Update: So it appears that the Nike McFLY's I linked to were a hoax. Still funny though. Thanks Michael for the heads up.
So I attended a presentation on CardSpace last night, easily the least publicized new feature of .net 3.0 The presentation was well done, and I certainly gained what I felt was a good insight into the how and the why, but I couldn't help but be struck by how 1999 it felt from an end user perspective.
I'm not going to even summarize the technology as it pertains to web site operators, merchants, etc. That is all extremely high level security work that I am simply not qualified to evaluate.
It's CardSpace (the client-side piece) that kills me. I'm utterly mystified by two key design decisions that were made that seem to make the product critically inferior to existing solutions.
Identity Tied To A single?! Computer
2005-2006 - Applications begin to move online. Things like calendaring, document management, word processing, bookmarks etc., all start appearing online in a sophisticated, finally useful way.
2007 - Identity Aggregation and Mashups - We're increasingly seeing an open environment where your identity in one location can be mapped to your identity in another. Host your flickr pictures on your blog, your YouTube vids on your social network page, etc.
Later in 2007... (I think) How can my swanky new identity remain LOCKED ON A SINGLE COMPUTER? (Your files are encrypted in a manner that inextricably ties them to a single machine) At best, you can apparently call a utility that will manually export your data, and then you reimport it on other machines. Why on earth would I need to create a NEW IDENTITY for DIFFERENT DEVICES?! What I want is an automatic syncing mechanism that keeps everything about me wherever I am, using whatever device I'm currently using.
No Benefit Today
I've been using Vista for almost 2 months now, and I've yet to come across any site using CardSpace. However, if you've created this single repository of your identity information on your machine, why can't you use it to log in to existing sites and network shares today? It seems like CardSpace could provide this functionality, since it already knows about me, and interacts with both browsers?
A Solution Available Today
2 very slick applications already fill these two gaps, plus a few others.
This is a password management program that I've used for several years now. What does it do and how does it work? Here's a copy and paste from the web site:
- Memorizes your passwords and Logs You In automatically.
- Fills long registration and checkout forms with one click.
- Encrypts your passwords to achieve complete security.
- Generates random passwords that hackers cannot guess.
- Fights Phishing by filling passwords only on matching web sites.
- Defeats Keyloggers by not using keyboard to type passwords.
- Backs up your passwords, Copies them between computers.
- Synchronizes passwords between computers using GoodSync.
- Searches for keywords in your passwords, notes and Internet.
- Portable: RoboForm2Go runs from USB key, no install needed.
- PDA-friendly: sync your passwords to Pocket PC and Palm.
- Neutral: works with Internet Explorer, AOL/MSN, Firefox.
- IE 7 and Vista are now supported.
I would recommend you let roboform generate crazy passwords for you. If you use the same username/password over and over, a hack into one site can easily compromise your security on all of your others. I generated this: E9x$fKpoU41TVQJwvkHq with 1 click.
The only shortcoming is that you have to manually sync your passwords. So if you log on to your bank, and let RoboForm generate a killer password for you, but then forget to sync your files, you can be in some pain when you try and 'recollect' this monstrosity on another machine.
This is a free app, courtesy of the Microsoft small company acquisitions team, that you can set up to automatically keep all of your files in sync via the internet. You HAVE TO CHECK THIS OUT. Here's a list of features:
- Automatically keep your files synced across your windows machines. You configure it to select the directories to sync, and that's it. Anytime you're online, it figures out what has changed on all connected machines, and responds appropriately. I keep a lot of personal files, including my Roboform data synced in this manner.
- On a public machine, or want to access files that aren't being synced? Log in, and you can either browse any machine online via the web interface, or it will even tie in to whatever desktop search application you're using (Live Desktop, Google Desktop) and let you search that way. This has saved me several times.
- Have you read security / backup advice that goes something like: "Periodically burnd DVD's of your data, and mail them to your family"? Do you do it? Foldershare. Remote backups. Done.
Few other tidbits.
If you're considering springing for the USB drive version of RoboForm, and are of the personal opinion that lanyards do little to increase your sex appeal, consider this drive that will fit in your wallet:
2Gb Super thin USB memory (Currently $23 + $5 Shipping)
And finally, I use roboform to store the CD Keys for all of my software, so I can ditch the jewel cases, or easily lost slips of paper.