environment through which the user can understand what's happening; and
  3. the tubing through which a related payload is transfered from the user-approved identity provider to the relying party.  The goal is to satisfy the necessary claim requirements. 

If you have looked at other technologies for exchanging claims (they not called that, but are at heart the same thing), you will see this system disentangles the communication protocol, the trust framework and the payload formats, whereas previous systems conflated them.  Because there are now three independent axes, the trust frameworks and payloads can evolve without destabilizing anything.

CardSpace “comes with” a “simple self-asserted identity provider” that uses the SAML 1.1 token format.  But we just did that to “bootstrap” the system.  You could just as well send SAML 2.0 tokens through the tubing.  In fact, people who have followed the Laws of Identity and Identity Metasystem discussions know that the fifth law of identity refers to a pluralism of operators and technologies.  When speaking I've talked about why different underlying identity technologies make sense, and compared this pluralism to the plurality of transport mechanisms underlying TCP/IP.  I've spoken about the need to be “token agnostic” – and to be ready for new token formats that can use the same “tubing”.

There have been some who have rejected the open “meta” model in favor of just settling on tokens in the “concept de jour”.  They urge us to forget about all these subtleties and just adopt SAML, or PKI, or whatever else meets someone's use cases.  But the sudden rise of OpenID shows exactly why we need a token-agnostic system.  OpenID has great use cases that we should all recognize as important.  And because of the new metasystem architecture, OpenID payloads can be selected and conveyed safely through the Information Card mechanisms just as well as anything else.  To me it is amazing that the identity metasystem idea isn't more than a couple of years old and yet we already have an impressive new identity technology arising.  It provides an important example of why an elastic system like CardSpace is architecturally right. 

It's sometimes hard to explain how all this works under the hood.  So I've decided to give a tutorial about “HelloWorld” cards.  They don't follow any format previously known to man – or even woman.  They're just someting made up to show elasticity.  But I'm hoping that when you understand how the HelloWorld cards work, it will help you see the tremendous possibilities in the metasystem model.

The best way to follow this tutorial is to actually try things out.  If you want to participate, install CardSpace on XP or use Vista, download a HelloWorld Card and kick the tires.  (I'm checking now to see if other selector implementations will support this.  If not, I know that compatibility is certainly the intention on everyones’ part). 

The HelloWord card is just metadata for getting to a “helloworld” identity server.  In upcoming posts I'll explain how all this works in a way that I hope will make the technology very clear.  I'll also make the source code available.  An interesting note here:  the identity server is just a few hundred lines of code. 

To try it out, enter a login name and download a card (if you don't enter a name, you won't get an error message right now but the demonstration won't work later).  Once you have your card, click on the InfoCard icon here.  You'll see how the HelloWorld token is transferred to the relying party web site. 

This card uses passwords for authentication to the HelloWorld identity provider, and any password will do. 

Continue here…

Wouldn't it be more correct?

I'd like to share this interesting comment by Francis Shanahan, who works on identity from the vantage point of Citi:

“Your blog talks about “Cardspace enabling Apache”. Regarding the language in the post, I know I'm being picky here but…

“Wouldn't it be more correct to say “XML Tokens as an additional authentication…” rather than “…Information Cards as an additional authentication mechanism…” since I can use Kerberos or SAML tokens with Cardspace over WS-Fed.

“Wouldn't it be more correct to say “token enable” rather than “Cardspace enable”? I don't need to use the Cardspace selector with a WS-Trust enabled site.

“Wouldn't it be more correct to say “The whole identity token processing can…” rather than “The whole cardspace processing can…” and so on.  CardSpace is just the ID selector used to faciliate the token exchange.

“Just don't want to confuse folks thinking there's a Cardspace specific token.”

First I'll say that technically speaking I think you make good points, and I'll try to be as careful as I can to bring out these ideas.

Then, since pointing the finger at someone else is so fashionable, I'll say I was quoting what another company said it was doing.  (That, in itself, is interesting.)

