Gates Says Microsoft Will Support OpenID

An anonymous reader writes "In his RSA conference keynote today, Bill Gates announced that Microsoft will support the decentralized OpenID digital identity protocol, in addition to WS-* and CardSpace (transcribed notes, video). From its roots in LID, i-names, and Sxip, the first major deployment in LiveJournal, and now with support from Techorati, Magnolia, Symantec, a suspected mass-deployment by AOL, and a number of startups — using URLs as digital identities has caught hold."

Embrace,

[rrohbeck]

extend, ...
You know the rest.

Re:Embrace,

[mandelbr0t]

Of course they'll support it! OpenID Authentication Server for Windows 2000/XP/Vista (not available for home or professional versions) -- coming soon!

Unfortunately, OpenID will utterly fail in it's task: it will never be a trustworthy source of identification. It's only useful for things where MS Passport was previously useful: throw-away Hotmail accounts and that's about it.

A Real Security(TM) implementation that required absolute knowledge of a person's identity would have to be based on the Web-of-Trust model, much like you don't have a single piece of identification. You have a driver's license, a social insurance number, a credit card, a health care card, etc. No one piece of ID is sufficient, especially when applying for new pieces of identification. The analogue on the Internet is similar, though even finer-grained. Instead of a series of governmental organizations correlating each other's data on a particular identity, every single person in the world is able to verify every other person's identity. This is known as "Federated Identity".

Such a mechanism does not preclude the idea that a government could support a particular identity; in fact, they could also sign a person's public key. While webs of trust are more difficult to set up, there is no longer a single point of failure in the identification. Going back to OpenID, all I need to do is supply my own authentication server, and I have corroborated my own identification. Or, in a slightly less legitimate fashion, I could take over someone else's authentication server and steal all the identities from it. A Web of trust is much more difficult to steal; you need to crack the passphrase on my certificate (not impossible, but much harder and I can revoke the certificate if I suspect that the certificate has been compromised). Once the DMV, Health Authority and Credit Card companies have all signed my public key, it's much more believable that something signed with my public key is definitely signed by me.

Re:

[autocracy]

You trust the OpenID site to supply and identity. By principal of it, whatever you get from a certain site is considered to be true. If the site is a spammer's site, the identity of [e-mail] is still valid. Trust is placed in the site you're viewing. You trust Slashdot to have checked for that identity. If you trust the site you're reading from, the goal is accomplished.

Re:Embrace,

[Bogtha]

Going back to OpenID, all I need to do is supply my own authentication server, and I have corroborated my own identification.

Trust and identity are two different things. You're talking about trust. The fact that you can make up multiple identities doesn't matter unless you want somebody to trust one of them for something.

Trust is a big problem; moreso than identity. Furthermore, trust systems have identity as a requirement. And identity is useful outside of any advanced trust system. It makes sense to solve the identity problem first before moving on to complicated web of trust models.

The OpenID people are careful to distinguish between identity and trust. Trust is outside the scope of OpenID, but it's likely that any worthwhile trust system can be built on top of OpenID. You shouldn't use lack of trust as a basis to reject OpenID; in fact large-scale adoption of OpenID may well be helpful in developing a decent trust system.

PS: The one organisation that I expected to support OpenID much sooner than this is Google. Anybody have any ideas why they haven't jumped on board yet?

Re:

[dozer]

Because they want everybody on the planet to have their own google.com account? Let's see if they start pitching this soon: http://code.google.com/apis/accounts/AuthForWebApp s.html [google.com]

Re:

[smallpaul]

You've defined OpenId's "task" differently than they do. I'd suggest you read this comment [slashdot.org].

Re:Embrace,

[CoughDropAddict]

Unfortunately, OpenID will utterly fail in it's task: it will never be a trustworthy source of identification.

You seem to be confused about the scope of OpenID. OpenID is not a system for tying user accounts to personal identities. It simply provides secure, distributed user accounts. It's not failing at it's task, it's failing at a task that you seem to want, but OpenID was never designed to solve.

Re:

[wellingj]

Dear god in heaven somebody mod dgr73 a 'funny interesting troll' and get it over with

Re:

[jhfry]

Thank GOD openID is not really about identifying an individual! It's about creating a single identity... not necessarily my own.

When I go on the internet, I can be a different person. I may be a sad little 14 year old in real life, but on slashdot I'm a 35 year old IT professional. The last thing I want is to have my online ID tied to my real life identity.

