In Context

Goodbye, Passwords. You Aren’t a Good Defense written by Randy Stross of the NY Times appeared today. The article starts off well and focuses entirely on the problem of passwords. I particularly like the line:

In short, we need a log-on system that relies on cryptography, not mnemonics.

Very nice. As for the rest of the article, well, everyone knows I’m a fan of Information Cards so I was glad of the mentions (especially of the Information Card Foundation). But I’m also a fan of OpenID, though not in its current form nor how it is being presented as web-scale SSO. The essence of OpenID provides a missing piece of the puzzle that Information Cards don’t. The concept is to provide the user with a web address to a set of services that work (continuously) on behalf of that user. “Pure” i-cards don’t. Pure i-card solutions (e.g. CardSpace) only work when the user is sitting in front of their machine.

Pitting one technology against another and focusing on getting rid of passwords, probably creates a more exciting story. But what we need to do is combine the best ideas from a set of complementary technologies, to create a great solution. With the right combination, you also get synergy. For example, many limitations of “pure” OpenID go away when combined with Information Card’s client architecture.

I really don’t think we’ll get Internet scale adoption with any of the “pure-play,” partial solutions, on their own. Instead, take an “extract” of OpenID, mix in a derivative of Liberty (esp. ID-WSF) services at that endpoint, top it off with i-cards, browser integration, and run it on all platforms (including mobile), and maybe we’ll have a recipe for something that works in enough real world situations to be generally useful.

It’s a common misconception that Information Card technology is proprietary to Microsoft. In the past there there has been some truth to this, and I realize that most people think it remains true, but it isn’t. Quite the contrary.

The design work behind what is now called Information Card technology started about five years ago at Microsoft, IBM (e.g. in the co-development of WS-Trust), Higgins, and a few other places. The pereception that it was a “Microsoft” technology was created by a series of actions and omissions by Microsoft over the intervening years. Some were intentional, some not. Many had unforeseen consequences.

From the beginning Microsoft was focused on shipping a product as soon as possible. Although getting CardSpace to ship in Nov 2006 was in and of itself a good thing, their lack of progress in other areas had consequences that worked against creating a vibrant ecosystem of interoperable, competing implementations based on open standards.

To some extent getting a 1.0 product out the door so far ahead of when others could ship helped create the perception that indeed this was a Microsoft dominated technology. The other projects were held up a combination of IPR issues, resource issues and the difficulty of understanding how CardSpace worked in some cases. Even little things contributed. For a time Microsoft used the term Information Card in Microsoft documents in a way that implied that it was a Microsoft term rather than an open, industry term. Nor did code-naming the product, “InfoCard”. More troublesome was how long it took Microsoft to release the CardSpace-related IP behind under the Microsoft OSP. Worst of all, it has only been in recent weeks that the last few remaining protocol design documents have been submitted to an SDO–in this case the new OASIS IMI TC.

Of course, Kim, Mike, and others always knew that to be successful there had to be open, standard protocols and multiple competing selectors (and other IdP and RP services) running on all platforms and mobile devices. I’ve always felt that they saw the big picture. And I think it’s fair to say that compared to Microsoft’s normal modus operandi there has been unprecedented level of openness, collaboration, and good will.

And in the end, and to Microsoft’s credit, everything did get done. Today there are open source implementations that interoperate with CardSpace, and in various ways go beyond CardSpace, living in open source projects like Higgins, Novell’s Bandit, OpenInfoCard, Pamela and others. The technology has recently gotten its own Information Card Foundation. The ICF and its members, with the addition of IBM, have provided most of the funding and resources for the OSIS series of interop events involving card issuing sites, selectors and relying sites (and relying apps). The one at RSA had 53 companies and open source projects collaborating together. The next and fourth one will be at DIDW.

So today, Information Card, InfoCard, I-Card (or whatever you call it) technology is open, free, and not a Microsoft proprietary technology.

-Paul

PS: Ben Laurie’s voice is echoing in my head right now. How Information Card implementations work interoperably between Microsoft’s Credentica-developed selective disclosure technology and the IBM Zurich Idemix technology has yet to be seen. I’d say there’s reason to be hopeful. Fingers crossed.