I have working with, writing about and presenting on CardSpace for over 2.5 years now...and in the process refining how I describe to people the benefits of information cards for improving security for end-users. In particular, end-users that are not like us developers...every day people that don't know how to choose which sites are unsafe, which links to click in email, and so on. Consider the following malicious PayPal email: You can see that the "Click here to verify your information" link is not really sending you to the PayPal site. I see this because I hover over the link to verify the destination...but most non-developers won't know to do this. For those unsuspecting users the story might play like this: They go to the destination site, which might look just like the PayPal site. They try to log in, it fails repeatedly. In the meantime, they enter every combination of username and password they use in various sites...perhaps including their online banking site. The malicious site collects these combinations of username and password. The user gives up logging in. The malicious sites now tries to log in to the real PayPal account, or worse, to some of the major well-known online banking sites. If they are lucky, and the user is unlucky, one of those username and password combinations will work at the online banking site, and they can write themselves a check, or otherwise play havoc on the user's bank account. It is that easy to lift a username and password combination. So, how do information cards issued by CardSpace (or, any other identity selector) help? Let's assume that the user has associated a personal card with their PayPal account...if PayPal supported information cards. The same scenario might go like this: The user get's the evil email. They click the link and head to the malicious site that looks just like PayPal. If the site doesn't support information cards, the user will be suspicious because they always log in with a card. If the site shows support for information cards, the user may fall for it and click on the "log in with personal card" link which takes them to CardSpace. CardSpace will ask you to confirm the site by reviewing its privacy statement and site identity. This should trigger an indication to the user that this is not the site they think it is, since they would normally only get this the first time they hit the site. If they have logged in to PayPal before with a card, they wouldn't see this screen: Assuming this isn't enough
Read More...