If that were the case, then there is the potential that the signatures you had could be used to identify you outside of your cozy internet environment

Re:

[His name cannot be s]

OpenID has no central database.

People are able to represent themselves with their own identity provider, and that isn't an email address.

I'm wondering what kind of spam you're thinking about? :D

Re:

[dgatwood]

I'm wondering what kind of spam you're thinking about? :D

Last I checked, there were only three kinds of pure spam left:

1. Porn spam,
2. |-|34b^1 Viagra spam, and
3. Pump-and-dump stock spam

Am I missing any? These days, everything else seems to be phishing (e.g. Nigerian 419 letters).

Re:

[Kandenshi]

4. Make your PEN15 twice as long!!!eleven

^It's rarer, but I think I got one of those a few days ago.

Re:

[Fred_A]

There aren't any fake watches any more ? I haven't looked at my Spam folder in a while...

Re:

[Clete2]

I keep getting this kind of spam:

Ìs Yahoo! QGë ¦H ±M½æ©± ¥À] jU½æ ( ¾_¾Ù¥¥x )

DVDåÂé®MÀ¥¥xÌCùÄf@ÓI®aÖü,÷£ù!

Ü¥dz¥ìÖká¥~ÅS¥¦Û©ç!!!!!!!âÀtÀYJ¥àYà¥À!!!!!!!

i Ý £ ì Ï ½Ð ö o j

Anyone have any idea what it says?

Re:Embrace,

[Timesprout]

Actually not, they wanted this ages ago to make life easier for themselves because single signon has a lot of attraction for them, as for many others. Passport failed as did Liberty and as IBM's new effort shortly will. They all want it so badly differences will be set aside at this stage just to make it happen in any shape or form that does not massively disadvantage any of them.

Re:

[Anonymous Coward]

Eliminate?

This is Microsoft, after all.

Re:

[Divebus]

Yeah.... "Error: -29 Incompatible Key. You must install MS-OpenID to continue"

Could someone translate this for me?

[Anonymous Coward]

English is my first language.

It's not just MS support

[blowdart]

It's a two way thing; OpenID will support CardSpace as an identity selector. This is a "good thing", as it will stop the man in the middle attacks OpenID is very prone to. Of course the OpenID identity providers need to add support, like MEX endpoints and WS-Trust, which are all open specs.

CardSpace itself doesn't care what's on the identity provider side, they just need to talk the right talk.

Man in the Middle

[Skewray]

So what prevents a man-in-the-middle attack between the target web page and the ID server?

That blows my analogy

[EmbeddedJanitor]

I was going to say that MS will support this the same way one of those Kama Sutra players support their partner during rather vigorous sex in a less stable psotion. Adding a man in the middle spoils that image somewhat.

Re:

[Wanon]

The ID content is signed with the identity providers private key. Of which the the web app holds a copy of the public key.

Good luck having the man in the middle regenerate the signature before the request expires.

Back channel communication can also use TLS\SSL to prevent the viewing.

Re:If you're not OUTRAGED

[Dunbal]

You're what's wrong with this country.


      Nothing wrong with this country. But on the other hand, I don't live in the US ;)

Re:

[nomadic]

You live in a country without anything wrong with it? Please inform me as to its identity so I can move there!

as OOXML?

[Elektroschock]

In a similar way as OOXML and SenderID? As a patented technology pushed through fast track procedures by a single provider, Microsoft.

It is urgent time that we gather some ressources to free citizens from that company. We see the progress Open Source has made without significant public subsidies. Why not invest a billion of public money into information freedom, free us from that company which funds all these damn lobbyists in parliament. We don't need Microsoft to tell us what an open standard is. We know what it is. It is 100% patent-free and no-rand community driven development. Free market, free competition, interoperable, open documented.

Before we get a free cyberspace, all these unethical companies need to be told a lesson. Now that Saddam is gone we have to go after rogue companies. It is important to safe our liberty and freedom of business. Unethical businesses need to be punished. Rotten companies are not good for business.

It was Gates who reportedly (their PR person told it Borsen) bribed the Danish Government: Get us software patents or we cut jobs in Denmark. Now he and his foundation are on the biopat lobbying front in Africa.

Re:

[Alicat1194]

It was Gates who reportedly (their PR person told it Borsen) bribed the Danish Government: Get us software patents or we cut jobs in Denmark.

