OpenID and the Relying Party Patchwork

June 24, 2008 at 12:11 pm · Filed under Attention, Web 2.0

Recently I have been thinking and writing about OpenID.  My thoughts have centered around two topics:

1. Sharing one credential across all of your Internet services is not a good idea.  See How many OpenIDs do I need?
2. The OpenID vision isn’t ready because there is not yet an ecosystem for Internet services (i.e., Relying Parties) to rate the trust level of an arbitrary Identity Provider.  See OpenID isn’t ready for prime time.

This led to a conversation with Bill Washburn, Executive Director of the OpenID Foundation. He was a pleasure to talk to and receptive to my ideas and concerns.  I left that conversation with an interest in contributing to OpenID through my writing.  I have been pretty pegged lately on other activities, but found the Microsoft HealthVault announcement interesting because it is at the intersection of these two topics. 

What is the announcement?  That Microsoft’s HealthVault will become an OpenID Relying Party later this week. 

Very cool news.  Congratulations to Microsoft for becoming the first big player to be an OpenID Relying Party in a significant way.  Also, congratulations to the OpenID Foundation and Bill Washburn for their role in this.

Now how is this intersection of these two topics?

1. Sharing Credentials

I’ll start by partially answering my first question:

How many OpenIDs do I need?

Partial answer:

I need one for each health information provider; for exclusive use with that provider.

I just don’t want to share these with any other Internet service. 

So the premise that OpenID allows me to share credentials across sites is of no value to me here.  (Note: that said, there are good reasons I might choose other Identity Providers for this application).

2. How do Relying Parties know who to Trust?

There are a growing number of providers out there, new implementations of custom coded OpenID providers, established businesses, startups, etc.

So if you want to become a Relying Party, who do you trust?  Everyone?  No.  The answer is easy.  From Sean Nolan,

The deal is — as of our next release in the next few days, users will have a new way to identify themselves to HealthVault. In addition to Windows Live ID, they will be given the option of using OpenID accounts from Verisign or TrustBearer.

You, the Relying Party, choose an explicit list of trusted Providers.  This is a completely rational approach.  Especially if you are responsible for protecting confidential data. 

Before you know it, more and more companies/services will become Relying Parties.  Each service — at least those that protect valuable confidential data — will have to perform a risk analysis to determine which Providers to accept.  Each Relying Party will end up with a different set of accepted Providers — a different set in constant flux.

Earlier I suggested that I could choose how to consolidate my OpenIDs, but the reality may be much different where I have to choose OpenID providers based on the services I use.  This reality seems like a complicated, user-hostile patchwork of Identity.  Kind of like what we had before OpenID.  Only more complicated.

What do I think should be done about it? 

One answer is that the OpenID Foundation fast-track efforts to formalize trust and reputation resources for Relying Parties. Bill Washburn had some other ideas too, and maybe this Microsoft announcement is in support of that effort.

How long will any of this take?  Can’t say, but I will continue to look on with interest and write about OpenID.  Despite my criticism, I am a fan.

Tags: HealthVault, LiveID, Microsoft, OpenID, TrustBearer, Verisign

Comments (1)

Digipede + Velocity

June 9, 2008 at 2:13 pm · Filed under .NET, Grid Computing

Last week Microsoft released the first CTP of the Microsoft Distributed Cache (code-named Velocity).

I am definitely excited about this release.  While Microsoft is not breaking new ground here, the addition of a distributed cache to .NET is a great addition to the platform.  Certainly there are competing technologies, but Velocity will be a very simple choice for developers and ISVs because we’ll be able to count on its availability. 

This ISV is interested, so we tried it out.

