Microsoft To Support "Open"ID

Feb 13, 2007

Microsoft To Support "Open"ID

Microsoft is NOT always against Open Source. Bill Gates announcement that Microsoft was going to support a distributed identity system known as OpenID is the proof to that. Gates, who is pushing for an information world where certificates — not passwords — control access to services and programs, said OpenID and Microsoft’s approaches were “complementary”. Microsoft plans to integrate OpenID with CardSpace.

What is OpenID?
OpenID is an open and distributed system that allows a user to log-in to multiple sites via a single user-name that is a URL. When trying to log-in to a service, the user is diverted back to their authentication site, where they enter their password, and the identity site tells the web service that the person is who he/she says he/she is…

What is CardSpace?
Windows CardSpace, formerly codenamed “InfoCard”, is a piece of client software that enables users to provide their digital identity to online services in a simple, secure and trusted way. It is what is known as an identity selector: when a user – or subject – needs to authenticate to a website or a web service, CardSpace pops up a special security-hardened UI with a set of “cards” for the user to choose from. Each card has some identity data associated with it – though this is not actually stored in the card – and has been given to the user by an identity provider such as their bank, employer or government. In fact, the user can also act as an identity provider – this is essentially what we do every time we register at a website.

The CardSpace UI enables users to create Personal cards and associate a limited set of identity data. When the user chooses a card, a request in the form of a web service call goes to the relevant provider, and a signed and encrypted security token is returned containing the required information (e.g. credit limit, employer’s name and address, or perhaps a social security number). The user, in control of the flow of information at all times, then decides whether to release this information to the requesting online service. If the user approves then the token is sent on to this relying party where the token is processed and the user is authenticated.

OpenID is now accepted by some 500 services including LiveJournal, social networking site Vox and photo-sharing site Zooomr.

The problem as usual will be security. History tells that each and every time companies have tried to make things easier for the consumer, it has left out security loop holes. And many times serious ones. Here again if they collect all the login info for users at one place than there servers will be gold mine for hackers. But now Microsoft behind it, it surely is gonna get fame quick. But remember Microsoft and Security are two sides of coin, which do not meet.

Update: Thanks to a “hidden” online friend, I missed to mention in this post the sources where you can get an OpenID for free. Or you can choose from other OpenID providers. You can read more at OpenID Enabled.