Subject: [pkix] 2014 - The year of the Web Token

From: Anders Rundgren <[email-masked]>
Date: Sat, 28 Dec 2013 08:33:58 +0100

>From an early still public specification:
https://docs.google.com/presentation/d/16mB3Nptab1i4-IlFbn6vfkWYk-ozN6j3-fr7JL8XVyA/edit?pli=1#slide=id.g19c09a112_2_88

    Direct Access from Browser:

        No client middleware to install
        Simple Javascript API: 'Create Key Pair' and 'Sign'
        Not just tied to login! Use anytime you want to strongly verify user.

Since the previous tech leader never got their stuff running [*], management bypassed engineering and bought a ticket to the occasion as well:
http://fidoalliance.org/news/MicrosoftAnnounce.pdf

Cheers
Anders

*]
- Windows for smart cards
- Passport
- CertEnroll. Only Microsoft still believe that exposing hordes of sensitive methods to arbitrary web code is a viable concept
- Information Cards.  Cool stuff killed by Windows legacy and lack of vision
- U-Prove.  Great technology but shouldn't you have the basics in place first?
- VSC (Virtual Smart Cards).  Nice idea killed by a lack of interest in consumer use-cases