But most important, I'll argue that the simplification of our current ideas into “iconic” notions is inevitable, and worthwhile, even though subtleties will be lost.  So we have to achieve a balance between the irreconcilables of breadth and accuracy.

I'll start with an analogy – the analogy to file and folder icons.  Computer scientists know files are potentially complex mappings of streams of bits onto blocks of storage.  They know folders are doubly linked lists of pointers to these streams of bits.  But if they're smart, they keep all of this to themselves – even when they're with other computer scientists and the door is closed.  If we told people about the inner workings of file systems, we'd drive them crazy.  In fact, they still wouldn't know how to manage documents or pictures or music.

Instead, people have gotten used to little pictures of files, and drag them from one “folder” to another – or even “onto” their mp3 players.  Our official help files say things like “Double click on the document to open it”.  We conveniently overlook the fact that the document exists as magnetic fields on the hard disk and you can't double click them.

There is a dualism between the science of the thing and the way we conceive of it in usage, just as there is in all aspects of reality.

When we invent new technologies, we start from the science, and it's really hard to explain what one is doing.  It takes months or even years to develop an “elevator pitch” – the ten second description of what you've done that makes it seem worth doing.  But that doesn't actually matter much, assuming you get funding.  What matters is the way the idea eventually enters mainstream consciousness.

It is inevitable that marketers will talk about products (CardSpace, Higgins, etc) rather than technology.

While people will “get” that something is being transferred when you authenticate or authorize, I suspect they'll always see the visual image as being the identity itself, with few understanding it as “a means to manage the metadata enabling connectivity between identity providers and relying parties”. 

I think protocols like WS-Federation and WS-Trust will be more or less invisible except to backbone engineers.

Once we get an Information Card icon out there and people start to use it, I think people will take it as meaning “Information Cards accepted here” – and that, in their minds, will be synonymous with CardSpace or whatever Information Card selector they run on their devices.  They'll realize that some sites want some cards and other sites want others, but will never think about token types.

So my reading is that Ping, which developed the Apache product being referred to, is already thinking about how to present a message that begins to deal with taking Information Cards to a wider audience.  Not out of the technology ghetto yet, but to a wider audience within the very busy technology community.  It would be interesting to hear what Andre Durand has to say about this.

 

Can browser-based plugins solve OP phishing?

Dready blog writes about OpenID phishing and proposes a browser plugin that introduces a delay in the dialog box before it can be dismissed.

“The OpenID phishing issue is a hard one to solve, particularly because it aims to:

  1. be user-friendly, i.e. it should pass the mother-in-law test; and
  2. work on the web platform without special software or browser plugin

“So, why is this suddenly a problem?

“Not really, phishing is a perennial problem on the Internet that researchers and developers have been trying to solve for many years now. OpenID just accentuates it because RPs are unregulated. You don’t need any agreement with any OP, essentially anyone can set up a web site and put the OpenID login button. If OpenID takes off, RP sites will grow like ’shrooms and user will get used to the idea that if they see the OpenID logo, they can type their URL to login. This only makes it harder for users to discern the good RPs from the bad ones.”

Actually, the problem is worse than the one we currently face.  We are not just dealing with “the perennial problem”.  If you use one OpenID account to go to two hundred sites, the thief who steals your OpenID credentials gains access to any of the 200 sites.  That's new. 

“This is really a social problem, and not a fault of the OpenID protocol. Users need only to trust their OP, and not the RPs that they interact with. If a rogue RP sends you to a page the poses as your OP but the URL doesn’t match your OP’s, you bail out. Doesn’t that sound simple? Well, the cold hard fact is that phishing works and there is research1 to prove that people get tricked very easily.”

Dready's right about the research.  But rather than calling it a “social problem” I'd call it a “social engineering attack”.  Further, there is a protocol problem.  The protocol is based on telling the RP where the OP is located – such that an evil site can automate a “man in the middle attack”.  Some other protocols, including the one used by CardSpace, do NOT have this problem.  That's why combining CardSpace and OpenID is useful. 

