# by | 2009/09/17 23:18 | OpenID | 트랙백
Today there are over 500 government websites and about 1/3 of them require a user name and password. Users need to be able to register and save information and preferences on government websites the same way they do today with their favorite consumer sites, but without revealing any personally identifiable information to the government.[3]
The challenge is that supporting this kind of citizen interaction with government via the web means that identity needs to be solved. On the one hand you can’t just ask citizens to get a new user-name and password for all the websites across dozens of agencies that they log into. On the other you also can’t have one universal ID that the government issues to you and works across all government sites.Citizens need a way to interact with their government pseudononymously& in the future in verified ways.[6]
Later this morning at the Gov 2.0 Summit, Federal Government CIO Vivek Kundra
The OpenID Foundation
The government is looking to leverage industry based credentials that citizens already have to provide a scalable model for identity assurance across a broad range of citizen and business needs – doing this requires a trust framework to assess the trustworthiness of the electronic credentials. see Trust Framework Provider Adoption Process (TFPAP). A Trust Framework Provider is an organization that defines or adopts an online identity trust model involving one or more identity schemes,has it approved by an government or community such as ICAM,and certifies identity providers as compliant with that model. The OIDF and ICF will jointly serve as a TFP operating an Open Trust Framework as defined in their joint white paper, Open Trust Frameworks for Open Government.[3]
The draft process for selecting approved Trust Framework Providers that will then certify individual identity providers is titled "Trust Framework Provider Adoption Process for Levels of Assurance 1, 2, and non-PKI 3" and is available for download as a PDF.
That draft includes requirements that OpenID or related Info Card identities not be used to authenticate people who are physically present (it's just for remote online access), that they not be used to transmit activity data or anything else beyond what is specificallyrequested by a government agency and that there be measures taken tocontinue protecting personal information if the identity provider goesout of business.
Google, Yahoo, PayPal, AOL, VeriSign, Citi, Equifax, Acxiom, Privo and Wave Systems will be the ten organizations to act as digital identity providers using OpenID and Information Card technologies in the first pilot programs designed for the American public to engage in open government. Representatives from the companies had met with governmen tIT officials early August to engage in talks about the initiative,which ReadWriteWeb
Dr. Jack Jones, NIH CIO and Acting Director, CIT, notes, “As a world leader in science and research, NIH is pleased to participate in this next step for promoting collaboration among Assurance Level 1applications. Initially, the NIH Single Sign-on service will accept credentials as part of an “Open For Testing” phase, with full production expected within the next several weeks. At that time, OpenID credentials will join those currently in use from InCommon, the higher education identity management federation, as external credentials trusted by NIH.”[1]
Most likely users will be presented with an array of logos to click on,launching a new window to communicate just with the identity provider. Once a user proves who they are to the identity provider, that companywill then vouch for the user to the government site.[2]
OpenID board member and Facebook employee David Recordon explainedto ustonight that participating government sites are not allowed to passpersonal information about users from one site to another, even thoughwe'll be logging in with the same accounts. Instead, when weauthenticate ourselves with Google, Yahoo, Verisign or whoeverourIdentity Provider of choice is, that website will pass adifferent,unique URL to the government site we're logging in to.[2]
Don't worry, your doctor will not store your medical records underyourTwitter handle yet. The pilot program is stepping first into aphase of public discussion, it is participated in only by IdentityProviders that have undergone extensive scrutiny (Twitter's notincluded) and participants say that individual privacy is being treatedwith the utmost regard. If they can pull it off, these organizationscould makeusing the .gov web easier and more effective than it's everbeen before.[2]
The identity providers will keep track of all the unique URLs used toidentify us to different government sites and we'll just need toremember one log-in. That means you'll need to trust your identityprovider to keep your private information separated between agencies-it won't be up to the government sites themselves to do so.[2]
# by | 2009/09/10 23:58 | CardSpace | 트랙백 | 덧글(2)
It’s an extension of something called the “finger protocol”that was used in the earlier days of the web to identify people by their email addresses. As the web expanded, the finger protocol fadedout, but the idea of needing a unified way to identify yourself has not. That’s why you keep hearing about OpenIDand the like all the time.[1]
The problem with it has been that it’s just a string of text, nothing more. You cannot attach information to it to let others know a bit more about you — something vital for true identification. Then idea behind WebFinger is that you should be able to attach any information you choose to your email address.[1]
Supplying such detailed information as e-mail addresses and fullnames was considered acceptable and convenient in the early days of Internetworking, but later was considered questionable for privacy andsecurity reasons. Finger information has been frequently used by crackers as a way to initiate a social engineering attack on a company's computer security system. By using a finger client to get a list of a company's employee names, Email addresses,phone numbers, and so on, a cracker can telephone or Email someone at a company requesting information while posing as another employee. The finger daemon has also had several exploitable security holes which crackers have used to break into systems. The Morris worm exploited an overflow vulnerability in fingerd (among others) to spread.[5]
# by | 2009/08/18 13:22 | OpenID | 트랙백
Burton Group’s Catalyst Conference North America 2009 will be the host of the single sign-on interoperability demonstration for cloud applications July 27-31 in SanDiego, CA. Wednesday night, July 29th. [2]
Interop participants have agreed upon the base scenario for the demo. In this case, identity provider instances will demonstrate single sign-on to several application environments – using SAML, WS-Federation and OpenID. Where supported, identity providers will also demonstrate just in time provisioning of user access. There will be an advanced scenariois being developed that combines SAML 2.0 and OpenID to meet NIST’s Level 1 through Level 3 identity assurance guidelines. This scenario is being built around a sample application, led by JanRain.[2]
thanks to participants such as Cisco WebEx, Exostar (hosted SharePoint),eXpresso Corp, Google Apps, PivotLink, SalesForce, and even BurtonGroup's client web site. Other participants contributing from thefederation software side include Arcot, CA, Cloud Identity, FuGenSolutions, IBM, Microsoft, Novell, OpenIAM, Ping Identity, RSA,Siemens, Sun Microsystems, Symplified, and TriCipher. FuGen Solutionsand JanRain have also been developing some advanced scenarios todemonstrate how higher levels of assurance can be achieved in afederated authentication. Other organizations that have alsoparticipated include Azigo, Information Card Foundation, Microsoft LiveID, MySpace, Plaxo, and Yahoo!.[1]
# by | 2009/07/16 08:08 | 기타 ID 동향 | 트랙백
Similarly, major identity providers like Google, Facebook are stuck at sharing a few hundred million users between them, they shift their attention to somehow involving all those users that didn’t sign up withthem. Pretty much all of them are OpenID providers already. Facebookjust took the obvious next step in becoming a relying party as well.The economics are mindbogglingly simple: Facebook doesn’t make money from verifying peoples identity but they do make money from people using their services.
# by | 2009/05/25 23:09 | OpenID | 트랙백
◀ 이전 페이지다음 페이지 ▶
