Windows CardSpace, AOL, OpenID

I'm no security guru, but it doesn't take a guru to realize that in the current world of identity theft, phishing, spoofing and what have you, security is a concern. As a developer you need to know at least the basics and try and understand what options for securing your application are available to you. Remember: most likely your boss will know even less about security than you do, he will rely on you to at least steer him/her in the right direction.

With the introduction of .NET Framework 3.0 came the introduction of Windows CardSpace. CardSpace is available on Windows Vista, WindowsXP SP2, Windows 2003 Server SP1, MacOSX and Linux.

"Windows CardSpace enables users to provide their digital identities in a familiar, secure and easy way. In the physical world we use business cards, credit cards and membership cards. Online with CardSpace we use a variety of virtual cards to identify ourselves, each retrieving data from an identity provider. Don't struggle with usernames and passwords, just choose an information card!"

More background information on CardSpace can be found in this introduction and here.

So how do CardSpace, AOL and OpenID relate? Well... AOL supports OpenID. Which means that a number of AOL site are accessible using an OpenID. For instance, I can log into the dev.aol.com using the account I created at http://www.myopenid.com. Now Microsoft supports (or will) OpenID 2.0. So theoretically I should be able to use CardSpace to log on dev.aol.com. There seem to be two ways to do this: AOL could support CardSpace directly, or the OpenID providers of the world can start supporting CardSpace. I don't know if AOL is currently working on supporting CardSpace. Earlier this year Praveen blogged that CardSpace still needed to gain traction, but now that we're almost a year along I think it's time for AOL to jump on the CardSpace bandwagon and start supporting this directly. Right?

In the meantime MyOpenID has implemented support for CardSpace, which means that when I log on to dev.aol.com I get redirected to the MyOpenID website, here I click on the CardSpace icon, select my card and automatically log on to the site. No need to enter a username or password!

Interested in supporting CardSpace on your website? The logo can be downloaded in many sizes from the Microsoft download center.