Bickering rivals

By Linda Musthaler
Network World Technology Executive Newsletter, 12/31/01

Watching the showdown between the backers of the Liberty Alliance Project and Microsoft, the developer of Passport, is a bit like watching my 6-year-old and 8-year-old play together. They are constantly bickering, lining up friends against each other, and trying to prove their own righteousness. At the heart of this issue, however, is not who gets control over the TV, but who wins the right to determine how hundreds of millions - possibly billions - of Internet users are authenticated to sophisticated 'Net services.

Before they come out fighting, let's introduce the players.

In one corner, we have Microsoft with Passport, the company's authentication system that is used for logging on to multiple Web sites or services. Passport technology is currently deployed in Windows XP, as well as in some Microsoft services such as the MSN Web site and a messaging service. Passport also is the authentication method at the heart of Microsoft's forthcoming .Net platform.

Microsoft is not alone in its corner, with partners such as McAfee and Starbucks already using Passport to authenticate goods and services they offer over the Internet. What's more, numerous application developers are sure to line up in this camp as .Net gathers momentum over the coming year.

In the opposing corner, we have the Liberty Alliance Project, initiated by Sun this past September. Among the founding members of the alliance are General Motors, Bank of America, Nokia, RealNetworks and RSA Security. The group calls itself " a business alliance formed to deliver and support an identity solution for the Internet that enables single sign-on for consumers as well as business users in an open, federated way. "

Since the group's inception just three months ago, several significant users and developers of technology have joined the alliance, including American Express, AOL Time Warner, and Cisco. Still more companies are considering commitment.

The two groups have traded pot shots, with Microsoft CEO Steve Ballmer who claimed the Liberty Alliance, or what he referred to as " the Sun thing, " has " absolutely zero probability of mattering to the world. " Sun CEO Scott McNealy has referred to the Microsoft solution as a " hairball " of interlocking software products.

Children, please, looks like we need a time-out.

No one disputes the need for a strong identity management system for the Internet. What's at issue is whose technology will be used. Microsoft Passport, by virtue of the fact that it is real and already in use today, could become a de facto standard - just like Windows. The Liberty Alliance Project, however, does not want to be locked into a solution controlled by Microsoft. This group advocates a neutral technology, using open industry standards that will be platform independent. Unlike Microsoft, however, the Liberty Alliance has no functioning technology today; the group is just getting into the specifications stage.

With its head start on user authentication, Microsoft has been approached about joining the Liberty Alliance Project, but has remained aloof. Likewise, it's been suggested that the alliance should jump on Microsoft's bandwagon, rather than starting from scratch with new technology. If you think either of these options is likely to happen, I've got beachfront property in Arizona to sell you.

It's very unfortunate that these groups are taking vastly different stances. If both technologies succeed in finding their place in the world, we'll once again be facing the task of adding layers of complexity in order to make Web-based applications interoperable. We'd all be better off if the disparate groups could find a middle-of-the-road solution.

This is not an issue that will be resolved quickly or quietly. Designers of an all-encompassing user authentication scheme will have to consider business needs, public policy and privacy rights, as well as technology. The public debate has begun, and it will be an interesting one to watch.