Slashdot Mirror
The Liberty Alliance Grows Again
sempf writes "The Liberty Alliance, a Sun-backed open-specification alternative to the Microsoft platform's Passport system, has added two very powerful members, Oracle and Intel. Now over 150 members, one wonders at the future of a world where we have two single sign-on systems. With the three big IM platforms joining forces, is the identity standard of the world going to be Microsoft, or Sun? Is this going to be the next Browser War?"
No. There won't be a war because no one wants it. MSN's passport has been around for a long time now and barely anyone uses it.
It's called Mac OS X's Keychain.
Who cares what company has the new identification standard? I'd rather keep my multiple passwords than rely on one breach of one system to lose my entire online life. I'd assume most geeks are the same and I've met some pretty paranoid non-geeks out there about having any information on the web. So unless we really believe that the information we need to have to exist in our online world won't be available outside of the authentication standards of a few companies, we have nothing to worry about.
When I tell an object to delete this, am I killing it or telling it to kill me?
I'll believe there's a "sign-on war" the day Ebay locks people out for not having a passport/liberty alliance account. (Currently they support Passport+their own system.)
Honestly, site-specific sign-on systems are easy to develop and most e-tailers have a powerful motive to offer their customers as many choices as possible. This is stark contrast to the one-or-the-other image a "war" connotes.
Go somewhere random
Does Microsoft have a patent on this kind of single signon? It sure wouldn't suprise me if they have one or one in the works.
Evolution or ID?
How universal can any kind of "identity system" be before it gets scary and/or illegal? (Illegal in countries with data protection laws anyway.)
Nokia is on board with this, and as more and more of my personal information gets concentrated on my phone I'll probably end up using it.
Eventually we'll probably all have a digital "passport" of some kind - and much better this way than the Microsoft way - but it's still a bit creepy.
This Like That - fun with words!
With, as you point out, over 150 member companies the Liberty Alliance is scarcely just "Sun".
Galileo: "The Earth revolves around the Sun!"
Score: -1 100% Flamebait
So they're all finally joining forces.
.NET hardware independent toolset will allow MS to move away from x86 at will and set up their own chip division. MS can't grow their software division much more in a saturated market, but if they use their own chipset (or licence it to a couple of 3rd party suppliers) they can take over all of Intel's current profit.
Intel is terrified that Longhorn's
Oracle is of course competing against SQL Server.
All these large IT companies have known for years that MS is going to eat their lunch, but they couldn't work out what to do about it.
The penny has finally dropped - the only way to combat MS is for them all to work together using common standards : hence, their support for Linux, the Liberty Alliance, J2EE and so on.
Liberty is a pretty good standard, it allows federated and distributed authoring instead of Microsoft's "only we know who you are" approach.
It's a shame that everything this alliance has produced up to date is just a pile of PDF specifications. Hope it will change soon.
Be sure that this will be the next big war. But it will most certainly not be fought in the open field. My guess is that this will mostly influence companies as they move more and more to single sign-on solutions.
Article from Internet News
June 30, 2004
Single Sign-On Gains Liberty Support
By Clint Boulton
Although a lack of interoperability has threatened to hold Web services adoption back, Liberty Alliance, a group dedicated to forging an open identity standard, cracked that barrier by certifying nine single sign-in products this week.
The group awarded Ericsson, Hewlett-Packard, IBM, Netegrity, Novell, Oracle, Ping Identity, Sun, and Trustgenix its "Liberty Alliance Interoperable" mark in a conformance test.
The certification, which covers Liberty Alliance Identity Federation Framework (ID-FF) version 1.1 and 1.2 for single sign-on services, involves a rigorous testing process that gauges identity federation, authentication, session management and privacy protection. Vendors must demonstrate interoperability with two other randomly selected participants.
Secure single sign-on services are a key ingredient for Web services, a high-flying concept for distributed computing that allows applications to talk to one another to perform tasks. But customers are afraid to "sign-on" without a secure brand, because crackers can swipe their personal information if the site is not safeguarded properly.
According to a Liberty statement, the products are interoperable out-of-the-box, which pares deployment schedules and saves costs. This is key, as customers are loathe to license technology if it isn't supported by a validated standard, according to Gartner analyst Ray Wagner.
Customers who are thinking about federation projects need some reassurance that there won't be a huge amount of manual integration necessary between partners with different infrastructures," Wagner told internetnews.com. "Requiring compliance with Liberty, SAML, WS-Federation, and WS-I Basic Security Profile, or a subset of the above, will provide some assurance that systems have the capability to work together."
Wagner said he believes most vendors who make identity management products will provide compatibility with specs or standards in the short term, noting that Federation protocols in particular (SAML, Liberty, WS-Federation) will likely converge in the medium term.
With Liberty's certification, companies can say that their products are compliant with the Liberty identity standard, making their identity management software more appealing to customers looking to shore up their Web services platforms with authentication via single sign-on services.
Forrester analyst Randy Heffner said using Identity Web Services Framework (ID-WSF) requires Liberty's ID-FF and offers an interoperable path to Web services as long as users start with Liberty's ID-FF.
"There is a test suite to ensure broad testing coverage of the technical interfaces," Heffner told internetnews.com. "But successful operation of the tests is sort of on the honor system -- except that a vendor who wants the Liberty logo must participate in an interoperability event and successfully connect with a couple of other randomly chosen products."
