Kaliya, the Identity Woman, says that pass.net is “a new identity protocol”. To me it seems more a smart idea for implementing an effective single sign-on solution. With Pass.net the trick is to delegate identification and authentication to a third party: your email domain. Hence this SSO method is as secure as the mail server handling your email account.

As far as security is concerned, Pass.net could add a new ground for attacks since it relies on a secret confirmation URL built from hashing the email address itself. A correct implementation of the hash function and of the random secret could be an overwhelming complexity for most web site. Anyway Pass.net is a very interesting project, quite simple to implement on any web site with not exceedingly high security requirements and I guess it could be an ideal solution for mailing lists, web forums and maybe blog comments.

It reminds me of a similar approach based on XMPP, the protocol behind Jabber. While XMPP is sometimes perceived as just an IM technology, it includes strong authentication via the Simple Authentication and Security Layer (SASL) specification.

Email accounts are definitely more common than Jabber accounts, but the robustness and flexibility of XMPP is a nice plus. in fact XMPP could act as a universal authentication platform. This fact has been already understood and exploited by Google with Gtalk.

dJOEk in his Dystopics blog had an accurate analysis of Gtalk authentication mechanism and how it can be used by any other web site.

Google hands out tokens securely over SSL. You can use those tokens to auth yourself on XMPP. You can authenticate yourself with your one single Google Account without ever having to give a third party your password.

Then he goes on to explain how you could generate a token to authenticate against Google. There are no auth API from Google, but this undocumented feature is there and it works.

I’ve heard that there are some efforts going on about Jabber and identity and, in our recent meeting, this topic was one that got Boris Mann really excited. I think we can expect some interesting news soon in this field.