Microsoft Passport Research Articles

The privacy advocates: resisting the spread of surveillance

Semi-finalist, 2008 Donald McGannon Award for Social and Ethical Relevance in Communications Policy Research, given by the Donald McGannon Communication Research Center. Today, personal information is captured, processed, and disseminated in a bewildering variety of ways, and through increasingly sophisticated, miniaturized, and distributed technologies: identity cards, biometrics, video surveillance, the use of cookies and spyware by Web sites, data mining and profiling, and many others. In The Privacy Advocates, Colin Bennett analyzes the people and groups around the world who have risen to challenge the most intrusive surveillance practices by both government and corporations. Bennett describes a network of self-identified privacy advocates who have emerged from civil societywithout official sanction and with few resources, but surprisingly influential. A number of high-profile conflicts in recent years have brought this international advocacy movement more sharply into focus. Bennett is the first to examine privacy and surveillance not from a legal, political, or technical perspective but from the viewpoint of these independent activists who have found creative ways to affect policy and practice. Drawing on extensive interviews with key informants in the movement, he examines how they frame the issue and how they organize, who they are, and what strategies they use. He also presents a series of case studies that illustrate how effective their efforts have been, including conflicts over key-escrow encryption (which allows the government to read encrypted messages), online advertising through third-party cookies that track users across different Web sites, and online authentication mechanisms such as the short-lived Microsoft Passport. Finally, Bennett considers how the loose coalitions of the privacy network could develop into a more cohesive international social movement.

Whose Name Is It, Anyway? Decentralized Identity Systems on the Web

A new form of personal identity is emerging on the Web. Decentralized identification protocols are a departure from traditional distributed authentication approaches developed for the Internet. From a technical perspective, they're quite similar to distributed systems based on public-key infrastructures or federated identity systems, such as those proposed by the Liberty Alliance, or Microsoft's Passport. What distinguishes the new decentralized approach is its use of URIs as the underlying identifier. The Web - using URIs as the basis for a global hypertext system of documents - set off an unprecedented explosion of human communication and knowledge sharing. So, too, could these new decentralized identity systems potentially augment the Web to let us reliably and scalably communicate with each other about our identities in a more trustworthy manner.

Issue report on business adoption of Microsoft Passport

PurposeThe purpose of this paper is to examine the feasibility and desirability of using the Microsoft Passport service for client authentication and authorization. It aims to present the business benefits of using Microsoft Passport, an overview (logical) description of the work involved in adopting Microsoft Passport into a business site, and a functional description of how Microsoft Passport works in conceptual terms.Design/methodology/approachAn analysis of the level of business adoption of passport is then presented.FindingsThe paper concludes that business adoption of Microsoft Passport appears to be losing ground due to lack of trust, control, and privacy; and the proliferation of other identity management paradigms. This issue report is prepared from the perspective of a business analyst and is pitched in terminology suitable for a business audience.Practical implicationsThis work provides organisations investigating the feasibility/desirability of using the Microsoft Passport, a fundamental understanding of passport, how passport works in conceptual terms, and the current business adoption status for passport services.Originality/valueOffers a significant analysis of the feasibility and desirability of using the Microsoft Passport service for client authentication and authorization and its current business adoption.

What's in a Name?

The author examines the debate about Microsoft's Passport technology--it will be difficult to design a workable Internet identity framework. We’re currently trapped between Scylla and Charybdis. On one side, civil libertarians warn that a centralized authentication service comprising a concentration of power and operational and systemic risk represents an unacceptable threat to a free society. On the other, we have a chaotic morass of idiosyncratic user ID and password implementations that inconvenience people and invite attack.

Analysis of liberty single-sign-on with enabled clients

Web single-sign-on protocols-such as Microsoft passport, Oasis's security assertion markup language (SAML), and the Internet2 project Shibboleth, aim to solve security problems by letting individuals log in to many Internet services while authenticating only once, or at least always in the same way. Enterprises hope that single-sign-on protocols will significantly decrease customer-care costs due to forgotten passwords and increase e-commerce transactions by enhancing the user experience. Commercial interest centers on distributed enterprises and on small federations of enterprises with existing business relationships, such as supply chains. We concentrate on the liberty-enabled client and proxy (LECP) profile. The LECP protocol assumes a special protocol-aware client (the enabled client). We also consider the design of security protocols based on XML and Web services.

Governance in Namespaces

Since the creation of the Internet Corporation for Assigned Names and Numbers (ICANN), the regulation of the Domain Name System (DNS) has become a central topic in Internet law and policy discussions. ICANN's critics argue that ICANN uses its technical control over the DNS as undue leverage for policy and legal control over the DNS itself and over activities that depend on the DNS. Such problems are not unique to the DNS. Rather, the DNS discussions are an example of the more abstract governance problems that occur in a set of technologies known as A namespace is a collection of all names in a particular system. Namespaces are ubiquitous. They can be found both in real space and cyberspace. Namespaces analyzed in this Article include the DNS, IP addresses, ENUM, Microsoft Passport, peer-to-peer systems, TCP port numbers, public key infrastructures as well as digital rights management and instant messaging systems. This Article also shows that many of its findings can also be applied to namespaces outside of cyberspace - such as bibliographic classification schemes, P.O. boxes, Social Security numbers, as well as the names of DNA sequences, diseases, and chemical compounds. Namespaces are an overlooked facet of governance both in real space and cyberspace. This Article develops a general theory of the governance of namespaces. Designing namespaces and exercising control over them is not a mere technical matter. Rather, the technical control over a namespace creates levers for the intrusion of politics, policy, and regulation. In particular, the technical control may lead to speech, access, privacy, copyright, trademark, liability, conflict resolution, competition, innovation, and market structure regulation. The Article provides several dimensions along which namespaces can be analyzed. From a legal and policy perspective, it matters, for example, whether a namespace is centralized or decentralized, whether the namespace is controlled by a public or private entity, and the degree to which the internal structure is adaptive. These and other dimensions influence how namespaces protect social values and how they allocate knowledge, control, and responsibility. This Article will also demonstrate that the end-to-end argument was implemented on the Internet by a particular design of a specific namespace. The taxonomic structure developed in this Article can be useful to legal and policy debates about the implications of various namespaces. It may also be helpful to designers of namespaces who consider the legal and policy consequences of their actions.

Privacy-Enhancing Technologies for Internet Commerce

We examine privacy-enhancing technologies based on the consistency of the business plans, technology, stated objectives, and the concept of privacy as embedded in the technologies. Three distinct trust models result from the three distinct concepts of privacy: a right of autonomy, a right to seclusion and a right to property. We use these trust models to segment the privacy market and classify the privacy-enhancing technologies. The Anonymizer and Zero Knowledge's Freedom were built as technologies to enhance autonomy, while Privada Control, iPrivacy, and Incogno SafeZone are built to provide seclusion. Microsoft's Passport is built with an assumption of privacy as a tradable property right. Security, privacy, and authentication are intertwined and sometimes confused in the privacy market. We argue that the creation of new trusted third party is not an effective strategy. In the case of creating a trusted third party, autonomy-based products have been more successful than seclusion-based products, despite the wider array of services offered by seclusion services.