Identity 2.0

by Nick Shelness

Establishing identity and authenticating on the web are a mess. I doubt I’m alone in using the same user id and password over and over again. If they’re hacked once they can be employed a hundred times over. Yeah, some sites make you change your password at regular intervals, but how do you remember them? I write them down, and carry them with me. OK, they’re somewhat encoded, but ...

For some time now, there has been the possibility of improvement under the “Identity 2.0” banner. To the surprise of some (many?), a significant chunk of Identity 2.0 innovation has come from Microsoft, and no, no, no, it’s not “Passport”. It is expressed in two seminal papers: The Laws of Identity and The Identity Metasystem, both by Kim Cameron.

But this is not all. There is a Microsoft product. It’s called “CardSpace” (it used to be called “Info Card”). It ships as part of Vista. It also ships as an automatic XP upgrade, and there are a host of alternatives, including open source ones.

CardSpace and its analogues, on their own, are not a solution. They are a component, albeit a key one, of an Identity Metasystem. What needs to come next is for web sites (“Relying Parties”) to start requesting and employing CardSpace-managed security assertions. This in turn will create a demand for Identity Provision (yes, this is where ActiveDirectory and son of Passport come in).

Will this happen? It’s too early to say. But by seeding the digital world with CardSpace, Kim and Microsoft have taken us a long first step down this path, and IMHO done us all a big favor.


Nick, did you look at OpenID?

Volker Weber, 2007-05-31

Yes. I've also looked at OpenID. I see OpenID and CardSpace as two cooperating components of the Identity 2.0 Metasystem.

Nick Shelness, 2007-05-31

I hope that Google decides to become a OpenID-Provider. I'd love to use my Google Account _everywhere_ in the Web to sign in. And I admit, that I have as well only few login und passwords that I choose in relation to my trust in the site. There's always that little men in my cerebral cortex telling me how careless I am, but who want's to remember dozens of passwords? And there's no really comfortable password safe solution yet ...

Martin Hiegl, 2007-05-31

Nick, enjoy this legendary video with Dick Hardt:

Cem Basman, 2007-05-31

Before OpenID become widespread, there is a nice solution, at least for browser passwords: Stanford's PwdHash.

Jan-Piet Mens, 2007-05-31


Perhaps I should have written

... create a demand for Identity Provision (this is where OpenID, Sxip, and yes, ActiveDirectory and son of Passport come in) ...


Yes it's deservedly legendary. I thought about including it in my post, but decided it was one URL too many.


I agree that this approach blocks a password replay attack by creating a unique password generated from a common seed for every domain.

Nick Shelness, 2007-05-31

Old archive pages

I explain difficult concepts in simple ways. For free, and for money. Clue procurement and bullshit detection.


Paypal vowe