• PC World
• » Computers

Sun is heading an alliance of companies to promote an alternative to Microsoft's Passport online authentication service, but now Microsoft says it may join the group.

The coalition, code-named Liberty Alliance Project, aims to create a ubiquitous single sign-on and decentralized authentication system for online services, accessible from any device connected to the Internet. The charter members of the Alliance say they expect to complete an agreement on organization and joint technology development within 60 days. Charter members will first meet in October.

"This is an alternative to Passport and Hailstorm. Project Liberty will allow users to decide what information to pass on, and customer data won't be controlled by one party," says Hans Appel, Sun's chief technology officer for Northern Europe.

The Liberty Alliance Project intends to create a universal digital identity service based on open standards. Users should be able to log in once on a given Web site and be authenticated for all the online services supporting the Liberty standard. Customer data, such as phone numbers, addresses, credit records, and payment information, will be secure, according to a statement from the organization.

Challenge or Complement?

The approach mirrors that of Microsoft's Passport program, which promises a single log-on for Microsoft sites and those of its Passport partners. The Passport includes a digital wallet for easier shopping, since purchasing information is stored and need not be entered repeatedly.

However, Microsoft has been criticized for its approach, with some questioning the reliability of its security measures. Others object to having to provide private information to Microsoft in order to use online services. Already, a Passport account is required in order to use Hotmail, and for some functions in the upcoming Windows XP.

Microsoft representatives say the company will consider joining the Liberty Alliance Project if the group members demonstrate a commitment to keep the identity platform open.

"If they are sincere [about an open platform], there's probably an opportunity for us to work together here," says Chris Payne, vice president of marketing for the services platform group at Microsoft. "I don't see it as a competitive announcement."

Limited Sharing

The Liberty alliance has not decided which technologies it will use for the authentication process. However, the group plans to let each participating company store user information on their own servers, says Marge Breya, vice president of Sun One marketing. A health care provider, for example, would set high levels of security for user information stored on its site. When a user goes from the health care Web site to a retail site, only the information needed to purchase retail goods, such as credit card information, would be transferred.

"There will be handshakes between the two companies that the user will authorize," Breya says.

Customers would permit one company's server to talk to another company's servers when visiting a new Web site, Breya says.

Smart cards or biometrics technology could be two possible means of authentication. However, the alliance maintains it will not decide on specific technologies for some time.

Businesses benefit because they will only need to adopt one technology to give access to all users, no matter what device is used, the group says. The alliance envisions users signing on with cellular phones, portable computers, televisions, cars, point of sales terminals, and the traditional desktop computer.

Welcomes Microsoft

"I think more and more people are now realizing that a unified user identity system is very useful and beneficial," says Dana Gardner, an analyst with Aberdeen Group.

Microsoft could potentially benefit from joining the Liberty Alliance because the software maker has not always had a reputation for security and trust. End users, service providers, and large companies will ultimately use the service they trust the most, Gardner adds.

"I don't think it is a given that Microsoft is open or trusted," he says. "Microsoft is a convicted monopolist on appeal, and I think that will weigh heavily on peoples' minds as they decide who to partner with. Sun is going out of its way to make sure enterprises own and control their relationship with the customer. Microsoft has not gone out of its way to show this."

The alliance would welcome Microsoft, as well as AOL Time Warner, which is also working on similar technologies, Breya says. A Web site could have multiple types of authentication available, such as Passport and the Liberty protocol.

Liberty Alliance participation is open to all commercial and noncommercial organizations. Initial supporters include Nokia, General Motors, NTT DoCoMo, Koninklijke Philips Electronics, and Bank of America.

The announcement comes a week after Microsoft surrendered to mounting legal and industry criticism and said it would consider handing over management of Passport to a federated group made up of rivals and corporate partners. Microsoft also said it would open Passport to work with similar competing services.

Privacy Advocates Watch

Privacy advocates say it's hard to judge the proposed system, since no technical details are yet available.

"It's still a sort of vaporware at the moment," says Ian Brown, a spokesperson for Privacy International. "It very much depends where they go, how deeply they embed privacy into this. It is possible, if you have privacy as one of your most important criteria, to build it in. Whether Sun will do that remains to be seen; Microsoft doesn't seem to have done so."

The proliferation of single sign-in systems could lead operators of Web sites to collect users' identities for market research purposes, Brown cautions.

"Four or five years ago, when the Web just started up, a lot of sites required some sort of log-in just to read the site. But most of them eventually gave up on that, and it would be a shame if it went back in the other direction," he says.

A coalition of privacy groups led by the Electronic Privacy Information Center lodged a complaint against Microsoft with the Federal Trade Commission in July. They allege Passport is a deceptive attempt to force consumers to store their personal data with the company.

• See more like this:
• passport,
• Liberty Alliance Project,
• Sun,
• hailstorm,
• Microsoft,
• security,
• privacy,
• authentication