CardSpace in .Net Framework 3.0 required that sites deploying CardSpace always have a SSL certificate. This meant that every site that wanted to use CardSpace was forced to deploy an https site. Based on customer feedback, we have decided to relax this requirement for the next release of CardSpace (currently available in .NET Framework 3.5 Beta 2). We realize that there are some sites like blogs which would like to use CardSpace, but consider the SSL requirement to be a deployment blocker. Now, if you have a website that you want to add CardSpace support to, all you need to do is add the object tag to the page and you are done. In addition to requiring .Net Framework 3.5 beta 2 or later, a new version of icardie.dll is required to use this new feature. This will ship with Vista SP1 and an upcoming update to IE7. CardSpace does behave differently for http vs. https sites. When CardSpace is invoked from an http site, CardSpace will inform the user about the lack of an SSL connection and the security implication of this. (Also, note the new streamlined look of this window) In addition, managed card issuers can decide if the card they issued can be used on sites that do not support SSL. This can be done by adding the following element to the .crd file. <wsid:RequireStrongRecipientIdentity xmlns:wsid= ‘http://schemas.xmlsoap.org/ws/2007/01/identity’> If this element is specified then the card can only be used on a site that has a SSL certificate. The card will not ‘light up’
Read More...