Gates Says Microsoft Will Support OpenID

An anonymous reader writes "In his RSA conference keynote today, Bill Gates announced that Microsoft will support the decentralized OpenID digital identity protocol, in addition to WS-* and CardSpace (transcribed notes, video). From its roots in LID, i-names, and Sxip, the first major deployment in LiveJournal, and now with support from Techorati, Magnolia, Symantec, a suspected mass-deployment by AOL, and a number of startups — using URLs as digital identities has caught hold."

Embrace,

extend, ...
You know the rest.

Re:Embrace,

Of course they'll support it! OpenID Authentication Server for Windows 2000/XP/Vista (not available for home or professional versions) -- coming soon!

Unfortunately, OpenID will utterly fail in it's task: it will never be a trustworthy source of identification. It's only useful for things where MS Passport was previously useful: throw-away Hotmail accounts and that's about it.

A Real Security(TM) implementation that required absolute knowledge of a person's identity would have to be based on the Web-of-Trust model, much like you don't have a single piece of identification. You have a driver's license, a social insurance number, a credit card, a health care card, etc. No one piece of ID is sufficient, especially when applying for new pieces of identification. The analogue on the Internet is similar, though even finer-grained. Instead of a series of governmental organizations correlating each other's data on a particular identity, every single person in the world is able to verify every other person's identity. This is known as "Federated Identity".

Such a mechanism does not preclude the idea that a government could support a particular identity; in fact, they could also sign a person's public key. While webs of trust are more difficult to set up, there is no longer a single point of failure in the identification. Going back to OpenID, all I need to do is supply my own authentication server, and I have corroborated my own identification. Or, in a slightly less legitimate fashion, I could take over someone else's authentication server and steal all the identities from it. A Web of trust is much more difficult to steal; you need to crack the passphrase on my certificate (not impossible, but much harder and I can revoke the certificate if I suspect that the certificate has been compromised). Once the DMV, Health Authority and Credit Card companies have all signed my public key, it's much more believable that something signed with my public key is definitely signed by me.

Re:

You trust the OpenID site to supply and identity. By principal of it, whatever you get from a certain site is considered to be true. If the site is a spammer's site, the identity of [e-mail] is still valid. Trust is placed in the site you

Re:Embrace,

Going back to OpenID, all I need to do is supply my own authentication server, and I have corroborated my own identification.

Trust and identity are two different things. You're talking about trust. The fact that you can make up multiple identities doesn't matter unless you want somebody to trust one of them for something.

Trust is a big problem; moreso than identity. Furthermore, trust systems have identity as a requirement. And identity is useful outside of any advanced trust system. It makes sense to solve the identity problem first before moving on to complicated web of trust models.

The OpenID people are careful to distinguish between identity and trust. Trust is outside the scope of OpenID, but it's likely that any worthwhile trust system can be built on top of OpenID. You shouldn't use lack of trust as a basis to reject OpenID; in fact large-scale adoption of OpenID may well be helpful in developing a decent trust system.

PS: The one organisation that I expected to support OpenID much sooner than this is Google. Anybody have any ideas why they haven't jumped on board yet?

Re:Embrace,

Unfortunately, OpenID will utterly fail in it's task: it will never be a trustworthy source of identification.

You seem to be confused about the scope of OpenID. OpenID is not a system for tying user accounts to personal identities. It simply provides secure, distributed user accounts. It's not failing at it's task, it's failing at a task that you seem to want, but OpenID was never designed to solve.

Re:Embrace,

Actually not, they wanted this ages ago to make life easier for themselves because single signon has a lot of attraction for them, as for many others. Passport failed as did Liberty and as IBM's new effort shortly will. They all want it so badly differences will be set aside at this stage just to make it happen in any shape or form that does not massively disadvantage any of them.

Re:

OpenID has no central database.

People are able to represent themselves with their own identity provider, and that isn't an email address.

I'm wondering what kind of spam you're thinking about? :D

Could someone translate this for me?

English is my first language.

It's not just MS support

It's a two way thing; OpenID will support CardSpace as an identity selector. This is a "good thing", as it will stop the man in the middle attacks OpenID is very prone to. Of course the OpenID identity providers need to add support, like MEX endpoints and WS-Trust, which are all open specs.

CardSpace itself doesn't care what's on the identity provider side, they just need to talk the right talk.

as OOXML?

In a similar way as OOXML and SenderID? As a patented technology pushed through fast track procedures by a single provider, Microsoft.

