Is Passport Paranoia Justified?

Passport is currently undergoing its most intense public scrutiny since its introduction in 1999. The Electronic Privacy Information Center (EPIC) and other consumer privacy watchdogs are worried about Passport’s integration with Windows XP and forthcoming Microsoft products, such as the HailStorm Foundation Services, and recently asked the Federal Trade Commission to investigate how Passport collects information and how this information is shared and used. In addition, researchers have published information about Passport security threats.

What Passport Can and Can’t Do

Based on architectural information derived from the Passport SDK and white papers, here is what Passport can and cannot do. This does not necessarily mean that Microsoft or participating sites use Passport in these ways; it merely means that it is possible.

Microsoft can use Passport to track:

• All the different Passport-enabled sites or services a user has visited
• The time that a user begins each Passport session