A Closer Look at Passport

Passport, Microsoft’s system for authenticating users, is becoming increasingly important to the company’s future. A broad array of future services will tap into Passport, and it provides an important proof-of-concept for Microsoft’s vision of Web-based services. Microsoft not only requires Passport for many of its own Web sites but is also linking to it from within Windows XP, and encouraging third parties to implement it on their own sites. Organizations and users stand to gain some benefits from Passport, but companies should understand its design, implementation, and possible downsides, and users should understand exactly what information Passport collects and how it is used. (See the sidebar “Is Passport Paranoia Justified?“.)

What Passport Does for Microsoft

Microsoft introduced Passport in 1999 to make MSN more convenient for users. Passport allowed users to access any MSN property while using a single username and password, and to store certain information necessary for e-commerce—such as their credit card numbers and shipping address—in a centralized “Wallet,” so they could make purchases without reentering this information. Passport not only improved the MSN user experience but also provided Microsoft a way to gather aggregate demographic and usage information, such as the average age of Hotmail users or the average number of MSN sites a user signed into in a single month. (Passport’s architecture and privacy policies prevent Microsoft from using this information to target specific marketing messages at individual users.)