“Numerous ideas to mitigate phishing attacks have been floating around the OpenID list and on the OpenID mini-blogsphere. Ben Laurie argues for a client-side solution:

‘Authentication on the web is broken, and has been for a long time. The OpenID fanboys want OpenID to work on any old platform using only standard software, and so therefore are doomed to live in the world of broken authentication. This is fine if what you protect with your OpenID is worthless, but it seems clear that these types of protocol are going to be used to authenticate for things of value.    

…

'This is the root of the problem: if you want to protect anything of value, you have to do better than existing Web solutions. You need better client-side software.’

“The picture is not so sunny, however, because most users:

  • won’t know / bother to install specialized plug-in or upgrade their browsers unless they’re forced to
  • won’t know the difference between citibank.com/signon and citibank.com-banking-foobar.com

“And even if they installed those anti-phishing toolbars and what not, they still fall for it!

“While I can’t decipher the wirings of the mums-and-dads who fall prey for phishing attacks, I know that I get lazy sometimes and just don’t bother. Then I remember this little trick that Firefox introduced to ensure that users get the warning before installing extensions — Introduce a delay in the dialog box before it can be dismissed. That sort of worked for me, at least for that 5 seconds I can’t click so I might as well read a little.”  (Code follows here…)

This may help Dready and in that sense it may be a welcome finger in the dike.  But as OpenID becomes successful and is used for sites of value, this kind of solution clearly won't stand up to attack or scale to embrace the population.

People really need to think about what it will mean to actually have “single signon”, rather than just talk about it. 

You cannot overestimate the value of your single signon credentials, or the extent to which they will attract attack.

I don't think browser-based solutions will do anything for us long term – the whole point of browsers is to make it easy to introduce cool new behaviors and empower the RP to give the user great experience.  They are vulnerable because they put the RP in control – by design

This doesn't mean plugins can't play a role in getting us to our destination.  But ultimately, you need defense in depth, many layers of defense.  If we think of the browser as a “broadband communications channel” inundating the user with information, we also need a “narrowband communications channel” honed to protection of the user.  The CardSpace work represents an attempt to create this.

 

Tailrank blog links

Tailrank did a nice summary of some of the blogging around our announcement. It's a cools site, where the results look something like this:

 

CardSpace & OpenID: Working together

kveton.com  

Found 4 days ago
The OpenID community has been having quite a few discussions about phishing and what we can do to help mitigate that problem. We have come up with a whole list of solutions that work together nicely to help address the problem. …
 

Microsoft and OpenID – commentary

identity20.com  

Found 4 days ago
Here are other posts on Microsoft and OpenID announcement: Kim Cameron (Microsoft) post Michael Grave (VeriSign) post “this is a significant step toward the convergence needed in the identity space” David Recordon (VeriSign) post “Convergence isn't new for OpenID, rather continues to show how …
 

Microsoft to Support OpenID Log on System

thomashawk.com  

Found 4 days ago
Time, Walk, Step, Turn Hosted on Zooom r [I am CEO of Zooomr] WIRED Blogs: 27B Stroke 6 : In a keynote speech at the RSA security conference earlier today Bill Gates reportedly announced that Microsoft was going to support OpenID. …
 

Microsoft Working on OpenID Support

25hoursaday.com  

Found 4 days ago
It looks like we just announced that we'll be supporting OpenID at the RSA conference. Official details are in the press release Microsoft Outlines Vision to Enable Secure and Easy Anywhere Access for People and Organizations which states To further enable the vision of secure and easy anywhere access, …
 

blogs.zdnet.com  

Found 4 days ago

With the Vista launch behind him, Bill Gates and Craig Mundie, Microsoft's chief research and strategy officer and security patron, were on stage the 16th annual RSA Conference in San Francisco before a crowd of about 15,000 security geeks and professionals. …