That's not bribery, that's extortion. (Which I believe carries heavier penalties...)

Re:

[Anonymous Coward]

[...]free us from that company which funds all these damn lobbyists in parliament.

We've called it "Congress" ever since we threw you guys the hell out of here...

Re:

[Wesley Felter]

The difference is that MS did not create and does not control OpenID. But don't let the facts of the situation get in the way of your rant.

Re:

[Elektroschock]

;-) OpenID? I meant http://en.wikipedia.org/wiki/Sender_ID [wikipedia.org]

Re:

[the_womble]

Are you seriously comparing Bill Gates to Saddam Hussein?

Bill Gates is FAR more powerful. A US president is highly unlikely to risk taking him head one.

The reasons I say he is more powerful are:

1) He has a lot of money that could be given in campaign contributions or spent to influence elections. If necessary he could even buy up some media companies (outright or just sufficiently large stakes in them to influence editorial policy) and exercise the sort of influence that Rupert Murdoch has in Britain.
2) He

Re:

[Elektroschock]

I am thinking in terms of national security. What needs to be done to protect our political system, to protect competition. Many nations have media antitrust laws. In Italy things are somehow different...

I mean, I know bad habits of that company from first hand. The USA spents billions on Iraq. Iraqi Freedom or Oil, I don't care. In business terms it shows how much nations invest in national security. Now, give a public Linux Foundation 1 Billion and let them develop a Desktop Linux which blows Microsoft Wi

Bad idea

[Watson Ladd]

Come on, are we seriously going to trust people because they can give us a url we can access? With IPv6, a lot more zombie machines are going to have publically accessable IPs which could host an Open ID server. How is Open ID going to prevent comment spam?

Re:Bad idea

[Fastolfe]

OpenID is not intended to establish trust or prevent comment spam. It's just there to guarantee to a participating site that the "identity" URL it's been given is indeed owned by the user (agent) presenting it. It doesn't even guarantee to a visitor that the comment they're reading was actually posted by the person it says it was posted by, because that would require that the visitor trust the participating site.

All of these FAQs and more are addressed on the OpenID site linked in the article summary.

Re:

[Tony Hoyle]

In other words it's absolutely useless. In fact it's actually worse than useless because it gives a false sense of security by giving the appearence of trust.

Re:

[maxume]

That's only a concern if sites use it in places that should require trust. Blog comments and other websites where it is nice to have settings don't really need any trust, they just need a decent unique identifier.

I don't want my bank to use it(well, they could, but there had better be another layer after I have identified myself), but I wouldn't mind if slashdot did.

Re:

[shmlco]

My server tries to send you an email from XYZ.ORG. Do a reverse DNS and you find that the email domain and server domain match. Do a DNS and you'll find a DNS entry that says said server's IP address is the ONLY address that should be sending mail from XYZ.ORG.

As such, if you try to spoof a user into believing mail coming from your botnet is coming from XYZ.ORG you're going to fail if they do the same checks, since your server isn't an "approved" one, and the only way to approve it is to have access to my D

Is your /. id useless?

[Per Abrahamsen]

I don't think so, you use it a lot. Even though it provides no trust.

Identity is quite a useful concept in itself. And as a bonus, you can build trust upon it.

Re:

[Fastolfe]

It's intended to act as a replacement for users creating individual IDs with individual passwords on each and every web site/blog they visit. Just because some random Joe signed up to post comments on your site doesn't mean you've placed any "trust" in Joe or that Joe's name really is Joe. It's just an ID he uses to post comments. This is no different. It's a convenience for the user, not really the web site operator. No one should imply trust in any of this, and the OpenID site and specifications make

Re:

[jrumney]

OpenID seems good in theory, allowing users to mange their own identity and choose where they host it, but with the big boys joining (Yahoo has already announced partial support), I can see that the trust issue will cause OpenID to become less open. Most sites will start accepting OpenIDs only if they are hosted by the big players. Not that a throwaway hotmail account is any more trustworthy than billspage.hax0rs.org, but it will be perceived to be by the suited classes, who don't understand the issues prop

'Support'....

[nurb432]

....and 'extend'....

however, it won't be supported by useless.com

[klenwell]

from their website:

Today's web is crazy. Open ID is a pipe dream. Every direction you turn you're forced to create yet another account. Most of the time it's for one of those throw-away web startups created 10 times a day, but occasionaly it's worth the effort. It might be to purchase some fancy threads, order a pizza or see how fat the Cool Kids from high school have become. When it's that important, you can't afford to drop the ball. With a useless account you can practice without fear. So when it comes to the crunch, you're ready!

