http://www.boingboing.net/2007/10/07/canadas-privacy-comm.html
(see the exchange in the comments section)

Microsoft is trying to move authentication and privacy apparatus out of the browser and into the OS. The kind of effort the article refers to IMO results in MS Active Directory becoming a must-have even for LAMP servers... another unworkable monopolist "de-facto" standard pops into existence because of tying with the Windows client.

Required reading from Jeremy Alison of the Samba project:
http://samba.org/samba/news/articles/low_point/column01.html

''Currently if you want to put your Windows clients and server into a "single-sign-on" environment (and let's face it, who wouldn't), your only real choice is Microsoft Active Directory. Why is this ? Well, the main obstacle is that Windows client won't log on in "Domain" mode without it, and Windows servers use information held in Active Directory to make authorization decisions for Windows clients. Enough of the protocols that the Windows clients and servers use to do this are not documented by Microsoft to make creating an inter-operable server a risky business for any commercial entity. Few have tried; Sun, with their "PC-Netlink" product was cut off from access to the Windows 2000 source code when their supplier AT&T abruptly had their contract to port the Windows source code terminated by Microsoft (thus instigating the EU case).''

It is easy to imagine all those hosting services nervously adopting AD as their standard identity server, lest they risk their ebusiness grinding to a halt because of possible glitches in CardSpace-Samba interoperability.

The same fear and uncertainty that end-users experience when contemplating non-Windows alternatives could be forced onto web admins in this way. If you can make a server product that defacto owns the web authentication market, then your product also wins the hosting market for most of the web.

( Yet another possible wrinkle is whether the CardSpace-type identity schemes require implmentation with keys undisclosed to the user -- like DRM keys only hidden in TPM hardware -- which would automatically disqualify GPL3 products like Samba. )

Steve Ballmer himself just indicated that he wants FOSS projects like PHP to 'innovate on Windows instead', using legal threats if necessary. See PJ's assessment of this at Groklaw.

...though I am sure the more garden variety of MS monopoly pressures will also be brought to bear, like warning people that they are trying to login to a "possibly insecure" https session.

Also, does MS have an easy and secure way to migrate one's CardSpace-encapsulated identity to another operating system? Or is this yet another way in which Windows will hold people hostage?

Final thoughts: If authorities and the tech community are unwilling to teach people a couple semantic rules for secure browsing, then either SSL won't get used properly and the current level of spoofing and phishing will remain, or else the Internet will turn into an authoritarian regime locking out non-monopoly technology and non-conglomerate business and opinion.

The need for semantic verification (looking at the domain name in context) by the user is irreducible when independent parties securely interact. The flashing of pretty trademarks to click on doesn't work for veracity because users cannot identify icons down to the last bit the way they can with alphanumeric information. This is why SSL certificates are keyed against domain names.

After a user checks for the lock icon along with the domain in the address bar, the only decisions left (indeed the only ones that CAN be made WRT security) are: A) is the domain spelled properly? B) do I trust them with my data? C) do I trust the Certificate Authority? Anything beyond that is like having a telephone system that tries to steer people away from dialing certain phone numbers because you might have mis-dialed in an attempt to reach a mainstream bank or chat line. All the user can do is check the number they dialed, and all the 'system' can do honestly is check that they reached the certified holder of that number.