"This is better than a simple, pre-planned interoperability event, which only proves that there is 'at least one' configuration by which products can work together -- but not that this is the configuration that any given user might need," Heffner concluded.
Web services have been slow to take off over the last few years, due to obstacles such as interoperability, security and manageability. But this is changing, owing in part to the steady work companies have been putting into the matter and the increasing acceptance of the more broad service-oriented architecture approach to software services.
The following products are now Liberty compliant: the Ericsson User S
StarTrek.org Free Webmail
There a can be no indentity standard, because there can be no indentity.
IPs can be spoofed, mail foraged, add to that proxies and firewall... There is no way of telling who is really on either end of the connection. Now, add single signon security, without forced timeout of passwords and without heavy forced editing preventing reuse and dictonary attacks.
Look to windowsupdate.microsoft.com. Are you connecting to truly to microsoft? No, you are not. So you are taking a SECURITY download from a site, that may have an associtation with MS but not MS itself. Boy are we trusting.
So where does that leave the rest?
that something is the 'new browser war' is the new black.
...Single sign-on outside the corporate network (aka, the Internet at large) is a problem that doesn't need much solving..
..and both MS and Sun will fail at solving a problem that doesn't really need solving.
A better approach would be for either MS or Sun to develop multi-langauge, multi-platform products that will help web developers implement standard password requirements, username/password schemes, etc.
Forcing a lame implementation of bad technology isn't going to work.
Both Microsoft and Sun to make equally useless products that nobody really wants to use... for now.
...who gets to give you herpes.
The big IM providers are NOT joining forces, they're just making a tidy sum providing Microsoft with a way of routing messages between networks. IM convergence would mean being able to send a message to a user on another network directly, that still is not on the cards.
I'm just waiting for Google to offer a Messenger service, using a gMail account as a login. I think they could bring great things to the IM market, especially if the based an offering on an OSS project like Jabber, for which other IM software providers could then incorporate support.
Passport is already tied closely to Messenger and Windows XP in particular, I don't see the opposition gaining ground without going the same way.
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
The Liberty Alliance is not a single signon like Passport. It doesn't put all your data in the hands on one organisation. It basically allows you to link logins and share data between them.
It's a tricky concept to grasp but I've found these two introductions helpful:
How about I just keep my identity and NOT have any single company owning my personal data? Yes convince is what America is all about, but there are still many steps needed to be taken in the real world to prove your identity, why do we need one system that everything will be required to use (think about the future). With something like this, I can see something bad happening. The US government (world government too) has been trying to remove the ability to be anonymous on the internet, with a system like this INFORCED at many different levels, the ability to be anonymous would no longer exist, the moment you connect your pc to the internet (LAN?) you would be authenticated.
TruePunk | Games
This is in not simply a single sign-on system like MS Passport, where only they manager/control your identity. This is just an API for identity and authentication, and the "identity provider" can be anybody such as the company you work for, the government, or a third party identification service like Thawte.
This is only a half-solution, however. It still requires creating separate accounts on each host, doesn't allow you to use computers other than your already configured Mac to access those sites, and doesn't let sites share authentication data. (i.e., site A authenticates you, site B authenticates you, and those two sites want to make sure they're both talking to the same person.)
There is a big different between actual single sign on and (for lack of a better word) hacks that auto sign on for you.
actually despite what the person who posted this article implies, LA is not a monolithic sign on like Passport. LA basically provides a protocol for a person's identity to be authenticated via a third party and the token from that third party server passed to different sites that trust the third party. The standard does not however stipulate that there can be only one company capable of identity verification, but rather lets sites choose who they trust the information from.
I never said I was smart, I just said I was smarter than you
..then we could back it unreservedly
you download a form, fill it out, and send it back to them. No online verification, and no electronic forms. I give it a thumbs down. Join the 21st century, Liberty Alliance!
"Warning slippery when sarcastic!"
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Coming to a Marvel comic book near you soon
You don't need a lab to make mud.
Some vendors already have Liberty-compliant solutions ready for production, with mobile operators running trials. I am not allowed to name such operators, but here is a list of products conforming to Liberty specs . It is a very interesting market, where vendors with a telecom background clash against classical IT ones.
It seems like there is a major problem with cross-site scripting that is very hard to fix in all cases. For example, here's one related to Passport. The point is that css is hard to fix because you can't guarantee that another website that uses the same single signon system won't be vulnerable. So if there is a single signon system, then it seems to me that it's all only as secure as the most insecure website in the network.
part of the standard allows you to pick and choose what information you share with whom. granted you'll still be giving all your information to one identification provider but you get to say what of that information is available to any company you want to link the login to. I'm not sure how to go about giving phony information other than having a bogus account though.
I never said I was smart, I just said I was smarter than you
Last I heard, Sun sold their soul to M$ for about $2 billion.
Loading...
The Identity Commons is also working on the same problem, but they have taken a more useful approach than the Liberty Alliance.
Scott Draves
In the spirit of FOSS - to wit, building a working one to back up your specifications - try this. If 50% of websites got a clean bill of health there, the world would be a better place.The error messages there recently got much better. See if you can spot which explicatory message I contributed to the list. The takeaway message is, don't just whine - fix it.
They may be a bunch of meeting-bound administrators, but W3C do produce working code to their own specifications.
Got time? Spend some of it coding or testing