News by Vendor /

Bickering rivals, part 3

By Linda Musthaler
Network World Technology Executive Newsletter, 01/28/02

Please indulge me. I am going to write one more article in the " Bickering Rivals " Internet authentication series, and then I'll be off this topic, for a while, at least. Since I wrote the previous two articles a few weeks ago, I have had many readers and a vendor or two, tell me that I missed some salient points. So, in fairness to the subject, I want to cover those points before we move on.

One astute reader told me that I failed to mention the most important point of contention between Microsoft Passport and the Liberty Alliance: the database used to store the identities. Currently, the Microsoft method employed with the Passport authentication scheme is a centralized database, owned and maintained by Microsoft.

If this sets off alerts for you, rest assured that others have also noticed this potential conflict of interest. Privacy watchdogs are concerned that Microsoft may use the information in this database - your identity information - for marketing or other self-serving purposes. To counter the critics, Microsoft has said it is considering giving the database over to a neutral federated party. It appears there would still be only one source of the data, and one potential point of failure. And speaking of failure, it should be noted that hackers have already broken into the Passport Internet Authentication service, shutting it down for two days recently.

The Liberty Alliance has already stated it would use a multiparty federated system, whereby several companies manage the data repositories. The group likens this to our credit card system in the U.S., where there are two clearinghouse companies that approve or deny your pending charges. Neither company is owned by Visa, Mastercard, American Express or other credit card issuers, yet our credit card system is dependent on the clearinghouses. As for the Liberty Alliance, how the multiple entities managing the identity databases would interact is not clear yet.

In the article I wrote about Passport ( " Bickering Rivals, part 2 " , www.nwfusion.com/newsletters/techexec/2002/01167066.html), I indicated that this is the only working global authentication solution on the market today. True, but that doesn't make it the clear winner. Despite its late entry to the race, I'm warming up to the Liberty consortium's proposed solution.

The Liberty Alliance formed last summer, and is moving fast to counteract Microsoft's Passport. The consortium's technology committee expects to have a technical spec on the APIs out by the end of this quarter. Other committees are busily looking at privacy policies, marketing and ongoing governance.

The big plus the organization has in its favor, however, is the growing support from numerous technology and end user companies. Technology companies throwing their weight behind the effort include Sun Microsystems, Cisco Systems, Hewlett-Packard, RSA Security, and other household names from the IT sector. Companies that utilize technology heavily also are supportive of the alliance's efforts. Among those are American Express, AOL Time Warner, United Airlines, NTT DoCoMo and General Motors. These are obviously large global companies that have many years experience in " thinking globally and acting locally " in terms of customers' privacy. What's more, the sheer number of " user " organizations in this consortium will mean broad acceptance once a solution is available.

The big hurdle that Liberty has that Microsoft Passport obviously does not have is getting the parties (like Sun and HP) to agree to share their patented technologies. Liberty Alliance isn't the first consortium to face that task, and like others before it, a workable solution will be found.

Having read my two previous articles on this topic, one reader told me he plans to wait two or three years before implementing any global authentication scheme. He's waiting until the kinks are ironed out and the security holes are found and fixed. This is, perhaps, a good strategy where large-scale extra-enterprise applications are planned. I still think it's worthwhile to select a small internal project and work with the available technologies as soon as possible. You should jump into the learning curve before you find yourself too far behind the eight ball.

To have your say on the debate, please go to Network World's online forum on the subject at www.nwfusion.com/cgi-bin/WebX.cgi?230@167.UeFrb2isaM4^0@.ee72a1c