Self certified identities and high risk transactions

Warning opinion follows :)

A while back I blogged on the difference between self issued and managed information cards; which lead to an interesting comment from Aditya;

I was wondering if you could further explain why a self-issued information card is not suitable for higher-risk transactions such as logging into a bank account. From what I gather, the advantage of a managed card would be that it could assert certain claims about a person (like the hair length example you mentioned). However, I'm not sure why managed cards are more secure just for logging in.

It's not that managed cards are more "secure" than self issued cards, the protocols used under the hood are the same. What a managed card gives over a self issued card is the ability for revocation and the ability to add further authentication requirements.

I'm sure most of us, at some point, as a child were a member of a club that you setup with friends. You may well have issued membership cards, much like Calvin and Hobbes had for Get Rid of Slimy girlS. This is equivalent to a self issued card. OpenID doesn't improve this very much - an OpenID provider may check the email you registered with belongs to you, but there is no way for a relying party to know if this process has taken place. With managed cards issued by a third party we have the same problem, the identity provider is claiming information about the card holder but we do not know if this is true, unless we know the inner workings of the identity provider. We should also consider revocation; there is no way to revoke a self issued card. OpenID providers may provide a way to kill an OpenID

However if we become an identity provider ourselves then we have a greater chance to verify any information we send beyond a PPID. Of course with the Geneva framework that becomes plug and play for people with an Active Directory backing their user metaverse; or, like SharpSTS a bit of coding if you use something else.

So consider a banking scenario; when you open a bank account in the UK you have to prove your identity by providing a passport, driver's license or other governmental photo identity. A bank is not going to accept a photo ID backed by Get Rid Of Slimy girlS. Equally a bank is not going to accept an identity card from a company it doesn't have any dealings with. So why should a bank accept a self issued card or an OpenID to allow access to your accounts?

Now arguably self issued cards and OpenIDs could be bound to an account if the bank could trust a user to look after their information; but as we're all aware everyday users are not good at this.

The advantage to a managed card is not that the transactions are more secure, but that a bank could issue its own information card (or its own OpenID - but that goes against the whole point of OpenIDs really, OpenID wants to be the sole username and password you use for everything) and know that the card is valid at every stage; further more a bank can revoke a card on instruction from the account holder. Remember that managed cards don't have to prompt for usernames and passwords (although a nice extension to that would be the ability to change the password prompt each time its used - "Give me letters 3, 5 and 7 from your password" for example), so the flow for a user could simply be selecting the bank's information card; even if we issued a managed card which looks for a self issued card as the authentication process we can still revoke the managed card.

If you're at TechEd go ask Vittorio for his thoughts on this; tell him I sent you *grin*

Technorati Tags: CardSpace,Information Card

Sunday, November 09, 2008 3:22 PM

Your Comments.

# re: Self certified identities and high risk transactions

Thanks for the post, Barry. In fact, my colleague mentioned revocation yesterday as an advantage of managed cards. Moreover, if there is a single card provider that the user can use for all his accounts, then all cards could be revoked simultaneously through the card provider as opposed to canceling each one separately.

On the other hand, using self-issued cards or a managed card from a particular bank would obviate the need to depend on a third-party, which is important.

Mike Jones tells me that banks are more willing to accept self-issued cards if there is a guarantee that a card is protected by a PIN/password, which makes sense (it would be useful anyway because as you point out, users are not good at looking after their information). I wonder if a PIN can indeed be guaranteed. He also mentions a managed card backed by an X.509 certificate on a smart card.

Of course, a PIN defeats the purpose of password-less sign-on but I suppose the information card still protects against phishing.

Left by Aditya Rajgarhia at 11/9/2008 11:56 PM

# re: Self certified identities and high risk transactions

Well there's nothing in the token that tells the RP that a self issued certificate was PIN code protected; so until that happens it's a non-starter.

With managed cards we can have usernames and passwords, X509 (smartcard or otherwise), self issued backed (if the self issued card isn't present it won't load) and kerberos (handy for corporate environments where you're in an AD or other kerberos environment).

Left by barryd at 11/10/2008 11:12 AM

Your Reply.

Comment Form.

Fields denoted with a "*" are required.

*Your name:

*Subject:

You may also like to leave your email or website.

*Your message:

Please add 6 and 5 and type the answer here:

Enter the code shown above:

Preview Your Comment.

# re: Self certified identities and high risk transactions
Thanks for the post, Barry. In fact, my colleague mentioned revocation yesterday as an advantage of managed cards. Moreover, if there is a single card provider that the user can use for all his accounts, then all cards could be revoked simultaneously through the card provider as opposed to canceling each one separately.

On the other hand, using self-issued cards or a managed card from a particular bank would obviate the need to depend on a third-party, which is important.

Mike Jones tells me that banks are more willing to accept self-issued cards if there is a guarantee that a card is protected by a PIN/password, which makes sense (it would be useful anyway because as you point out, users are not good at looking after their information). I wonder if a PIN can indeed be guaranteed. He also mentions a managed card backed by an X.509 certificate on a smart card.

Of course, a PIN defeats the purpose of password-less sign-on but I suppose the information card still protects against phishing.

Left by Aditya Rajgarhia at 11/9/2008 11:56 PM
# re: Self certified identities and high risk transactions
Well there's nothing in the token that tells the RP that a self issued certificate was PIN code protected; so until that happens it's a non-starter.

With managed cards we can have usernames and passwords, X509 (smartcard or otherwise), self issued backed (if the self issued card isn't present it won't load) and kerberos (handy for corporate environments where you're in an AD or other kerberos environment).

Left by barryd at 11/10/2008 11:12 AM

Jump Menu

So what are all these buttons for?

Personalize

Text Size

Layout

Navigation Position

idunno.org

now with extra subtext goodness

Self certified identities and high risk transactions

Your Comments.

Your Reply.

Preview Your Comment.

Buy My Book

Tag Cloud

Article Categories

Archives

Post Categories

Syndicate

Shiny Badge Things