Advanced

Can the Concordia Project Bring Coherence to Federated Identity?

Posted by Andy_Updegrove on · 5 comments
ConsortiumInfo.org Standards Blog; By Andy Updegrove 		Mail this story
Print this story

Robin Cover's XML Daily Newslink yesterday included a note on the formation of the Concordia Working Group by the Liberty Alliance Project (LAP). The story caught my eye for three reasons: it addresses a real problem, it's using an increasingly common approach to do so, and it's advancing the state of the art at the same time in a new and interesting way. I'd like to look at each of those reasons in greater detail.

First, let's review the real world problem: LAP is wrestling with a frustration that concerns us all: how can we take advantage of all that the Internet can offer without (a) having our privacy violated and our bank accounts emptied by the Bad Guys, while (b) not being driven crazy by endless user IDs, passwords, and other safeguards thrown up to deal with (a)?

The second reason is also systemic, but in a different way, as this Working Group is the latest in a series of initiatives born of the realization that it's increasingly rare for single standards organizations to be able to solve real-world problems for end-users, as compared to point solutions for vendors. The reasons include that there are two many moving parts, too many different organizations involved in standardizing those parts, and too much that has to happen quickly in order to keep up with technical innovation and commercial exploitation of new technologies.

The third reason is that this standards-based particular initiative is being launched using a hybrid methodology that borrows as much from an open source project as from a standards development working group. And very appropriately so, as well.

Full Story

  Nav
» Read more about: Story Type: Editorial

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (5)

Sander_Marechal ·
Related to this: I've always wondered it it would be possible to use GPG as a method of authentication. GPG is widely used. Public-Private ket cryptology usually makes my head spin when I think about it too hard, but it would be something I'd like to try out. So, for the cryptology-minded among you:

Would it be possible to create a website login system in which the website only has access to the public key and where the user has the private key, and prove to the website that he is who he says he is? How would that work? Alice and Bob examples preferred! http://en.wikipedia.org/wiki/Alice_and_Bob
azerthoth ·
Off the top of my head would be a browser cookie that you have emailed to you and you have to manually insert into your cookie cache.

You access the website, website checks the cookie, if you have it your in, if not you get sent to Penguin Petes underwear drawer.
Sander_Marechal ·
Well, if I were to make something like this I'd create a FireFox (yes, and IE7) plugin for it. But I understand your point. Website sends randomized session cookie. Client encrypts cookie with private key. Website decrypts cookie with public key and makes sure it matches what was send.

If you built it into the browser you could have single sign-on throughout the internet. Log into your browser and the browser can log you into all the websites. One potential problem I see is multiple accounts on the same website. How would the browser or website know which account to sign in with?

dcparris ·
Same way as with password managers?
Sander_Marechal ·
Soft-of. Except that you don't need to create new accounts anywhere (you already have your one GPG key that's valid everywhere. I.e. no need to sign up to anything. Just log :-). It would also give websites a nice opportunity to reliably link users from one system to another. E.g. I can associate forum posts with bugzilla comments and wiki edits.

You could even extrapolate it further. Websites could associate the public GPG key ID with posts (in microformat code - http://www.microformats.org). That way even search engines could do the social linking. I.e. it would be possible for technorati to reliably search all your blog posts and blog comments, no matter what blogs they were made at.

But that just bonus. The reason I'd like to do it now is so that I don't have to have a hundred different username/password combinations for all my websites. Even with a password manager its hard to keep track of so many accounts.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post