From the high security end of the spectrum to the long tail<\/strong><\/p>\n Given the time pressures of shipping\u00a0Vista,\u00a0those of us working on CardSpace\u00a0had to prioritize (i.e. cut) our features in order to get everything tested and out the door on schedule.\u00a0 One\u00a0assumption we decided to make for V1.0 was that every site would have an X.509 certificate.\u00a0 We wanted our design to start from the high end of the security spectrum so the\u00a0fundamental security architecture would be right.\u00a0 Our thinking was that if we could get these cases working, enabling the “long tail” of sites\u00a0that don't have\u00a0certificates would be possible too.<\/p>\n Let's face it.\u00a0 Getting a certificate, setting up a dedicated external IP address, and configuring your web server to use https<\/strong> is non-trivial for the average person.\u00a0 Nor does it make much sense to require certificates for personal web sites with no actual monetary or hacker value.\u00a0\u00a0I would even say that without\u00a0proper security analysis, vetting of software\u00a0and rigorous operating procedures, SSL isn't even likey to offer much protection against common attacks.\u00a0 We need to evolve our whole digital framework towards better security practices, not just mandate certificates and think we're done.<\/p>\n So again, when all is said and done,\u00a0it is best to promote\u00a0an inclusive\u00a0Identity Metasystem embracing\u00a0the full range of identity scenarios – including\u00a0support for the “long tail” of\u00a0personal\u00a0and\u00a0non-commercial sites.\u00a0 One way to do this is through OpenID support.\u00a0 But in addition, we have\u00a0extended CardSpace to\u00a0work with sites that don't have a certificate.<\/p>\n The user experience\u00a0makes the difference clear\u00a0– we are careful to clearly point out that the exchange of identity is not encrypted.\u00a0<\/p>\n In spite of this,\u00a0CardSpace continues to provide\u00a0significant protection against attack when compared with current browsers.\u00a0 You are shown the DNS name of the site you are visiting as part of the CardSpace ceremony, not on some random screen under the control (or manipulation) of a potentially evil party.\u00a0 And if you have been redirected to a “look-alike” site\u00a0containing an unknown\u00a0DNS name, you will get the “Introductory” ceremony rather than the more streamlined “Known site” ceremony.\u00a0 This unexpected behavior\u00a0has been shown to make people much more careful about what is appearing on their screen.\u00a0 Ruchi from the CardSpace blog<\/a> has a great discussion of all the potential issues here<\/a>.<\/p>\n What software is required?<\/strong>\u00a0<\/p>\n As my little demo shows<\/a>, if you have a website\u00a0to which\u00a0you want to add CardSpace support, all you need to do is add\u00a0an “object tag” to\u00a0your login\u00a0page and parse a bit of xml when you get the Information Card posted back to your site.<\/p>\n On the “client” side, if\u00a0you are using IE, first you will need to install an updated browser specific extension that will work at a non-SSL\u00a0site.\u00a0 If you have IE7 you probably already have it as part of the October<\/a> security update.<\/a>\u00a0 If not, download it from here<\/a>.<\/p>\n Second you will need to install an updated version of Cardspace that does the right thing when a website (we call it\u00a0the “relying party”) does not have a certificate.\u00a0 The latest version of Cardspace can be downloaded as part of .Net Framework 3.5 from here<\/a>.<\/p>\n For people using Mac and Linux clients, I look forward to the upcoming Internet Identity Workshop <\/a>as an opportunity to catch up with my friends from Bandit, OpenInfoCard, Higgins and\u00a0others\u00a0about\u00a0open source support for the same functionality.\u00a0 I'll pass on any information I can at that time.<\/p>\n Once you watch the demo<\/a>, more information is available here <\/a>and here <\/a>and here<\/a>.\u00a0 The code snippets shown are here.<\/a><\/p>\n![\"Warnings](\"\/wp-content\/images\/2007\/11\/nossl.jpg\")
<\/p>\n