Microsoft Finds Unlikely InfoCard Ally

SAN JOSE, Calif.—Microsoft has found an unlikely backer for its ambitious InfoCard online ID management system.

At the RSA Conference here, Verisign dispelled the notion of a rivalry with Microsoft over identity management and announced that its new VIP (Verisign Identity Protection) network—which is backed by Yahoo and eBay—will work seamlessly with InfoCard in Windows Vista and Internet Explorer 7.

The surprising partnership is a big boost to Microsofts efforts to use authentication technologies to strengthen online transaction security and thwart the escalating phishing scourge.

Verisign chief executive Stratton Sclavos used the spotlight of his keynote to outline how the two authentication technologies would work together to allow users to access both systems without complications.

The partnership clears the way for new technology to handle what is described as "mutual authentication" on the Internet.

Mutual authentication requires that both the destination site and the consumer positively identify each other.

It promises authentication that cannot be phished or spoofed because users arent tricked into entering personal information on fake sites.

On stage, the company showed how a Web surfer could sign on to Microsofts InfoCard and gain access to Verisigns VIP network using a password created by a cell phone or a USB key made by VIP hardware partners.

With full support, a customer would be able to use Microsofts technology to access Web sites that support Verisigns authentication network.

"If we make [identity management] too hard, users will choose less security every time. We have to get to a place where weve created one network and all of this just works," Sclavos said.

Click here to read more about the RSA conference.

The idea that the two companies would be hard-nosed competitors in the space was driven by Verisigns recent announcement that VIP would allow customers to use a single authentication credential across Web sites that support VIP.

eBay and its PayPal transaction service will enable VIP along with Yahoos e-commerce properties.

Verisign said SanDisk and Motorola had already signed on to support the project with USB devices and cell phones.

Verisigns announcement comes less than 24 hours after Microsoft chairman Bill Gates urged an industry-wide push toward trust-based, multifactor authentication systems to help solve the clutter of dealing with multiple passwords for different Web-based accounts.

Gates described existing password systems as a major "weak link" and promised technology to help businesses move away from depending on complex password management policies.

"Password systems [today] just arent cutting it," Gates said. "Im not pretending that were going to move away from passwords overnight, but for corporate systems, this change can happen over three to four years."

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

The Redmond, Wash.-based software maker is working on a set of technologies built on an identity metasystem, starting with InfoCard, which is to be delivered as part of WinFX, the companys managed code programming model.

InfoCard will support Windows Internet Explorer 7 on Windows Vista, Windows XP Service Pack 2, and Windows Server 2003 Service Pack 1 and R2.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.