Microsoft CardSpace

» see msdn.microsoft.com/en-us/windowsserver/cardspace as it lived, on the wayback machine

~ the obituary ~

cardspace was the part of windows that nobody quite saw. you opened it through a control panel applet and looked at a wall of small rectangular cards that represented your digital identities. each card was a signed pointer to a claim set, ready to be released to a relying website that asked for it. it was a wallet ui for federated identity, and the idea was reasonable. the problem was that the web did not ask.

microsoft shipped infocard with.net framework 3.0 on november 21, 2006. the rename to windows cardspace came with the.net 3.5 release in late 2007. it was installed by default on windows vista and then on windows 7, available as a free windows update download for xp and server 2003. the architecture was built around kim cameron's seven laws of identity, designed to be phishing-resistant by routing the credential exchange through a system-level selector rather than a browser form.

relying-party adoption never arrived. a handful of partners experimented with cardspace login pages, but the vast majority of identity-aware sites went on building their own username and password forms, then started adopting openid and later oauth for federated signin. on february 15, 2011 microsoft announced that cardspace 2.0, which had been in beta the previous year, would not ship. the existing version stayed in.net through 4.0 and was removed from.net framework 4.5 the following year.

i did not see cardspace in the wild as a user. by 2007 i was on windows xp at home with msn messenger and a forum login per site, and no website i used ever asked for an information card. cardspace lived in the same windows i ran, untouched, behind a control panel applet i opened maybe twice out of curiosity.

~ the case file ~

~ what it actually was ~

the technical name was an identity selector. when a website declared in its html that it accepted an information card, the browser called into the operating system, which dimmed everything outside the selector window and showed your cards. you picked one, the selector signed the claims and passed the token back to the site through the browser. the screen-dim was deliberate. it visually separated the credential moment from the rest of the page so that a fake login form could not impersonate it.

~ why it did not catch on ~

the network effect ran the wrong way for cardspace. site operators would only integrate the selector if their users had it, users would only set up cards if sites accepted them, and the bootstrap moment never came. openid solved a smaller version of the same problem with no client install needed, just a redirect to an identity provider on the web. google and facebook then collapsed the entire problem into oauth flows tied to social accounts. cardspace was designed for a more careful world where identity providers were separate from the social networks, and that world stayed mostly theoretical.

~ what carried over ~

the u-prove research project at microsoft research took some of the cryptographic ideas forward and the broader identity-metasystem thinking from kim cameron's group fed into later work on decentralized identifiers and verifiable credentials. cardspace itself left no living install base. on a fresh install of windows 10 the selector is simply not there, and the control panel applet that used to launch it was removed years earlier with the.net 4.5 cleanup.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »