Microsoft Defends Passport To Privacy Group

securitas writes: "CNET reports that Microsoft is defending Passport as safe and secure in a presentation to the Center for Democracy and Technology. Other organizations such as the Electronic Privacy Information Center, Junkbusters and even the U.S. government may be lobbied by MS this week to fend off a Federal Trade Commission complaint filed by 15 consumer and privacy groups that charges unfair and deceptive practices."

Comments

security and privacy a difficult issue

[Proud Geek]

Passport is definitely an easier solution for consumers than any alternative yet presented. Having all your information stored in one central location is definitely better than having all your information stored all over the place. Microsoft also has a lot more motivation and resources to protect it than Joe Random Vendor.

The problem is that they haven't had any success protecting it anyway. To be completely fair, neither has anyone else. The other difficulty is that although I would trust MS rather than JRV to protect my data, the necessity of distribution and interaction opens up a whole new class of security holes that no one has even thought of before.

The unfortunate truth is that right now the only way to protect your privacy online is not to give out any information, and that Passport will do exactly nothing to remedy this situation.

Re:security and privacy a difficult issue

[kilgore_47]

Having all your information stored in one central location is definitely better than having all your information stored all over the place.

I disagree.
Just because I am truthfull when entering my age on one site doesn't mean I want to be on another site. If both ask for my age, and both use passport, I'd have to use two passport accounts to achive my age-deception! And that defeats the whole purpose.

Age is just a trivial example. What info (and how much info) most people give out varies greatly between sites. How does it benefit me, the end user, to have all my info in one place? I can remember passwords, so that one-password argument is no good.

And, even if I wanted one place for all my info, M$ would be the last company I would want to administer it.

Re:security and privacy a difficult issue

[Matt Lee]

If your personal information is so valuable, don't leave it lying around. Logging out should be just as natural as putting your credit card back in your wallet when you're done with it, or not leaving your checkbook laying around. Surely we shouldn't all stop using credit cards just because people can exploit carelessness to commit fraud.

Selective paranoids

[frleong]

So these privacy groups get worried about Microsoft's Passport leaking information when the biggest leaks of personal info are from fallen dotcoms and stupid e-commerce web sites? People, when you are paranoid, at least be paranoid to everybody, not just to Microsoft.

Re:Selective paranoids

[kilgore_47]

So these privacy groups get worried about Microsoft's Passport leaking information when the biggest leaks of personal info are from fallen dotcoms and stupid e-commerce web sites? People, when you are paranoid, at least be paranoid to everybody, not just to Microsoft.

"fallen" dotcoms are, by definition, no longer in bussiness. Complaining about them won't do any good. Microsoft, on the other hand, is very much in bussiness. Their passport service has a bad track record. There is no indication that microsoft has made any major changes in response to the barrage of criticism it has received. It's growing, and in the future you will undoubtedly see more sites where a passport login is required for certain features. That is why its important to be paranoid about this threat now.

Re:Hmm..

[kilgore_47]

I don't know about many other people, but I don't think too many people would have an e-mail account on a service such as Passport if it was going to contain highly sensitive material. I use services like this as "spam e-mails" so that I can sign up for things that require an e-mail address (but some websites won't even let you sign up with an e-mail like Passport or Hotmail, anyways).

Sure, my current passport account is filled with bogus info and is mostly used for hotmail and sometimes msn communities. But the idea is that the passport login will be required for more legit/official uses such as the MSN HomeAdvisor, financial sites, and maybe even ecommerce. Sites that you'd ordinarily give real info to will soon be using passport. And that sucks.

Only trust those you can physically get to

[Mandelbrute]

If you are going to trust a business enough to allow it to have access to your finances, then it should be a business that you can physically reach, so that if something goes seriously wrong you can call the police in your own country or go bang on their door yourself without getting a visa. If nameless employee #6363666 gets up to a bit of embezzlement, and they are in another country, it's likely that you'll never see the money again and the offender will never get extridited.

"I'm calling at international rates from Outthebackofstan, I've been on hold for three hours, and why don't you ^%#$%#^ read your email?"
"Oh, I'm sorry, you have the wrong department, this is the Pacific USA only support line. Please dial this number again in another eleven hours and the people supporting your region will be here. Have a nice day" (To co-worker: "Another commie towelhead") click."

Re:One password, multiple accounts, low security

[sfe_software]

If I'm not mistaken, it's worse than that.

Scenerio 1: User always uses the same login/password everywhere they go.

If you obtained that username and password, you'd be able to log into any service *that you know they use*. You would not be able to log into any random service unless that user happened to have been there before.

Scenerio 2: Passport.

If you obtain their Passport login and password, you could log into services *the user has never logged into before*. I'll admit I don't know much about how Passport works, but it seems that you'd be able to use their credit cards and other personal information at any Passport-enabled site...

So even though users may choose non-secure passwords and use the same info at many sites, you still would have to know what services the user has signed up with. Passport eliminates that obstacle.

Re:One password, multiple accounts, low security

[Kierthos]

And of course, when it does get hacked (I'm sorry, we're talking about M$ here, someone will hack it just because of that) and J. Random User ends up with thousands of $ worth of porn site use, or eBay charges, or whatever, what will be the reaction from M$?

A service pack? Abject denial?

It's simple... if you're providing an online service, you need to supply the best protection possible to your clients. And there is no indication that M$ has the slightest clue on how to do this.

Kierthos

great idea, but not for /valuable/ passwords; ENUM

[bcrowell]

The whole thing is a great idea, but only for less valuable passwords. I'd love to have a service like Passport to keep track of all my passwords for mailing lists, etc. I'd even use it for online businesses that have my credit card info, since the credit card company cancels the charges in cases of fraud.

But no way would I use a single password for important stuff. And there's the problem: MS obviously wants to force you to use it for /everything/. So then you can have your whole identity stolen by the first criminal who watches over your shoulder while you type in your password.

It's also scary to ponder that next they'd probably force you to use it with ENUM, a new scheme we're going to have shoved down our throats, which involves linking the DNS database to the database of phone numbers.

Privacy will be protected, or passport won't work

[sevensharpnine]

I'm not terribly worried by any "unfair and deceptive practices" that may ensue with regard to privacy. Any information given to Microsoft is done so in a completely voluntary manner: any leak of that information would certainly become well-known in a very short amount of time.

The success of the passport system, and quite possibly their .NET "architecture", relies in significant part on the confidentiality of any personal information stored. As the system aspires to collect an amount of personal info I've never seen one company (truthfully) attempt to aquire, I would expect consumers to be very wary. If any of this personal data should be stolen, the repercussions for their entire system could be enormous. In short, I think the market will sort this problem out. Though, given the track record of Microsoft, I certainly don't want to be a test subject while it does.

What's even more interesting, to me, is the fact Microsoft is using it's very large distribution channel to advertise and promote services in which it's competing against non-monopolistic companies. Messenger vs. ICQ (and others), Hotmail vs. many free email services, etc. I can't help but wonder if the FTC will look into this, rather than just the special interest groups concern.

great idea(l)s

[seanw]

this is such a classic microsoft-ism: thinking up a really good idea, and totally fucking up the implementation ([d]com, ole, activex, etc).

what I can't figure out is why this company, which is supposedly on the brink of launching this massive, multi-tiered platform that is .NET has shackled it to possibly the worst authentication possible.

I mean, come on, the username/password combo was maybe reasonable in the days when everyone had exactly one shell account. but today when everyone is expected to remember a user/pass combo for every one of a dozen or so websites they want to log into, the weakness of this paradigm has hit pretty hard. simply put: people can't remember them all, which means they either write them down lots of places (prett damn insecure) or use the same username/password for each account (even worse).

and MS has made THIS the lynchpin of their security model?

why couldn't MS use some of their much vaunted "monopoly power" to "leverage" an authentication system that actually matched the sophistication of the rest of .NET?

my suggestion: the medium which most people are accustomed to carrying that is intimately tied to their financial and personal data is the credit card. my MS "Passport" could be a physical smartcard that held authentication data, encryption keys...hell, anything. each copy of XP (and each bundled OEM copy) would include a small USB device that could read this card, maybe that was designed to mount onto the side of the monitor so it would stay out of the way.

YES this would be a major move, and it would stir things up a little. but when it is clearly called for, WHY NOT? people would just carry another little card in their wallet, the reader device would be small and dirt cheap (in that volume, most anything is) and in a year we would forget what we did without them. we have calling cards, and credit cards,and ATM cards...where is my computer card?

in any case, tying their much-heralded .NET platform to the username/password "security system" is about as intelligent as locking your car with duct tape, and will probably be about as effective.

Single Point of Failer, but needed...

[tshak]

Passport, or a similar concept, is still needed. Customers want it. If a user has to have 10 different logins, they may:

1. Use the same password on all 10 anyway

2. Use grossly easy passwords so that they can remember them

3. A combo of 1 and 2.

With a Passport like concept, there's only one account to remember. Maybe then consumers will find it reasonable to memorize a secure password. Either way, a centralized system is needed for identification. As a web developer for 5+ years, customers don't want to fill out the same crap each time they visit a site, and if they could just type in their passport info to authorize access to certain private information, they'd do it. Now, it's up to us to come do the social and technological engineering to make this happen safely, and securely.

