Windows CardSpace

~ the obituary ~

There is a category of software that arrives on your computer without being installed and leaves without being uninstalled. Windows CardSpace lived in that category. It sat in the Control Panel of every Windows 7 machine sold in Turkey, and I would guess most people reading this never opened it either.

The idea came from Kim Cameron, Microsoft's identity architect, who had published a set of principles in 2005 called the Laws of Identity. CardSpace was those principles turned into a shipping product. Your identities became cards, each one a picture with a small amount of data sitting behind it. When a website asked who you were, Windows dimmed the whole screen and showed you the cards so you could hand over exactly one of them.

It went out with .NET Framework 3.0 on 6 November 2006 and was built into both Windows Vista and Windows 7. There was a version for XP as well. Microsoft did not ship it as a download people had to go and find, which is normally the hard part, and it still did not matter.

On 15 February 2011 Microsoft announced that CardSpace 2.0 would not ship. There was no migration path, because there was nothing to migrate. The company pointed at U-Prove, a cryptographic credential technology it had acquired along with Credentica in 2008, and U-Prove never became a consumer product either.

~ the case file ~

~ the dimmed screen ~

The one part of CardSpace people actually remember is the screen going dark. When a card was requested, Windows switched to a secure desktop, the same mechanism User Account Control used, so nothing running as an ordinary program could paint over the dialog or read what was in it. That was the correct security decision and it was also alarming. Your machine appeared to freeze for a second every time a website wanted to know who you were.

~ why nobody used it ~

Websites had to support it, and websites had no reason to. A site that accepted CardSpace still needed a username and password path for everyone who was not on Windows, so CardSpace was extra work that removed nothing. Browser support meant Internet Explorer, with add-ons everywhere else, which in 2007 was less of a problem than it had become by 2010.

The other half is that people do not experience passwords as the problem the industry says they are. The friction of a password is small and constant. The friction of learning a new mental model for identity is large and arrives up front, and CardSpace asked for the second in exchange for removing the first.

~ what happened anyway ~

Almost everything CardSpace argued for happened anyway, under other names. Identity moved to a selector you pick from, which is what the Sign in with Google button is. Credentials moved onto the device and got protected by hardware, which is what passkeys are.

What CardSpace never had was a party with enough leverage to make websites adopt it. Google and Apple had that leverage later and they used it. Kim Cameron retired from Microsoft in 2019 and died in 2021, by which point the passkey specifications carrying his argument forward were being written by a consortium rather than by one company.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »