The Liberty Alliance Grows Again

sempf writes "The Liberty Alliance, a Sun-backed open-specification alternative to the Microsoft platform's Passport system, has added two very powerful members, Oracle and Intel. Now over 150 members, one wonders at the future of a world where we have two single sign-on systems. With the three big IM platforms joining forces, is the identity standard of the world going to be Microsoft, or Sun? Is this going to be the next Browser War?"

No.

No. There won't be a war because no one wants it. MSN's passport has been around for a long time now and barely anyone uses it.

Re:No.

That's for a number of reasons.

- You have to pay to use it for your site.

- Lots of people don't trust Microsoft's security.

- Some people are concerned about single platform/single corporation.

I'd love to have a single ID.

Re:No.

Yes, but is anyone actually using Liberty? It's all very well signing companies on, but what web sites actually use the damned thing?

Reading the testimonials [projectliberty.org] it's all fluffy, without implementation (excluding one company which seems to use it for internal enterprise authenication, which is a way different market to Passport)

Single Sign In

It's called Mac OS X's Keychain.

Re:Single Sign In

This may not have been an entirely serious suggestion, but it is a much better idea. I would much rather store passwords locally and trust my own security than trust anyone else's (it may not be more secure, but at least it's my fault if it isn't). The only thing I would like to see a specification for is labelling fields in HTML forms so that they can be auto-completed with information from my vCard. Safari does a good job of guessing at the moment, but it's not perfect.

who cares?

Who cares what company has the new identification standard? I'd rather keep my multiple passwords than rely on one breach of one system to lose my entire online life. I'd assume most geeks are the same and I've met some pretty paranoid non-geeks out there about having any information on the web. So unless we really believe that the information we need to have to exist in our online world won't be available outside of the authentication standards of a few companies, we have nothing to worry about.

Re:who cares?

One of the points of the Liberty Alliance is that you, the end user choose whether to Federate your accounts or not, and you get to choose to break that Federation. Take a spin through the backgrounder paper [projectliberty.org] on Liberty - there's a lot of tech, but there's also quite a bit of thinking about privacy and security there.

Sign-on War

I'll believe there's a "sign-on war" the day Ebay locks people out for not having a passport/liberty alliance account. (Currently they support Passport+their own system.)

Honestly, site-specific sign-on systems are easy to develop and most e-tailers have a powerful motive to offer their customers as many choices as possible. This is stark contrast to the one-or-the-other image a "war" connotes.

Patent

Does Microsoft have a patent on this kind of single signon? It sure wouldn't suprise me if they have one or one in the works.

How universal can it be?

How universal can any kind of "identity system" be before it gets scary and/or illegal? (Illegal in countries with data protection laws anyway.)

Nokia is on board [nokia.com] with this, and as more and more of my personal information gets concentrated on my phone I'll probably end up using it.

Eventually we'll probably all have a digital "passport" of some kind - and much better this way than the Microsoft way - but it's still a bit creepy.

Microsoft or Sun? No...

is the identity standard of the world going to be Microsoft, or Sun?

With, as you point out, over 150 member companies the Liberty Alliance is scarcely just "Sun".

They're all terrified of MS' power

So they're all finally joining forces.

Intel is terrified that Longhorn's .NET hardware independent toolset will allow MS to move away from x86 at will and set up their own chip division. MS can't grow their software division much more in a saturated market, but if they use their own chipset (or licence it to a couple of 3rd party suppliers) they can take over all of Intel's current profit.

Oracle is of course competing against SQL Server.

All these large IT companies have known for years that MS is going to eat their lunch, but they couldn't work out what to do about it.

The penny has finally dropped - the only way to combat MS is for them all to work together using common standards : hence, their support for Linux, the Liberty Alliance, J2EE and so on.

Re:They're all terrified of MS' power

Actually, I think Intel is more keen to ditch x86 than MS. They tried to with the i860. They are trying with the IA64. I recall a few months ago an Intel representative stating that they thought x86 only had a couple of generations left. Unfortunately, they can't jump ship if AMD doesn't. Hopefully Longhorn will ship for several CPU architectures (as NT did), and will include something based on VirtualPC for running legacy x86 code.

Note that the only non-x86 architecture properly supported by Windows at the moment is IA64.

A pretty good standard

Liberty is a pretty good standard, it allows federated and distributed authoring instead of Microsoft's "only we know who you are" approach.

It's a shame that everything this alliance has produced up to date is just a pile of PDF specifications. Hope it will change soon.

Single Sign-On

Be sure that this will be the next big war. But it will most certainly not be fought in the open field. My guess is that this will mostly influence companies as they move more and more to single sign-on solutions.

