In Context

Goodbye, Passwords. You Aren’t a Good Defense written by Randy Stross of the NY Times appeared today. The article starts off well and focuses entirely on the problem of passwords. I particularly like the line:

In short, we need a log-on system that relies on cryptography, not mnemonics.

Very nice. As for the rest of the article, well, everyone knows I’m a fan of Information Cards so I was glad of the mentions (especially of the Information Card Foundation). But I’m also a fan of OpenID, though not in its current form nor how it is being presented as web-scale SSO. The essence of OpenID provides a missing piece of the puzzle that Information Cards don’t. The concept is to provide the user with a web address to a set of services that work (continuously) on behalf of that user. “Pure” i-cards don’t. Pure i-card solutions (e.g. CardSpace) only work when the user is sitting in front of their machine.

Pitting one technology against another and focusing on getting rid of passwords, probably creates a more exciting story. But what we need to do is combine the best ideas from a set of complementary technologies, to create a great solution. With the right combination, you also get synergy. For example, many limitations of “pure” OpenID go away when combined with Information Card’s client architecture.

I really don’t think we’ll get Internet scale adoption with any of the “pure-play,” partial solutions, on their own. Instead, take an “extract” of OpenID, mix in a derivative of Liberty (esp. ID-WSF) services at that endpoint, top it off with i-cards, browser integration, and run it on all platforms (including mobile), and maybe we’ll have a recipe for something that works in enough real world situations to be generally useful.