New York Times on Passwords and Alternatives

There is a new article by Randall Stross in the New York Times titled "Goodbye, Passwords. You Aren’t a Good Defense".

I am thankful for this article and I think that we need more of them. It is targeted at a readership that is no expert in security and privacy; and never will be. It informs its readers that there are problems with passwords and that openid (yet?) isn't the solution either. I think that with Information Cards we are moving in the right direction. True, we are not there yet, but major players by forming the Information Card Foundation have decided to jointly work on a accepted and interoperable solution.

Microsoft is doing the right thing to put their implementation of the card selector, CardSpace, into Windows Vista. And to improve it again and again; and put this major component for Internet security outside the long Windows and .NET update cycles; and to support alternative implementations of the identity selector and the other components of the Identity Metasystem.

One thing that I am missing from the article is the notion of "claims". Information Cards are "information cards" not "login cards" and especially they are no "id cards"; they might be used for authentication and even identification but, I believe, that the major thing to note about Information Cards is that they, by means of a trusted client component - the card/identity selector - enable the secure and privacy friendly exchange of data about the user.

Information Cards will be available on major operating systems and browsers. Many people are working on this and we will be successful.