Article from Internet News [internetnews.com]

June 30, 2004
Single Sign-On Gains Liberty Support
By Clint Boulton

Although a lack of interoperability has threatened to hold Web services adoption back, Liberty Alliance, a group dedicated to forging an open identity standard, cracked that barrier by certifying nine single sign-in products this week.

The group awarded Ericsson, Hewlett-Packard, IBM, Netegrity, Novell, Oracle, Ping Identity, Sun, and Trustgenix its "Liberty Alliance Interoperable" mark in a conformance test.

The certification, which covers Liberty Alliance Identity Federation Framework (ID-FF) version 1.1 and 1.2 for single sign-on services, involves a rigorous testing process that gauges identity federation, authentication, session management and privacy protection. Vendors must demonstrate interoperability with two other randomly selected participants.

Secure single sign-on services are a key ingredient for Web services, a high-flying concept for distributed computing that allows applications to talk to one another to perform tasks. But customers are afraid to "sign-on" without a secure brand, because crackers can swipe their personal information if the site is not safeguarded properly.

According to a Liberty statement, the products are interoperable out-of-the-box, which pares deployment schedules and saves costs. This is key, as customers are loathe to license technology if it isn't supported by a validated standard, according to Gartner analyst Ray Wagner.

Customers who are thinking about federation projects need some reassurance that there won't be a huge amount of manual integration necessary between partners with different infrastructures," Wagner told internetnews.com. "Requiring compliance with Liberty, SAML, WS-Federation, and WS-I Basic Security Profile, or a subset of the above, will provide some assurance that systems have the capability to work together."

Wagner said he believes most vendors who make identity management products will provide compatibility with specs or standards in the short term, noting that Federation protocols in particular (SAML, Liberty, WS-Federation) will likely converge in the medium term.

With Liberty's certification, companies can say that their products are compliant with the Liberty identity standard, making their identity management software more appealing to customers looking to shore up their Web services platforms with authentication via single sign-on services.

Forrester analyst Randy Heffner said using Identity Web Services Framework (ID-WSF) requires Liberty's ID-FF and offers an interoperable path to Web services as long as users start with Liberty's ID-FF.

"There is a test suite to ensure broad testing coverage of the technical interfaces," Heffner told internetnews.com. "But successful operation of the tests is sort of on the honor system -- except that a vendor who wants the Liberty logo must participate in an interoperability event and successfully connect with a couple of other randomly chosen products."

"This is better than a simple, pre-planned interoperability event, which only proves that there is 'at least one' configuration by which products can work together -- but not that this is the configuration that any given user might need," Heffner concluded.

Web services have been slow to take off over the last few years, due to obstacles such as interoperability, security and manageability. But this is changing, owing in part to the steady work companies have been putting into the matter and the increasing acceptance of the more broad service-oriented architecture approach to software services.

The following products are now Liberty compliant: the Ericsson User S

What Standard?

There a can be no indentity standard, because there can be no indentity.

IPs can be spoofed, mail foraged, add to that proxies and firewall... There is no way of telling who is really on either end of the connection. Now, add single signon security, without forced timeout of passwords and without heavy forced editing preventing reuse and dictonary attacks.

Look to windowsupdate.microsoft.com. Are you connecting to truly to microsoft? No, you are not. So you are taking a SECURITY download from a site, that may have an associtation with MS but not MS itself. Boy are we trusting.

So where does that leave the rest?

Re:What Standard?

mail foraged

Yeah, I hate it when people forage through my email - it's bad enough that my girlfriend goes through my phone sometimes, but my email? No way!

I think claiming

that something is the 'new browser war' is the new black.

How about this...

...Single sign-on outside the corporate network (aka, the Internet at large) is a problem that doesn't need much solving..

..and both MS and Sun will fail at solving a problem that doesn't really need solving.

A better approach would be for either MS or Sun to develop multi-langauge, multi-platform products that will help web developers implement standard password requirements, username/password schemes, etc.

Forcing a lame implementation of bad technology isn't going to work.

My bet is on...

Both Microsoft and Sun to make equally useless products that nobody really wants to use... for now.

This would be like fighting over...

...who gets to give you herpes.

Summary is misleading

The big IM providers are NOT joining forces, they're just making a tidy sum providing Microsoft with a way of routing messages between networks. IM convergence would mean being able to send a message to a user on another network directly, that still is not on the cards.

I'm just waiting for Google to offer a Messenger service, using a gMail account as a login. I think they could bring great things to the IM market, especially if the based an offering on an OSS project like Jabber, for which other IM software providers could then incorporate support.

Passport is already tied closely to Messenger and Windows XP in particular, I don't see the opposition gaining ground without going the same way.

Re:Summary is misleading

... IM providers are NOT joining forces ... IM convergence would mean ...