It is urgent time that we gather some ressources to free citizens from that company. We see the progress Open Source has made without significant public subsidies. Why not invest a billion of public money into information freedom, free us from that company which funds all these damn lobbyists in parliament. We don't need Microsoft to tell us what an open standard is. We know what it is. It is 100% patent-free and no-rand community driven development. Free market, free competition, interoperable, open documented.

Before we get a free cyberspace, all these unethical companies need to be told a lesson. Now that Saddam is gone we have to go after rogue companies. It is important to safe our liberty and freedom of business. Unethical businesses need to be punished. Rotten companies are not good for business.

It was Gates who reportedly (their PR person told it Borsen) bribed the Danish Government: Get us software patents or we cut jobs in Denmark. Now he and his foundation are on the biopat lobbying front in Africa.

Re:

The difference is that MS did not create and does not control OpenID. But don't let the facts of the situation get in the way of your rant.

Bad idea

Come on, are we seriously going to trust people because they can give us a url we can access? With IPv6, a lot more zombie machines are going to have publically accessable IPs which could host an Open ID server. How is Open ID going to prevent comment spam

Re:Bad idea

OpenID is not intended to establish trust or prevent comment spam. It's just there to guarantee to a participating site that the "identity" URL it's been given is indeed owned by the user (agent) presenting it. It doesn't even guarantee to a visitor that the comment they're reading was actually posted by the person it says it was posted by, because that would require that the visitor trust the participating site.

All of these FAQs and more are addressed on the OpenID site linked in the article summary.

Re:

In other words it's absolutely useless. In fact it's actually worse than useless because it gives a false sense of security by giving the appearence of trust.

Re:

My server tries to send you an email from XYZ.ORG. Do a reverse DNS and you find that the email domain and server domain match. Do a DNS and you'll find a DNS entry that says said server's IP address is the ONLY address that should be sending mail from XYZ

however, it won't be supported by useless.com

from their website:

Today's web is crazy. Open ID is a pipe dream. Every direction you turn you're forced to create yet another account. Most of the time it's for one of those throw-away web startups created 10 times a day, but occasionaly it's worth the effort. It might be to purchase some fancy threads, order a pizza or see how fat the Cool Kids from high school have become. When it's that important, you can't afford to drop the ball. With a useless account you can practice without fear. So when it comes to the crunch, you're ready!

Who needs OpenID...

When we can do everything with a single Google account...

Interesting Reading Reguarding Vulnerabilities

http://test.phpbb.cc/viewtopic.php?p=66#p66 [phpbb.cc]

Don't sound like anything I am interested in...

Re:

Um, that thread shows that if you have both the username and password for someone's OpenID, that the OpenID registration page will reassign the email address instead of throwing a "username already exists" error. As in, a significant usability bug and not

Blaming the user again is pathetic.

Gates said [theregister.co.uk]

"The challenge we face in administering and using them [Windows Vista and Office 2007] is humans - and humans make mistakes. A large part of what we do going forward is not dealing with the engineering aspects of the software we build, but we have to deal with the fact errors do happen whether by accident or intentional"

He needs to deal with the engineering first. What good is an ID if your computer is one of the 25% of all Windoze computers with a keylogging bot on it? It's not the user's fault.

CardSpace is worth looking at

At the very least, CardSpace is doing a fine job at providing a mechanism for exchanging identity information without boiling it all down to the root of all evil: Shared Secrets (passwords)

It's worth looking into the specifics of CardSpace, which I'm kinda suprised there were no links that talked about that end of the equation.
CardSpace community site [netfx3.com] (Part of .NET framework 3)
CardSpace community PM [fearthecowboy.com]

Wikipedia entry and Identity providers

The wikipedia entry [wikipedia.org] is quite informative. With OpenID, unlike XNS.org (for those who remember), you need an 'identity provider': A service provider offering the service of registering OpenID URLs or XRIs and providing OpenID authentication (and possibly other identity services), and here's the official list of identity providers [openid.net]. And while we're at it, the list of services that support OpenID [myopenid.com].

Re:

According to the OpenId website, you can also be your own provider of your OpenId URL. Just install the framework on your website and you're done.

Re:If you're not OUTRAGED

You're what's wrong with this country.


      Nothing wrong with this country. But on the other hand, I don't live in the US ;)

That blows my analogy

I was going to say that MS will support this the same way one of those Kama Sutra players support their partner during rather vigorous sex in a less stable psotion. Adding a man in the middle spoils that image somewhat.