It’s a good bet that if you have 20 online accounts, you don’t have 20 different passwords. In fact, according to a survey by Kaspersky Lab, most people (51% of us) only have between one and four passwords for 20 accounts. We are insecure. But recent developments mean we could be more secure in the near future.
While it’s almost impossible to change people’s behaviour, it’s not too hard to fix the system so that only one to four passwords are actually needed. For example, you could get people to sign on to a single service, and then ask other online services to consult that service before letting you in. That way, you can safely use one password for 20 different accounts, because 19 of them don’t know what the password is.
This isn’t a new idea, and it’s how Hotmail has worked since the 1990s. You don’t actually log on to Hotmail: you sign in to Microsoft’s authentication service, known as Passport. That tells Hotmail to let you in, and it can and does do the same job for many other sites. (Actually, Passport has been replaced by Windows Live ID.)
Although Passport was convenient, it had some major drawbacks. A lot of people were — rightly — unhappy about having their online identity on a centralised Microsoft server under Microsoft’s proprietary control. A universal identity service ought to be open to all, and widely distributed, so it did not have a single point of failure.
Many years later, we are closer to getting what we want, thanks to Microsoft’s InfoCard initiative and an open collaborative development called OpenID (Openid.net). This lets you use a web address that you control to sign on to any site that uses OpenID. You could, perhaps, use the address of your blog at WordPress, which has announced that it supports OpenID.
Unfortunately, OpenID is vulnerable to phishing attacks, so it is hardly worth the effort. When a draft of OpenID Authentication 2.0 was published in January, Google security expert Ben Laurie immediately exposed its flaws, and Microsoft identity guru Kim Cameron illustrated Laurie’s attack.
But all is not lost. One of the editors of the OpenID draft approached Laurie to get him involved, and in February there was a joint announcement from Dick Hardt of Sxip Identity, Michael Graves from VeriSign, JanRain’s Scott Kveton and Kim Cameron. This said that OpenID (JanRain and Sxip) will support InfoCards, Microsoft will support OpenID, and Cameron “will work with the OpenID community on authentication and anti-phishing”.
As a result, people will be able to use OpenID securely if they use it via InfoCard, which is a platform-independent metasystem capable of supporting any ID system. Vista users already have an implementation called Windows CardSpace, and XP users can download it. Others are becoming available. CardSpace allows you to hold a number of ID cards. You can create your own, or they can be issued by websites, clubs, banks, governments and so forth.
At its annual Brainshare conference last week, Novell went even further, showing an open-source, cross-platform InfoCard Selector Service. In its demo, Novell used a Mac to log on to a shopping site with an InfoCard generated from an OpenID account, then picked up the same shopping cart from a Linux PC. Finally, the payment was made via Bluetooth using a credit card stored in the CardSpace on a cellphone.
It will be useful when InfoCard systems like this are widely implemented on different platforms. When you access a service by saying, in effect, “Here’s my virtual card,” then you won’t have to remember a password at all. — Guardian Unlimited Â