We have many customers who use our Executive pattern to load and cache job-specific data for compute-intensive jobs on the Digipede Network.  These data are often fetched through WS calls or directly from SQL databases.  Often this is performed in the Executive.Start method.  Before Velocity, the code might look like this:

protected override void Start() {
    // read the CBOData object from the database.
    _cboData = ReadCboData(cache.Get(JobTemplate.Parameters["CBODataStore"].Value));          
}

Including Velocity in this example is really easy.  The following snippet adds use of the Velocity cache:

protected override void Start() {
    // get cache 
    CacheFactory factory = new CacheFactory();
    Cache cache = factory.GetCache("CBOCache");
    // see if our CBOData object is already there
    string key = JobTemplate.Parameters["CBODataKey"].Value;
    _cboData = (CBOData)cache.Get(key);
    // if not, read it from the database.
    if (_cboData == null) {
        _cboData = ReadCboData(cache.Get(JobTemplate.Parameters["CBODataStore"].Value));
        // store it in the cache for later use
        cache.Put(key, _cboData);
    }          
}

With a few lines of code, we reduce the load on the database server and network and spend more time computing.  (I’m making an assumption with this simple code that all Executives don’t start at once, an assumption made obsolete by seeding the cache from a master application).

Of course, this is a simple example, but there are many other use cases.  For example,:

• Digipede-enabled applications can share results; 
• master applications can load the cache with job-specific data; and,
• others where baking Velocity deeply into the Digipede Network start looking pretty interesting.

I have seen many posts on “must-haves” for a Velocity RTM.  I mostly agree with the lists I have seen.  I’ll have a list too mostly from the ISV perspective.

Cool stuff.

Tags: .NET, Digipede, ISV, Velocity

Comments (3)

Digipede on Mono

June 6, 2008 at 8:53 am · Filed under Miscellaneous

I am routinely asked if the Digipede Network can run under Mono.  The main scenario people want is to run Digipede Agents on a mix of Windows and Linux boxes.

My answer has always been the same:

Not now, maybe never, but this would not be technically challenging.

A while back we researched what it would take to get the Digipede Agent working on Linux.  At the time, the Mono project was less mature.  Finding out what worked was mostly a game of just trying it.  We eventually gave up, because a dependency on WSE2 turned out to be a blocker.

A couple of weeks ago I decided to see what it would take to finish this task.  I haven’t paid much attention to the Mono project over the years, but Moonlight gave me hope that Mono has made a lot of advances since we tried last.

It has.  Still using Visual Studio, I #ifdef’ed out a few noncompliant functions and got it working with the Mono runtime.  It was surprisingly easy.  Kudos to Miguel de Icaza, Novell, and the Mono team. 

So now I have it working in the lab on a Linux VM.  Checking in to a Digipede Server, it is able to run our .NET development patterns.  Of course, it can also run command-line applications with Linux-specific binaries.  Pretty cool.

This is not ready for release.  Not only is a supported product more than just bits, but I took a few shortcuts in getting the bits to work! 

Now if someone asks me if it Digipede Network can run under Mono, I can say

It does in the lab, it may never get released, and this is ultimately a market and product decision. 

So now we can do it, what shall we do with it?

Tags: .NET, Digipede, Mono, Novell

Comments (4)

Meeting Notes #1

June 4, 2008 at 6:09 pm · Filed under Web 2.0

On the phone with Steve Gillmor this morning talking about, among other things, Plan B. 

Here are my notes:

Tags: Gillmor, Twitter, Web2.0

Comments (2)

Google I/O Day 1

May 28, 2008 at 9:28 pm · Filed under Web 2.0

Quick notes from Google I/O today. 

Best things I saw were (in order):

1. Android.  Very disruptive.  It will force the iPhone to be more open.  It will further commoditize the hardware (driving down prices).  It places Symbian, RIM, and WM into filling niche roles.  Of course the other mobile OSes aren’t sitting still, but they are already playing catch up.  This will put them further behind.
2. GWT.  JavaScript apps written in Java with familiar tools.  Cool.  Interesting how Microsoft and Adobe are solving the JavaScript-dev-maint problem with rich containers (Silverlight and Air / Flash) while Google is solving it with a Java to JavaScript compiler.  The former are working outside
3. OpenSocial.  The fundamentals of this API and Friend Connect are to allow social applications to interact across silos.  To me this means user control.  This will ultimately force silos (like Facebook) to open up.  I like it.

Participated in the ongoing argument between Robert Scoble and Steve Gillmor regarding FriendFeed.

