I attended the Software Association of Oregon (SAO) event today. The Development Special Interest Group (DEV SIG) hosted a discussion about Microsoft CardSpace, the open source framework of OpenID, and basic identity management.
Stuart Celarier walked the audience through Kim Cameron's paper called The Laws of Identity that articulate seven desired aspects of a good identity system.
Microsoft CardSpace was formerly named "InfoCard". This is a joint effort to implement the identity metasystem defined by the laws of identity. CardSpace is the "identity selector" for Windows. It needs IE7 and Microsoft .Net Framework 3.0 to operate. It implements the WS-* specifications in this service.
OSIS - Open Source Identity System: This is an open source group that's involved in the identity space.
Stuart also showed a demo of a system he's been working on. It logs a user into Wachovia banking site using CardSpace. Scott Kveton of JANRAIN presented OpenID to the SAO DEV SIG group. OpenID hopes to solve the problem of having too many usernames and passwords.
- Single Signon for the web
- Simple, light-weight
- Easy to use, easy to deploy
- Open development process
- Decentralized
Your OpenID is a URL: http://kveton.myopenid.com/
- OpenID comes from the blogosphere
- Biggest problem with identity; namespace
- OpenID solves this by using DNS
- Your identity is a destination
- You have a unique endpoint on the web
Scott Kveton explained how sites enabled with OpenID enable users to authenticate. Visitors type in their OpenID, and the browser redirects to your OpenID provider. The visitor makes the appropriate decision and the browser redirects back the website.
Scott's site is http://scott.kveton.com
Last week Bill Gates announced support for OpenID. AOL announced support for OpenID this morning. More companies are about to make similar announcments. Here's some interesting stats on adoption:
- 12-15 million users with OpenIDs.
- 1000+ OpenID enabled sites
- 10-15 new OpenID enabled sites each day
- 7% grown each week with new sites
Kveton also brought up "Microformats" - a way to describe data in an HTML format (contact info, social network, calendar). These can be embedded on pages. There are some interesting ways to use OpenID with these technologies:
- OpenID + iCal
- OpenID + hCards
- OpenID + Social Networking (XFN, FOAP or FOAF?)
- OpenId + Reputation (jyte.com)
OpenID Predictions from Kveton:
- 7500 sites supporting OpenID
- 100 million users with OpenID
- Big players adopt OpenID
OpenID.net has a ton of info.
Scott Hanselman explained how he enabled OpenID on his blog. Hte added two HTML <link> tags to his website. Simon Willison has an OpenID enabled blog. A visitor can click Sign in with OpenID. The OpenID logo lives inside the textbox. Scott entered his OpenID in the textbox on Simon's site. Using a web service, Simon's blog discovered Hanselman's OpenID provider, then it redirected the browser to Scott's OpenID provider.
Scott's website indicates the OpenID provider is www.myopenid.com.
The OpenID provider prompts Scott to authenticate. After a successful login, the browser redirects back to Simon's page and recogizes Scott Hanselman. This is how Simon doesn't need to keep track of usernames and passwords for his blog; a huge benefit.
Stuart helped explain the difference between self-insued cards and managed cards: Business Cards from Kinko's versus a card issued from Visa.
Scott Hanselman displayed a different identity selector using Firefox on Windows. The page contains an HTML <object> tag of type "application/x-informationCard". It wasn't as pretty as the CardSpace in IE7 and .Net 3.0, but it had the same behavior.
There was some last minute discusson on "I-Name", an XRI technology (extensible resource identifier). It sounds like its still being baked.
2idi relays comments on Scott's blog. They will issue an I-Name. =kveton is Scott's I-Name. They have an DNS resolver where visitors may enter xri://=scott.hanselman/photo to redirect to his Flickr account.