Note that I did NOT say IM convergence. I DID say they are joining forces. They are. Despite all of the vitrol, reality has forced them to hold hands and play nice. I'm sure the ability to send a message from one platform to another using a common P2P platform is not far off, despite your claims.

How exactly is Google making a gMail messenger any different from MSN mesenger, or Yahoo messenger? All great brands, all good technology. Will it be better because you like Google more? Don't get me wrong, I like Google too, but how will a fourth standard make it any better?

Liberty Alliance is not the same as Passport

The Liberty Alliance is not a single signon like Passport. It doesn't put all your data in the hands on one organisation. It basically allows you to link logins and share data between them.

It's a tricky concept to grasp but I've found these two introductions helpful:

• http://www.projectliberty.org/resources/tutorial_d raft.pdf [projectliberty.org]
• http://www.projectliberty.org/resources/whitepaper s/LAP%20Identity%20Architecture%20Whitepaper%20Fin al.pdf [projectliberty.org]

Neither?

How about I just keep my identity and NOT have any single company owning my personal data? Yes convince is what America is all about, but there are still many steps needed to be taken in the real world to prove your identity, why do we need one system that everything will be required to use (think about the future). With something like this, I can see something bad happening. The US government (world government too) has been trying to remove the ability to be anonymous on the internet, with a system like this INFORCED at many different levels, the ability to be anonymous would no longer exist, the moment you connect your pc to the internet (LAN?) you would be authenticated.

What about dotGNU?

Does anyone know what dotGNU proposes to do?

From their website it seems that they are making some kind of decentralized "passport". Is The Liberty Alliance also pushing a decentralized solution?

Why stop at just two

Microsoft or Sun, we need more choices, like a different single sign on system for everything we log into. Oh, wait, we already have that. Now what where we trying to fix again?

Re:Why stop at just two

actually despite what the person who posted this article implies, LA is not a monolithic sign on like Passport. LA basically provides a protocol for a person's identity to be authenticated via a third party and the token from that third party server passed to different sites that trust the third party. The standard does not however stipulate that there can be only one company capable of identity verification, but rather lets sites choose who they trust the information from.

That logo looks familiar...

I found the logo (and even the name) to be vaguely reminiscent of the Alliance and Leicester bank [alliance-leicester.co.uk]. I wonder if it's just a coincidence?

Where does AOL really stand?

The first link says MS, AOL and Yahoo have joined forces.
The Liberty Alliance page shows AOL as one of the 15 "Management Board Members".
Seems AOL is positioning themselves to be a win/win member.

Liberty Alliance?

I prefer "Coalition of the Willing (TM)."

Suckers! Just what Big Brother wants!

This article and the replies contained therein clearly demonstrate BIg Brothers ability to polarize the American public on who is the best provider of security while keeping the focus off the real issue at hand, the sytematic destruction of your personal privacy. Who cares which one is better! I don't want either! Who really believes you can catch the bad guys by keeping track of the good guys? We have proven that to be false and flawed, over and over, and that that approach simply doesn't work. The bad guys never abide by the system, but find ways around it. Does gun registration stop people from obtaining illegal guns for use in crimes? Does all the information a bank collects on you stop someone from ripping off your bank account? Meanwhile the rest of us have more and more laws to abide by, more hoops to jump through, more restrictions on our movements and more eyes watching our every move. Maybe if there were camera's in my house watching me, my neighbor wouldn't kill anyone. Wake up, before it's too late!

"Jennifer Government"

What will the Microsoft-led coalition be called? Team Advantage? (In a perfect world, Liberty Alliance would be US Alliance. I know.)

should have called it the Rebel Alliance..

..then we could back it unreservedly

Liberty Alliance is low tech

you download a form, fill it out, and send it back to them. No online verification, and no electronic forms. I give it a thumbs down. Join the 21st century, Liberty Alliance!

"Warning slippery when sarcastic!"

The Liberty Alliance

Coming to a Marvel comic book near you soon

client peace

I want multiple signons, so a single server crack doesn't jeopardize all my info, along with everyone else's. I want a single client that manages all those signons. That security architecture also makes any one crack less profitable - getting all my info isn't nearly as attractive as getting every customer of a big web merchant. The distributed security will reduce the damage, and increase the trust of the infrastructure.

Cross-site scripting

It seems like there is a major problem with cross-site scripting that is very hard to fix in all cases. For example, here's one [securityfocus.com] related to Passport. The point is that css is hard to fix because you can't guarantee that another website that uses the same single signon system won't be vulnerable. So if there is a single signon system, then it seems to me that it's all only as secure as the most insecure website in the network.

Is there a difference anymore?

Last I heard, Sun sold their soul to M$ for about $2 billion.

Identity Commons

The Identity Commons [identitycommons.net] is also working on the same problem, but they have taken a more useful approach than the Liberty Alliance.