InfoCard == Passport Version 2? == Doomed
I recently attended the RealDevelopment 06 tour here in Vancouver and had the change to listen John Bristowe give us an overview of Microsoft’s big plans for the next client security model. It’s called InfoCard or recently named “Windows CardSpace” (WCS).
A quick overview, as I see it…
So in Vista we see this new control panel item, which is supposed to emulate a “Virtual Wallet”. Literally it gives the end user a place to store their credentials all in one handy place.
Note: In Build 5384 of Vista you need to go to Control Panel, User Accounts (and Family Safety), and choose “Digital Identities”. It will launch the InfoCard interface.
So, how do we use this? Well what happens is, let’s say you do banking with Wells Fargo for example. Wells Fargo needs to meet the requirements which Microsoft will lay down in order to participate/qualify for an InfoCard exchange to happen. They also need to embed an <object…> tag on their site, typically in a membership area which you will need to click and then go through some authorization process. Once that process is complete you are now in a sharing relationship with Wells Fargo. IIRC, so far, there is no way to revoke this sharing relationship, or give the ability to the client to modify their details at will in order to notify of a change of address, etc. I know this is a vague description but you get the point.
So, I ask, what is so different from this and Passport? Essentially the concept is the same. The 3rd party (Wells Fargo, or other institution) needs to go through some sort of development process to make this InfoCard feature available on their site. It does add additional metadata to the entire service but I simply don’t see that as any value added for these 3rd party sites to spend the time and money going through the integration process.
Is it more secure? I can’t see how. The biggest issue with security is typically NOT software, it’s the people. Since we can never fully secure people, and the (sometimes stupid) decisions they make why wrap it all up in a new UI/API for people to struggle with?
So what could be a potential solution…?
Recently I’ve been using the Microsoft Fingerprint reader. DigitalPersona is the actual vendor for the product, but just tagged the devices with the Microsoft Logo. With this product we get a full blown GINA (the login screen, etc.) and a little application which sits in your System Tray which responds to the Finger Down/Up events on your Fingerprint reader. This software (most of the time) is actually quite nice because it handles Windows and Webform authentication quite nicely. You have a dialog box on the screen asking for your credentials, simply press the reader and it will give you a simple step to punch in the needed details for you and automatically submit the form. The next time you hit that authentication challenge you need only to press your finger to the device and it submits the form for you. Very easy.
Now I know, not everyone can get their hands on one of these readers but why can’t MSFT simply beg/borrow/steal/buy this software from DigitalPersona and embed it at the core level of Vista?
Have a tray app, call it “InfoCard” or whatever the heck you please. This tray app is activated whenever the user clicks on it (instead of the finger down/up event). This new version of “InfoCard” will scan the active form (Win or Web) and uses the same logic and work flow as DigitalPersona uses. It could even pop-up the fancy virtual wallet and give us the option of using pre-defined credentials to make the association.
This would be a 100% client sided feature. As a developer I would never have to care about making my site or my windows form application “InfoCard aware” or whatever. All I would need to do is pop-up the authentication dialog, like I always do now, and allow the client to choose the way they want to integrate.
Bottom line, InfoCard is doomed to merely be a Passport v2 tool which Microsoft and very few of its closest vendors will use and that’s it. Lame!