When an industry group called Liberty Alliance announced specifications for how to manage “digital identities” on July 15th, it was hardly headline-grabbing stuff. Yet the event may prove important in the history of the computer industry, by marking the beginning not only of an ID system for the digital world, but also of an era in which standards are no longer set mainly by the companies that sell information technology.
Knowing who a user is has traditionally been left to individual websites or software applications. Consumers and company employees tend to have many different identities in the form of passwords and user names. But multiple identities are becoming a serious drawback for e-commerce. Consumers forget their passwords and spend their money offline. Firms fail to purge former employees from their directories, giving them the opportunity to wreak digital havoc.
One basic way to unify digital identities is known as single sign-on. These services let a user — whether a consumer or a company employee or supplier — move seamlessly from one website to the next without having to retype a password. The holy grail, however, is technology that allows businesses to manage identities — and thus risk — in exactly the same way as they do offline, says Jamie Lewis, chief executive of the Burton Group, a consultancy.
Technology firms have lined up to get a piece of the identity pie. Seven of them — including Novell and Sun Microsystems — have announced products that comply with Liberty Alliance’s specification. For its part, Microsoft, which is not a member of Liberty, had hoped that its single sign-on service, called Passport, and a related set of offerings, called My Services, would become the main attraction of its .NET software platform for web services.
Although the technology was innovative, Microsoft got the politics wrong. It had planned to build a centralised system in which it would hold identities on behalf of consumers. But airlines, banks and others began to worry that this would drive a wedge between them and their customers — so Microsoft now also offers software that will allow clients to run their own identity services.
This shift in strategy came too late to stop a counter-movement in the form of Liberty. The consortium was launched last September by Sun, Microsoft’s arch-rival. The idea was that instead of having a central identity provider, multiple accounts would be linked. For instance, a user could buy a plane ticket online and then book a hire car without having to sign on again and retype the destination.
Liberty could have turned out to be just another cartel, cobbled together to neutralise the advantage of the market leader. But the group, which now has more than 60 members, has turned out to be something different: a web-standards body driven by large users (rather than providers) of technology. Its chairman is Eric Dean, chief information officer of United Airlines. Firms such as United got involved mainly because they did not want to get caught in another standards war that would force them to support competing technologies. Anthony Scott, General Motors’ chief technology officer, predicts that large companies will increasingly insist that IT vendors stick with common technical rules.
But there is something more important at work, says William Guttman, an economics professor at Carnegie Mellon University. Increasingly, he argues, standards are not there only to regulate IT; they must also take account of public-policy issues, such as privacy. Without the input of users, government and academics, as well as technology firms and their corporate clients, specifications risk being irrelevant.
Allowing for broad input, however, does not guarantee success. On the contrary, reaching agreement is likely to be harder. The first version of Liberty’s specification deals only with single sign-on, not with the more controversial exchange of user information, such as payment details and buying preferences. What is more, Microsoft and IBM, which has also decided to stay out of the consortium for now, may yet try to launch a competing standard.
On top of this, consumers might not bite. So far, they are not very enthusiastic about identity services. Most register with websites only because they have to, and do not trust technology firms to prevent misuse of personal information. Promoters of identity services will probably have to face the fact that many, if not most, consumers will prefer to stay anonymous — just as they can in the offline world.