Comment Articles

Taking Liberty's word for it

Rupert Goodwins ZDNet.co.uk

Published: 16 Jul 2002 15:08 BST

Ladies and gentlemen -- roll up, roll up. It's time for another one of those tiffs the IT industry does so well. For your delight and amusement, Microsoft takes on the Liberty Alliance in a battle to the death! Who will win in the fight to give you, the lucky consumer, the golden age of Net freedom through federated authentication? But among the razzmatazz and the carefully positioned press releases, none of the players want to discuss a deeper issue -- do we want what they're doing at all?

Federated security works by security services sharing information. You have access to one service, and you agree for that access to be used to let you into another. You store your details in one site, and agree for those details to be passed onto another. Microsoft's Passport is one way of doing this, and the Liberty Alliance will be another.

Liberty Alliance lists four good things about itself and what it does. It will support a broad range of identity-based products and services; enable organisations to realise new revenue and cost-saving opportunities that economically leverage their relationships with customers, business partners and employees; provide consumers with choice of identity providers, the ability to link accounts through federation, and the convenience of a single sign-on; and finally it will increase ease-of-use for consumers to stimulate e-commerce.

Sounds nifty if you're an organisation and great if you're selling identity-based products and services -- which, of course, every member of the Liberty Alliance does, as does Microsoft. But is it a good idea if you're a consumer?

It would be wonderful in a perfect world if you never had to log on to anything, never had to carry keys you could lose or remember a PIN to get at your cash. The world, gracelessly, refuses to comply. The next best thing, the Liberty Alliance and Microsoft says, is to have just the one key, just the one PIN, just the one login. Oddly, the rest of the world doesn't agree. No car is sold with the selling point that you can open it with your house keys: no bank would recommend you set all your PINs to the same number. A single point of vulnerability is never good.