Re:Single Point of Failer, but needed...

[Chris McLaren]

I agree that a password store/person profile store is very useful... but why does it have to be online?

Why couldn't you store the required info in an (encrypted) store on your machine and use that to answer the types of requests you are talking about. Same result to the end user without having all this information in some remote store.

You could go further and set the system to autmoatically answer requests in some cases (perhaps in cases where the site has a P3P policy meeting certain conditions, etc.) and you could have every response be part of a digitally signed package that provided a "paper-trail" of exactly what you shared with that site and what purpose they claimed they would use it for.

Much better solution, without MS holding all my data.

Multiple passwords are *not* more secure

[Anonymous Brave Guy]

Because people usually don't pick very secure passwords, it's better to have multiple passwords so that an evesdropper or other malicious person can't crack into all yur accounts.

Unfortunately, that's just not true. Usability research has shown certain facts about passwords again and again. In particular, as soon as you start forcing users to remember several passwords, they immediately start using obvious and easy to remember passwords, or writing them down in a readily accessible location. Clearly, this does not improve security.

Having a single sign-in, with a single, genuinely cryptic ID and password, is far more secure than twenty different authentication schemes for different facilities. Of course you rely on the keeper of that information to keep your data in a trustworthy fashion, but you have that problem anyway. At least with a single secure sign-in the average five year old can't guess everyone's ludicrously simple password.

Re:Multiple passwords are *not* more secure

[Anonymous Brave Guy]

Ah yes. Usability research, the great curse of the 21st century rears it's ugly head again.
And why pray tell,should we take anything that involves people stupid enough to dump hot coffee or tea in their laps seriously?

Good usability research involves observing the people who are actually going to use your product, using your product. If those people are stupid enough to dump your hot drinks on themselves, you need to design a product that stops them doing it. What you don't need to do is complain that they are stupid.

This is the point. If you're designing a product, whatever it may be, and you want to sell it to a particular market, then your personal opinion on what that market should do is totally irrelevant. Your preconceived ideas about how they should behave are totally irrelevant. You have to watch what they do do and how they do behave, and adjust your product accordingly. If you don't, your product will not be a success, and all the ego in the world won't change that.

Hmm, what are the alternatives?

[magi]

I guess there must be dozens of distributed alternatives to this centralized Passport system. It would be interesting to find a nice short overview about them.

I think a nice solution would be a kind of "PassPouch", based on public-key crypto, etc. A pouch would contain arbitrary number of passwords. To authenticate a user, a service would need your pouch password to open the pouch, and then use its site-password to authenticate a security cookie in the pouch. Well, something like this. You could have multiple pouches, and a pouch could be stored in your personal computer, or in any "PouchServer", based on for example LDAP. There probably already are such systems, but I haven't noticed any so far (I don't know much about the topic).

Re:Passport - Great idea, iffy implementation.

[quartz]

Nobody's saying it should be "crushed at all costs". I simply won't use it. And neither will, probably, all those who don't like the idea. For me at least, it's a little difficult to trust Microsoft with my personal data when I don't even trust them enough to have any of their software installed on my computers. It's not an emotional or religious issue: I just can't trust them.

Regarding several comments...

[mindstrm]

Firstly, those who say that it's GOOD to have centralized authentication like this, because people tend to be sloppy with their passwords, etc.

Okay. On a small scale, it might make sense. This is not a small scale. This is microsoft. The Internet was not built so one company could control it; it's independent. MS is doing this to corner the e-commerce market. I don't want to let them do that. They are already free to compete fairly with everyone else.

Regarding the comment about Windows XP product activation containing a GUID (which should scare everyeone). I refuse to buy a product that requries me to 'authorize' it's use with the company I bought it from. It's wrong. I paid for it, like a product, at the store. It's mine to use. I should not in any way have to deal anymore with the creator unless I choose to.

Regarding Passport in general... using it for hotmail? MSN messenger? Fine. That's great. But let's not get carried away. I won't give MS my financial information, ever.

Re:I will NEVER trust passport...

[shic]

In the UK we have "The data protection act" which allows anyone over the age of 18 to demand a printed copy of all personal information stored about them online (and now, I understand, offline, for example printed) records. The glitch is that a "reasonable search fee" is acceptable (about which I'm annoyed) but the company is required to amend any inaccurate or unnecessary records.

Doesn't America have one of these? Has anyone actually challenged MS to provide a printed breakdown?

every single Free Passport is an asset to Microsof

[stefaanh]

... so it will defend (the value of) it. I explained lately how I got my Passport account. Not with my consent. This is the most anti-democratic construct I've ever seen grow in the U.S.