Coalition to unveil Net ID system

Concerns raised over security, privacy

WASHINGTON (AP) -- An industry coalition is set to unveil standards for identity authentication on the Internet, the first step toward making the task of remembering long lists of Web site passwords a thing of the past.

The Liberty Alliance, which includes companies like Sun Microsystems, Sony, American Express, Mastercard and Bank of America, plans to release the details Monday.

The standard is designed to make it easy to log into different systems -- from making online purchases to checking bank or credit card accounts -- while making different authentication systems speak the same language. That realm is currently dominated by Microsoft, whose Passport system runs on about 200 Web sites.

"The promise of electronic commerce has not been delivered on," said United Airlines chief information officer Eric Dean, who also serves as the head of the group's management board. "There are huge possibilities."

Privacy advocates, however, say the creation of a single identification standard will make it easier for businesses to profile Internet users for marketing purposes.

"They want identification data to find new marketing avenues," said Chris Hoofnagle, legislative counsel for the Electronic Privacy Information Center. "What it means for the individual is more spam, more direct mail, more telemarketing."

Hoofnagle said a single Internet ID also will place individual financial data at greater risk for disclosure over the Internet.

"It's like using the same key for your house and your car and your safe deposit box," he said. "Compromise that one key and all the golden eggs are compromised."

Starting small

Dean said Liberty Alliance is starting small. Users will be able to choose to "link" different accounts, so Mastercard.com will be able to identify the same user that visits United.com, without having to type in another password.

More robust features, like a detailed profile that contains the user's address and phone number to be shared with all the Liberty-enabled sites, will come later. Dean said the slow ramp-up is designed so Web site developers can start using it within months.

"We can extend United.com to do this without having to launch a rocket to the moon," Dean said.

It has been almost a year since Liberty Alliance was announced. Without any real product or service to speak of, most of the attention has focused on friction between Liberty members and Microsoft.

During Microsoft's antitrust penalty hearings in April, Microsoft lawyers derided Liberty's name as an attack on Microsoft. They said it means "liberty from Microsoft hegemony." While testifying against Microsoft, Jonathan Schwartz, Sun Microsystems's top Liberty representative, called that interpretation of the name "paranoid."

Competing standards?

Microsoft and Liberty members have discussed Microsoft joining the alliance, but no deal has been struck.

Microsoft has not yet seen the Liberty standard. While Microsoft said it agrees a single Internet ID standard is a good idea, it wants Liberty to use Microsoft's Passport system.

"We are not distracted by Liberty versus Passport battles," Microsoft spokesman Adam Sohn said in a statement. "We are instead focused on answering broader customer demand for security in the Web services environment."

Dean downplayed Liberty's disagreements with Microsoft, including the idea that Microsoft may join Liberty only to co-opt and change the standards for its own purposes. Several critics, including Liberty members Sun and AOL Time Warner, have said Microsoft has done that to other technology standards, essentially "breaking" them so competing products don't work as well as Microsoft's. (AOL Time Warner is the parent company of CNN.com.)

"There were some concerns about that at the beginning," Dean said. "We have not talked about that much in the past six months."

Copyright 2002 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.