Met a man dressed in a pirate costume.  Or Ben Franklin costume.  Pano Kroko.  Fascinating guy.  Checkout www.churmo.com.

Ran into an old friend, Julian Wixson.  Hadn’t seen him for at least ten years.

Went on a trek with Robert, Steve, Pano, Julian, Vincent Nguyen of Slashgear, Mark Lucovsky  and a student to see Gary Vaynerchuk talk about his new book.  I learned two things:

1. It is about a 15 minute walk from Moscone West to Union Square. 
2. Don’t drink the same varietal twice.

Got back to the Google party just in time to see Flight of the Conchords.  Those guys are very funny.

Tags: Android, FriendFeed, Gillmor, Google, GoogleI/O, GWT, IO2008, OpenSocial, Scoble, Twitter

Comments

Blaine FriendFeed

May 24, 2008 at 8:27 pm · Filed under Web 2.0

I got a call from Steve Gillmor earlier today asking if I had seen his TechCrunch post, called Blame FriendFeed.  I hadn’t.

I just read it.  It had me laughing so hard I couldn’t read through the tears in my eyes.  It’s all classic Gillmor, but when you get about two thirds down, LOL:

Here’s my demo of the difference between FriendFeed and Twitter:

Twitter: Hi, I’m having Sugar Pops for breakfast.

Ten minutes later….

FriendFeed: Hi, I’m having Sugar Pops for breakfast.

And it just gets funnier.

BTW: I misheard Steve on the phone and thought his post was called Blaine FriendFeed, a reference to Blaine Cook.  Now that’s funny.

Tags: FriendFeed, Gillmor, techcrunch, Twitter

Comments (1)

OpenID isn’t ready for prime time

May 22, 2008 at 6:40 pm · Filed under Web 2.0

The other day, I wrote How many OpenIDs do I need?  The premise was that the Identity Community needs to help educate users on the choices surrounding the use of OpenIDs.  Having bought into the hype of OpenID I have since:

• Read various critiques and articles supporting OpenID.
• Added OpenID comments to this blog. 
• Got an i-name, =rwa, to act as my public OpenID.
• Began tracking OpenID on Twitter.
• Participated in discussions about OpenID in financial services.
• Tried to Demand OpenID, only to find my OpenID verification failed : (

All together, I’ve come to a few conclusions.

Users assume OpenID has a trust layer

Track OpenID on Twitter and you’ll see what I mean.  Here is one example:

• (leighhouse): Bill: OpenID also insures you’re not a machine / spam, creates acess #iCitizen
• me: @Leighhouse: openid does not prove you are not a robot. Anyone can create a Provider that accepts arbitrary IDs.
• (leighhouse): @rwandering Can if authenticated? Can eventually? Or Can’t period.
• me: @leighhouse: it depends on the Provider. Services need to evaluate trust of Providers (which is already too hard).
• (leighhouse): @rwandering Can if authenticated? Can eventually? Or Can’t period.
• me: @leighhouse: you are asking the wrong question. OpenID is only authentication piece, trust of IPs is a bigger question outside of tech OpenID standards.

OpenID is intended to provide identity, but without trust.  Search around the Internet and you will find an OpenID Identity Provider (OP) that takes this to the extreme: it accepts arbitrary URLs with no authentication at all.  It reports “trusted” to anyone who asks.  Granted, this OP exists to demonstrate a point, a kind of “white hat” OpenID hack, but it leads into my next point.

Relying Parties don’t have any reasonable way of determining trust levels for Providers

Some OpenIDs can be trusted (e.g., Google, Yahoo, myopenid, etc.), others cannot.  I want to be clear that I’m only talking about trusting Google (or some other Big-Co) as an OP.  That means that they manage user authentication in a reasonably secure way.  I am not talking about trust outside of that relationship, or even if it makes sense to trust Google as the center of your identity.

So some can’t be trusted.  In addition to the example OP above, what about the numerous self-hosted OPs that are springing up? 

How is a Relying Party to distinguish between all these different OPs? 

It appears the OpenID authors intended to delegate this issue to a 3rd party (e.g., VeriSign or perhaps a community-based foundation).

Fair enough, but how are services to deal with this issue today?  I don’t think they have a reasonable way to do it, except to maintain their own list of trusted OPs.  But that is a brittle system to say the least.

And more

On top of this, there are many technical issues that are being raised about OpenID.  These range from security issues to privacy issues and much more.  A good round up can be found here: The problem(s) with OpenID.  Some of these issues are at the heart of why users shouldn’t want one ID on the Internet.

OpenID isn’t ready for prime time

OpenID shows a lot of promise and has real value in some current use cases.  Google Friend Connect stands out,  as do any applications that are built on top of services published by OpenID providers (e.g., if you want to build a service that interacts with WordPress.com, OpenID might make sense).

The OpenID hype is getting way ahead of what the technology can deliver.  People are rushing out to get OpenIDs and people are demanding that their services become Relying Parties, but the technology is just not ready for general adoption. 

The leaders in the identity community (the Identity Commons?) need to slow this down and get these issues sorted out, otherwise I think OpenID will end up a big failure.

It just isn’t ready for prime time.

Tags: Google, i-names, OpenID, Verisign, Yahoo

Comments (7)

.NET on Server Core

May 19, 2008 at 6:22 am · Filed under Miscellaneous

Dmitry Sotnikov provides the steps to get PowerShell — and of more general interest, .NET 2.0 —  running on Windows Server 2008 Server core.

While this is a stopgap until Microsoft officially supports this configuration, it could still be useful. 

Now the question for me is, will this work for running Digipede components?

Tags: .NET, Digipede, PowerShell, Server 2008, Server Core

Comments

Come on Google, support i-names for OpenID!

May 18, 2008 at 10:35 am · Filed under Miscellaneous

Playing with the Google Friend Connect demos last night, I found that my i-name doesn’t work as an OpenID.  No big deal, after all it is a preview release.

Today I went to add a comment on a blogger.com blog and tried my i-name there.  Nope.

What’s up, Google?  Why aren’t you supporting i-names?  Oversight, planned for release, bug, or politics?  I really hope it isn’t the latter.

Tags: Blogger, Google, i-name, OpenID

Comments (2)

How many OpenIDs do I need?

May 16, 2008 at 6:36 pm · Filed under Web 2.0

The Internet Identity Workshop 2008a (aliases IIW2008a and IIW6) got me thinking more about the problem of having so many distinct logons across the Internet.

Solving this problem is one motivation of the OpenID project.  OpenID and other technologies (like SAML and Information Cards) help us share credentials across sites, allowing us to simplify this problem of having too many sets of credentials, but they don’t make the problem go away.  Even if all sites accepted OpenID (as Relying Parties), one set of credentials is just not a good idea.   Why?

• If your credentials get stolen all online accounts that share those credentials are also compromised.  Given that OpenID providers tend to store a list of sites that you have approved, a thief could also gain access to that list, making it very easy to quickly find and logon to those accounts.
• Cross-service correlation — the ability to match your accounts across multiple services.  While it is possible without multiple credentials and logons, it becomes easier when the credentials are the same.  Perhaps you don’t want to make it any easier for your services to share your data?  Or for the government to correlate it?

Of course, OpenID isn’t the problem here.  These problems exist without unified identity.  For example, many people re-use credentials from site to site making it possible for stolen credentials to be used in many places.  This similar problem is often worse in that it also engenders weak passwords plus you’ve shared your password with many services who may get your credentials in the clear.  Correlation today is also trivial when people tend to choose the same logon again and again (e.g., rwandering) or the logon is actually just your email address. 

So, these problems aren’t so new.  And while they do represent good reasons not to have a single identity, having 273 separate logons is too many.  So, how many identities do I need?  Where is the middle ground between 1 global identity and 1 logon per service?

I think this is particularly important with campaigns like Demand OpenID going on. 

So, if this hasn’t happened already, it would be useful for the community to develop some material to help users make choices about sharing their credentials between sites.  This would help users make better decisions on how to use OpenID.

Is someone working on this?

Tags: Identity Commons, IIW2008A, IIW6, Information Card, OpenID, SAML

Comments (2)