Passport vs. Plan 9

Security by skubalon · 2002-09-20 04:05 · Score: 2, Interesting

Do we really want a single sign on?

Re:Security by RailGunner · 2002-09-20 04:09 · Score: 4, Insightful

I was going to ask the same question. Having a single sign on means that security has a single point of failure. Is this what consumers really want? Why is the Open Source community playing "catch-up" to Microsoft when I know we can come up with a better way to do it...
Re:Security by Anonymous Coward · 2002-09-20 04:09 · Score: 2, Interesting

WHo wants singles singn on? I don't. I quite enjoy making up false marketing info whenever I sign up for anything. A single sign-on system, whether an open project or otherwise, still has the possibility of removing anonymity and privacy.
Re:Security by rmadmin · 2002-09-20 04:37 · Score: 2

How about reversing the idea to some extent? For instance, all of the important information is now stored on your computer (If your running windows, I can understand your uneasiness about this), along with a serial # of some type. Now, the sign on server out in the middle of nowhere has your serial #, and just verifies that your serial # is valid for your computer. So, when you go to buy something, etc, your browser says 'Do you want me to put your info in here?' and you click 'Hell yeah', and it sends that info. Now the server on the other side checks your serial # with the sign on server. Viola.

I know this type of system would need some serious refining to work. And theirs probably lots of problems associated with making this way work. But then again, isn't the same true about the current system they are pushing?

I personally don't want to see any type of centralization, I just thought this idea sounded more fun. :-D

--

Can all fish swim?
Re:Security by broody · 2002-09-20 04:51 · Score: 2, Informative

I want Java Card support everywhere coupled with a single PIN.

--
~~ What's stopping you?
Re:Security by Bangback · 2002-09-20 05:35 · Score: 2, Insightful

I think everyone is missing the point.

Single signon allows you to use hard tokens (either the changing number kind, smartcards, etc.). No one site can afford them for their own use (though Bank of America uses them for medium-sized businesses) but they're quite affordable if everyone shares. Most people don't want 20-30 smartcards anyway.

The cry of single point of failure is really a desire for security through obscurity. Most people I know have a text file with tens to hundreds of passwords (I have 25 or so for work and about 150 for home). They don't change them on a regular basis. (I'm forced to change mine every 60 days -- another reason for the text file) Where's the security?

If I had one password accompanied by a hard token I'd have it memorized and you'd have to mug me to get the token. A single system also allows proper redundancy, security monitoring, etc. You can also have multiple passwords if desired/required -- what's important is that the same security infrastructure is utilized for compatibility (token type, etc.). Just because Microsoft's passport is awful, doesn't mean the SSO concept isn't sound.
Re:Security by einhverfr · 2002-09-20 08:00 · Score: 2

I would cautiously answer yes, but I think we need a *decentralized* one. I.e. placing all our credit card numbers in Microsft's database would create a single point of attack.

A better approach would be something like Kerberos but expanded to the web. Additionally, sensitive data would be stored either on individual's system (well, I don't really think we want to distribute it thsi far) or more likely on localized servers, so that although you have a single point of failure, you don't have a single point of attack.

The problem with the multiple sign on paradigm is that people either 1: use the same password for everything (single point of failure again) or 2: Have trouble remembering their passwords (leading to other types of attacks). I personally use a three tier system, so if someone gets my Slashdot password (via a dictionary attack ;)) that does not translate into an attackable bank account password or even that a dictionary attack would work there.

--

LedgerSMB: Open source Accounting/ERP
Re:Security by FooBarWidget · 2002-09-20 10:38 · Score: 2

Yes, this is what consumers want. Most consumers don't care about security. A lot of them don't run a virusscanner even though they know the risk. They even refuse to learn about nearly everything.

The majority prefers "easy" over secure.
Re:Security by jonadab · 2002-09-20 15:18 · Score: 2

> Having a single sign on means that security has a single point
> of failure. Is this what consumers really want?