 

factoryjoe.com  

Found 4 days ago

You can read it around the web, but, hot on the heels of the creation of the OpenID Foundation , the news from the RSA Security conference is that Bill Gates has announced Microsoft's intention to support OpenID 2. …

 

saunderslog.com  

Found 3 days ago

Sometimes wishes to come true. It was only a few days ago that I posted a rant about Yahoo's decision to impose Yahoo ID's on Flickr account holders . And I was just one of the many voices in the blogosphere raised against Yahoo's decision. …

 

hyperthink.net  

Found 3 days ago

There's lots of buzz in the blogosphere today about the big Cardspace/OpenId collaboration that was announced this morning at RSA. Whodathunk that a technology rooted in the RESTful open source ecosystem could intermingle with a technology built by the WS-* wonks without trigging some bizarre matter/antimatter explosion. …

 

equalsdrummond.name  

Found 4 days ago

User-centric identity infrastructure just took another key step forward today: Janrain, Sxip, Verisign, and Microsoft announced they will all be working together to help OpenID users get the benefits of CardSpace and vice versa. …

 

brad.livejournal.com  

Found 4 days ago

http://kveton.com/blog/?p=221

 

blog.wachob.com  

Found 4 days ago

For those of us who've been helping to promote OpenID, today's announcement that Microsoft will work to get OpenID and Cardspace working well together is absolutely no surprise. Kim Cameron, Mike Jones and the rest of the crew have been saying both very rosy things, as well as giving some well-appreciated constructive criticism. …

 

vecosys.com  

Found 3 days ago

Unbelievably sleepy old Microsoft (we spend $4bn on R&D but has anyone seen a return) beats dithering Yahoo (should we support it or should we buy OpenID) and arrogant Google (we hate OpenID and Microformats, we only use complicated stuff we invent) to officially announce support for the OpenID movement today at the RSA conference. …

 

oreillynet.com  

Found 3 days ago

Just when you thought it was safe to make assumptions regarding whether or not MSFT understood the ” Don't Fight The Internet ” rule of doing business on the 2. …

 

phildawes.net  

Found 3 days ago

Microsoft, Verisign, Sxip and JanRain have announced that they will all support the OpenID protocol in their upcoming products. Kim Cameron has the scoop (but then he would have, being the ‘Chief Architect of Identity’ at Microsoft). …

 

nelh.blogspot.com  

Found 3 days ago

CardSpace OpenID collaboration :

 

daveman692.livejournal.com  

Found 4 days ago

http://netmesh.info/jernst/Digital_Iden

 

benlog.com  

Found 4 days ago

(There's always a dilemma between “publishing soon” and “polishing for peer review.” This is my first attempt at blog-based collaborative peer-review. Let's see how it goes!) The Problem Phishing is a serious issue, and it's only getting worse. …

 

lagesse.org  

Found 3 days ago

This is great news for the OpenID community – having companies like Verisign and Microsoft onboard certainly help the chances of achieving a way to manage your persona on the web! OpenID ( Radar post ) got a big boost today when it gained support from Microsoft . …

 

kaliyasblogs.net  

Found 4 days ago

This morning at RSA Bill Gates and Craig Mundie announced MSFT support of OpenID2.0 . ( Johannes has a good summary of the points they made too ) I wouldn't go so far to say that they got Married. But what exactly was announced? …

 

internet.seekingalpha.com  

Found 3 days ago

Thomas Hawk submits: In a keynote speech at the RSA security conference yesterday, Bill Gates reportedly announced that Microsoft was going to support OpenID. OpenID is an open, decentralized identity system that attempts to provide a solution to the multiple log on ID systems to access various sites across the internet. …

 

chimprawk.blogspot.com  

Found 3 days ago

I'm proud to announce that, as of this morning, we are going to be taking ClaimID in a slightly new direction. We're going to be concentrating our efforts on being an OpenID provider, one that is extremely simple and easy to use. …

