Web services providers fight off privacy concerns

From...

By Scarlet Pruitt

(IDG) -- Despite a good rattling by privacy advocates, leading companies offering Web-based authentication and single sign-on services stuck to their guns at the Computers, Freedom and Privacy (CFP) conference in San Francisco Thursday, defending their record on privacy and saying that it tops their list of concerns given that it is important to their long-term business success.

Executives from Microsoft Corp., VeriSign Inc. and Sun Microsystems Inc. all touted their Web authentication and location services as privacy-friendly, repelling sharp arrows of criticism launched by CFP attendees who raised concerns over information sharing and data archiving.

"Privacy advocates generally don't like very large databases full of personal information," said Jason Catlett, president of Junkbusters Corp., a privacy advocacy and antispam group.

Catlett as well as other CFP attendees expressed concern that the user information gathered through Microsoft's Passport single sign-on service, for example, could not only be shared with the company's marketing partners or used to target consumer promotions, but could also be vulnerable to security leaks.

IDG.net INFOCENTER ITWorld.com home ITWorld.com Webcasts ITWorld.com forums Free e-mail newsletters Related IDG.net Stories CFP: Experts chew up national ID card idea Privacy: The continental divide CFP: Debate over ICANN reform rages on Features PC World.com Product Finder All about Microsoft .Net Top 10 rules for e-business success Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

However, Brian Arbogast, vice president of Microsoft's .Net Core Services Platform, Services Platform Division, refuted claims that his company was endangering consumer privacy.

"I actually think that we are representing leadership in privacy," Arbogast said, adding that the Passport service gives users control over their data.

Passport is an opt-in service that allows consumers to visit and shop at a variety of Web sites without having to re-enter their personal information because it is stored in their Passport account. The Microsoft service is similar to Sun's Liberty Alliance single sign-on service which is being adopted by a number of companies to compete with Passport.

While privacy advocates expressed concern with any company storing a wealth of consumer information, Arbogast argued that at least for Microsoft's part, it was in the company's best interest to cater to privacy concerns, not disregard them.

"I can not think of a situation where it would be in our best interest to step away from our privacy policy," said Arbogast. "Our business success is focused on the long-term and in the long-term we have to give consumers what they want," he added.

Avi Rubin, principal researcher at AT&T Labs, warned consumers that if privacy is what they want, they have to voice public outcry now.

It's easier to build privacy protection into a technology than it is to impose it on the technology later, Rubin said.

Despite suggestions that companies only put privacy protections in place when consumers express outrage, VeriSign Senior Vice President and Chief Policy Officer Roger Cochetti argued that companies such as Microsoft and Sun have raised their own bars in terms of privacy.

"(Passport and Liberty Alliance) have gone beyond anything I've seen before in self-regulation of privacy," Cochetti said. VeriSign works with both Microsoft and Sun, providing them with authentication services.

Still, security remained a concern for some conference attendees who poked fun at both Microsoft and Sun's security record.

"You are never going to hear me guarantee security, because we can't," Arbogast conceded. He added, however, that Microsoft was spending a lot of money to provide added security.

Regardless of increased security expenditures, Rubin expressed concern over the entire Passport idea.

"Even assuming Passport could be done securely, the idea of Passport is the enemy of privacy," he said.

Both privacy advocates and service providers attending the CFP conference seemed locked in their debate over whether privacy and Web services such as Passport are compatible.

"This topic hasn't been a big issue yet but will be a massive issue soon," predicted Dan Gillmor, technology columnist for the San Jose Mercury News.