Who needs OpenID...

[rduke15]

When we can do everything with a single Google account...

Re:

[m50d]

Because a few years ago you would have been saying that about Yahoo.

Interesting Reading Reguarding Vulnerabilities

[codepunk]

http://test.phpbb.cc/viewtopic.php?p=66#p66 [phpbb.cc]

Don't sound like anything I am interested in...

Re:

[setagllib]

Let's agree to never listen to people who voluntarily use (let alone develop) PHP software talk about "vulnerabilities". They're right alongside "health experts" who abuse hard drugs.

Re:

[HatofPig]

Did you actually read what you linked to? The gentleman who found the "security vulnerability" signed up a new account on the OpenID server requesting his own, already regestered username and password, with a different confirmation email address. The way the server was set up, this was treated as a change of email request, he got the confirmation email (at a new address) and was logged on with his "new" account (his old account with a new default email address).

Except that in order to do all that, he had

Re:

[rossifer]

Um, that thread shows that if you have both the username and password for someone's OpenID, that the OpenID registration page will reassign the email address instead of throwing a "username already exists" error. As in, a significant usability bug and not even slightly a security vulnerability. The "attack" requires that the "attacker" already have enough information to log into the server and just change the registered email address through the regular account information page.

The first phpbb developer m

Blaming the user again is pathetic.

[twitter]

Gates said [theregister.co.uk]

"The challenge we face in administering and using them [Windows Vista and Office 2007] is humans - and humans make mistakes. A large part of what we do going forward is not dealing with the engineering aspects of the software we build, but we have to deal with the fact errors do happen whether by accident or intentional"

He needs to deal with the engineering first. What good is an ID if your computer is one of the 25% of all Windoze computers with a keylogging bot on it? It's not the user's fault.

Re:

[Fred_A]

Actually he didn't really blame the users, it just sounds that way because they didn't put the full quote online :

"The challenge we face in administering and using them [Windows Vista and Office 2007] is humans - and humans make mistakes. Just look at how our prducts are made - by humans. A large part of what we do going forward is not dealing with the engineering aspects of the software we build, it's too much of a mess anyway, but we have to deal with the fact errors do happen whether by accident or inten

CardSpace is worth looking at

[His name cannot be s]

At the very least, CardSpace is doing a fine job at providing a mechanism for exchanging identity information without boiling it all down to the root of all evil: Shared Secrets (passwords)

It's worth looking into the specifics of CardSpace, which I'm kinda suprised there were no links that talked about that end of the equation.
CardSpace community site [netfx3.com] (Part of .NET framework 3)
CardSpace community PM [fearthecowboy.com]

Wikipedia entry and Identity providers

[Lord Satri]

The wikipedia entry [wikipedia.org] is quite informative. With OpenID, unlike XNS.org (for those who remember), you need an 'identity provider': A service provider offering the service of registering OpenID URLs or XRIs and providing OpenID authentication (and possibly other identity services), and here's the official list of identity providers [openid.net]. And while we're at it, the list of services that support OpenID [myopenid.com].

Re:

[Fred_A]

According to the OpenId website, you can also be your own provider of your OpenId URL. Just install the framework on your website and you're done.

Liberty Alliance

[owlstead]

Of course, MS would not want to support the Sun answer to Passport: the Liberty Alliance. Check the current member list here:

http://www.projectliberty.org/liberty/about/curren t_members [projectliberty.org]

Now compare it with that of OpenID, if you can find it on their wiki-like site. IMHO, this is just FUD to keep wind out of the sails of the Liberty Alliance. The same stupid tactic they have performed with the open source document format. Kill it by strengthening the currently loosing spec, and both will perish.

Re:

[metamatic]

So, how many web sites can I log into via Liberty Alliance? Where can I get an ID?

I use OpenID every day. It's here and it works.

OpenID is Not Secure, Not Useful

[smack.addict]

Of course Microsoft would buy into OpenID, its the Swiss cheese of identity management. It neither solves an actual identity management that the world has nor is it in any way a secure protocol for authenticating users against a single identity.

OpenID vs OpenPrivacy?

[alexandre]

Has anyone got any precise insight on the difference between OpenPrivacy [openprivacy.org] and OpenID [openid.net] goals? :)