 

blog.broadbandmechanics.com  

Found 3 days ago

So I haven't had any time to talk to Kim or Dick – but here's my take on this deal between Microsoft and their CardSpace/InfoCards standards efforts and the OpenID community (Sxip, JanRain and Verisign. …

 

blog.broadbandmechanics.com  

Found 3 days ago

Microsoft and the OpenID community have decided to support each other. In depth coverage here. Congrats to all! THis is important news! Getting Microsoft to recognize and then support an open effort like OpenID is a first step. …

Cool Tailrank page

I love Tailrank and its little pictures of blogs as this page on the CardSpace OpenID Collaboration Announcement shows.  I wonder how long the pages persist?  I'll have to remember to come back and look at this link in a couple of months.

Meanwhile, I thought I would explore Tailrank further and got to the part where I had to sign in and said to myself, “No, I don't have time for that”. 

Then it occured that this was just one more concrete example of a Web 2.0 opportunity going down the drain.

It seems so clear to me the Web 2.0 community should climb on board this user-centric identity thing ASAP. 

 

Apache Authentication Module for CardSpace

Yesterday I referred to a mind-altering announcement from Ping Identity Corporation.  I think it's a key piece of the identity puzzle.  Since it's obvious that this is a big accomplishment and that he's played a major role in it, I'll quote Ashish Jain's Identity TIcker blog: 

Thanks to the efforts of our labs team, we finally have the ‘Apache Authentication Module for CardSpace‘ available for download .

Here is the product description from the SourceID website:

“The Apache Authentication Module for CardSpace is an open source module that allows applications using an Apache server for hosting or proxy to use Information Cards as an additional authentication mechanism. It allows the Apache applications to act as CardSpace relying parties (RP) by means of simple configuration. The module is responsible for decrypting the tokens submitted by CardSpace, retrieving the claims and making them available for the applications’ use.”

The idea behind this is simple. If you have an application that is deployed on an Apache server and you want to CardSpace-enable it, drop in the module (along with the dependencies), change the httpd.conf and your application should have access to the claims in the infocard.

The post includes proof that these guys were coding twenty-four hours a day.

To my mind this is really huge.  I wonder if one day we'll see it become a part of Apache, just like the password and digest authentication modules.

The whole cardspace processing can be a black box for the administrators

The module puts the attributes in the session. So if you have a PHP application, you can do the following to retrieve the attributes

$email = $_ENV[‘auth_infocard_env_emailaddress’]
$ppid = $_ENV[‘auth_infocard_env_privatepersonalidentifier’]

The same thing works in any other programming language, since they all give you access to your environment variables.

So this is pretty much as simple as it gets.  I hope everyone with a product that runs on Apache will look at this.

But wait!  There's more!  When I wrote to Ashish to congratulate him on this development, he added:

We also have a .jar file for java that serves the similar purpose (we internally refer it as the cardspace-magic.jar and we will open source some day). Same idea…drop the .jar file in,  then:

xmltoken in -> attribute’s map out

So if you use Java, you can go that way too.

But wait! There's still more!!

Yes, folks, Ping Identity is actually showing a demo at RSA of some of the very ideas we've been discussing over the last couple of days.  Namely, use of CardSpace to log in to OpenID sites.  I'll do another post to sow you some screen shots.

Structuring our announcement

Identity Woman Kaliya, who is a key community figure and has played a pivotal role in bringing everyone together, posted this (and this) about yesterday's announcement:

This morning at RSA Bill Gates and Craig Mundie announced MSFT support of OpenID2.0. (Johannes has a good summary of the points they made too) I wouldn’t go so far to say that they got Married. But what exactly was announced? I spoke with David Recordon and Mike Jones after the announcement. (this picture is before the announcement).

The OpenID Relying parties will be able to request that the authentication be done in a Phising resistant way. Then the OpenID Provider will have it a way to assert that the authentication of the OpenID (a URL or XRI/I-name) has been done in a Phishing resistant way. CardSpace will be available as a primary way of providing this kind of authentication (for users on Windows machines).

This is a very exciting development as it expands the options available to users. Their are issues with Phishing in OpenID (as outlined here by Kim) and addressing this hole is key to making it a viable protocol that is good for users.

Kim talks about is request to the OpenID community in the blogosphere and in the meeting they had last week at JanRain (Scott blogged about that here).

My big ask was to add a way to request credentials based on phishing-resistant authentication…..[so that] the system is built to handle the dangers that would come with its own success.

The one question I have about this collaboration announcement why Cordance, NetMesh and other companies who have made major contributions and have critical stakes in the OpenID community were not listed in the announcement. I know it was pulled together very quickly but I think the contributions of those two companies have been extensive and deserved mention (and yes! they do have ‘code’).

There was also no mention of like Brad Fitzpatrick the originator of the OpenID and his company LiveJournal which is now a part of SixAppart.

This is a good question.  As I pointed out yesterday, NetMesh was one of the orginators of OpenID.  Drummon Reed and Cordance have been big proponents too, and brought their i-names and XRI technology to the party.  Brad proposed the initial concept.  There are lots of creative people and companies who are playing their part in all of this, and I consider most of them to friends.

So since, as Gabe says, everything about this announcement – and identity work in general – should be perfectly transparent, let me share what I was thinking while working on this.

I've been involved in big announcements a number of times, and they take months to pull off.  Every PR department from every company has to get involved.  Each has a constituency and message that it wants to be clear.  Every time a change is made it has to go everyone else for approval, often provoking a further change, and so it just takes time.  You plan well ahead for these things, and commit near full-time resources.

We didn't have that luxury.  Nor was this meant to be PR as such.  It was a matter of the industry shaping itself through collaboration, and doing it in the blogosphere – the only place where these magical things can happen.  The fact that Bill and Craig thought all of this was important and exciting gave us all a sudden opportunity for time travel.

If I wanted this to happen in a short time, I needed to work with representatives, not the whole community, and even then, have a great deal of luck.  But to do this without offending everyone involved, I felt we needed an objective criterion for deciding who to approach to represent the OpenID community.

It seemed to me that the best representatives were the editors of the OpenID 2.0 specification.  After all, they are at the center of landing this baby.  And the editors are David Recordon at VeriSign, Johnny Bufu at SXIP, and Josh Hoyt at JanRain.  Thus the choice of companies.  I felt they would understand the technical issues and possibilities, and that the support of their companies for collaboration would be the beginning – not the end – of a wider process.

So to be perfectly clear, we would love to see more people and companies getting involved in this collaboration and building the momentum going forward.  This isn't the end of the identity journey – just a time-warp in which we all got thrown forward.  So let's work on some of the big announcements I referred to above, and most of all, on really great technology.

Clairvoyance?

Gabe Wachob claims a certain clairvoyance in this post. But I don't want anyone to underestimate the drama even for me.  Friendly discussion is slightly different from everyone actually landing on the same page.

For those of us who've been helping to promote OpenID, today's announcement that Microsoft will work to get OpenID and Cardspace working well together is absolutely no surprise. Kim Cameron, Mike Jones and the rest of the crew have been saying both very rosy things, as well as giving some well-appreciated constructive criticism.

Today, there was an announcement (see Scott Kveton, Dick Hardt, Michael Graves, David Recordon, Johannes Ernst, or Kim Cameron for details) that Janrain, SXIP, Verisign and Microsoft  ” will collaborate on interoperability between OpenID and Windows CardSpaceâ„¢ to make the Internet safer and easier to use.” Let me assure you that from personal experience I know the parties involved all want to make OpenID and Cardspace succeed – the agendas here are amazingly open and transparent.

This is a big deal folks – i encourage you to read those blog entries, rather than have me summarize it here. Apparently Bill G even spoke about openid at the RSA keynote this morning! 

Gabe was also part of an IPR podcast that sounds interesting and is described here.

There's a nice piece on the announcement in O'Reilly Radar here.

Really great news coming on Ping Identity.

 

 

Notes on Bill Gates’ Identity Keynote

Many of you know my colleague Mike Jones. He had enough wits about him to take notes on what actually transpired during the keynote earlier today. So I'll share them with you:

The flow of the identity part of the talk went something like this:

  • Slide: Evolution of Identity: Making the Vision Real (with picture of two cards in hands)
  • People are used to choosing what credential to use where for what purpose (talking about cards in our wallets)
  • We use a variety of physical tokens to represent these things
  • CardSpace creates a vehicle to allow people to have a GUI for credentials that represent their identities or personas in particular situations
  • Each thing in the physical world conveys a particular set of information and discloses just enough information
  • CardSpace provides a drag & drop interface for identity
  • People will have to acclimate to it
  • People can create their own credentials and others can give you credentials
  • The system reasons about what the right credential is for you to simplify things for users
  • WS-* hints about what credentials that are being looked for
  • CardSpace shows candidates for credentials

Then they segued to the OpenID collaboration announcement:

  • Issues of reputation and trust are foundational on the Internet
  • Different levels of trust are needed in different contexts, such as blogs and access to enterprise resources
  • People have been thinking about issues of trust
  • OpenID 2.0 is doing this in the blog / Web 2.0 world, others are coming at this from the enterprise space
  • We see these approaches as being complementary
  • “Today we are announcing that we are supporting OpenID 2.0 and that they’re extending what they’ve done to enable the use of strong credentials”
  • They're doing this because they see that it solves problems and attacks that a pure password approach has
  • We're excited about this marriage of CardSpace and Web 2.0
  • This will help eliminate the possibility of man-in-the-middle attacks
  • CardSpace is built on our work on the WS-* specifications
  • OpenID will be endorsing the CardSpace marriage later today
  • We see this as a very smooth continuum with a common GUI metaphor

Numerous enthusiastic comments followed in Mikes rendition…

Bill Gates and Craig Mundie on identity and privacy

Here are some of the top level messages from the Microsoft RSA Conference Keynote press release.  I thought Bill Gates and Craig Mundie spoke extremely well about identity this morning.  In the speech, Bill announced the industry initiative to converge the capabilities of CardSpace and OpenID that we've been discussing here.  This includes support for OpenID in future Microsoft identity products.   

“Security is the fundamental challenge that will determine whether we can successfully create a new generation of connected experiences that enable people to have anywhere access to communications, content and information,” Gates said. “The answer for the industry lies in our ability to design systems and processes that give people and organizations a high degree of confidence that the technology they use will protect their identity, their privacy and their information.”

“To create the level of seamless, pervasive connectivity that will make secure anywhere access a reality, continued collaboration and cooperation across this industry is essential,” Mundie added. “If we can work together to enhance trust, it will open the door to a transformation in the way people share experiences, explore ideas and create opportunities.”

Gates and Mundie said that to further advance trust and enable anywhere access, there are three key technological areas for industry focus and momentum:

    Evolution of networks. As businesses and the industry move forward on redefining network boundaries, policy will become the driving force for managing access — not the physical topology of the network. The goal is for the network and the Internet to appear and work as if the boundaries between them are seamless, so access for users is easier and faster.
    Evolution of protection. To achieve this anywhere access vision, customers need comprehensive security products and services that integrate seamlessly with each other and existing infrastructure and that are easy to use and manage. There is a necessity for the industry to enable greater protection, not only when information is in transit but also when it is created and where it resides, whether on the server, the desktop or a mobile device.
    Evolution of identity. Today, individuals and businesses struggle with an increasing number of digital identities to manage and the increased level of complexity and risk that goes with them. The industry’s collaborative efforts around the development of an identity metasystem are the right direction, and customers need this system to be based on standard protocols that address heterogeneous infrastructures in order to reduce the complexity of managing identities across networks and the Web.

There are a lot more details about many different initiatives here.