It's not what geeks want, but it would suit nearly everyone else
just fine. Most people I know want to walk into the bank, be
recognised by the teller, and not need to sign anything, enter
any PINs, or any other annoying red tape. My sister, who is more
computer literate than average, considers anything that requires
a password to be the antithesis of user-friendliness. If the
family PC required a password on startup, my family be annoyed;
if the screen saver were password protected, they'd riot. The
idea of _changing_ a password on a regular basis scares most
people out of their minds. If I try to explain to my mom (who
works in a hospital) that using the name of a close relative as
a password on the hospital system is insecure, she responds the
way you would respond to someone telling you that running a
quarter mile a day isn't good enough exercise and you should
run twenty miles a day instead.

--
Cut that out, or I will ship you to Norilsk in a box.

Do we really need a single sign in? by dirvish · 2002-09-20 04:07 · Score: 4, Insightful

The question should be: Do we really want a single sign in solution? I don't like passport, or its integration into XP and I probably won't like a Linux version. Single sign in sounds terribly insecure. I suppose the Linux version might be more secure since as Microsoft says, their products aren't made for security.

--
FoundNews.com - get paid to blog.,

Re:Do we really need a single sign in? by rsd · 2002-09-20 07:02 · Score: 2

What's wrong with saving it in the browser
rather than a third party "Evil" server?

Thank god by Anixamander · 2002-09-20 04:07 · Score: 5, Funny

Here I was worried that a company with billions of dollars would be able to dominate the market with their single sign on technology, but apparently some technology I have never heard of that is named after an Ed Wood movie will defeat it.

Can we mod the article -1, Presumputous?

--
Do not taunt Happy Fun Ball(TM)

Re:Thank god by T3kno · 2002-09-20 04:28 · Score: 2

I'm just wondering, not that I completely disagree with you, but do you actually thing that Passport integration with XP is a good thing? Do you trust Microsoft enough to give them the key to all of your personal information? What will you say when Passport becomes a pay-per-use technology? I dont like Microsoft, because I dont trust them, they have never earned that. I also dont like the blind /. bashing of the zealot crowd it doesn't help anything. But this is a really bad idea, especially with all of the DRM crap that Microsoft is wanting to put in their products. If you think it's a good idea I would really like to hear why.

--
(B) + (D) + (B) + (D) = (K) + (&)
Re:Thank god by Loligo · 2002-09-20 04:48 · Score: 5, Insightful

>Do you trust Microsoft enough to give them the
>key to all of your personal information?

Do you trust ANY company enough to give them the key to all of your personal information?

-l
Re:Thank god by Anixamander · 2002-09-20 04:56 · Score: 4, Interesting

Personally, I am against single sign on. I think it is fundamentally dangerous, and ultimately unnecessary. What bothers me though is the degree to which some zealots here are willing to dismiss Microsoft out of hand. As a long time mac user, I know well the feeling of having a superior technology that is dwarfed by the 800 pound gorilla. However, I have never been under the dillusion that MacOS will defeat Microsoft's offerings in the marketplace. And it seems absurd to make such a broad assertion. Better would have been "here is why Plan 9 could (or should) defeat MS..." Quite frankly, if you don't give your competition the respect they deserve and recognize their strengths, you have no hope of defeating them. I'm sure Sun Tzu said something about this. Even MS knows that...look at their efforts to counter open source, etc...they recognize it as a force to be reckoned with.

At this point, I'm not sure where this post is going or what my original point was. But to repsond more directly to some of your questions: I don't have a problem with integration of passport in XP. Its their operating system. For those that need that functionality, having it tightly integrated into the OS can make sense. Having said that, if using XP requires you to use passport, it is one more reason I would personally avoid XP. I don't trust Microsoft, but I use them when it makes sense. I use Office v.X (the office suite unfortunately named after a powerful nerve gas) because it rocks. Say what you will about feature bloat, but it has the features everyone in my office needs. No one uses all of them (or nearly all) but everyone has different needs and I know with Office those needs will be met. And I can disable clippy.

In summary: Single sign-on bad. Microsoft good and bad. Rabid zealotry bad. Any questions?

--
Do not taunt Happy Fun Ball(TM)
Re:Thank god by T3kno · 2002-09-20 04:58 · Score: 2

No, absolutely not. I think it would be cool to have my own signon server that validates me to the rest of the world. If I want to login to my mail account I login to my personal Plan 9 server, it authenticates me and passes that authentication securely to my mail server.

--
(B) + (D) + (B) + (D) = (K) + (&)
Re:Thank god by T3kno · 2002-09-20 05:23 · Score: 2

I'm not necessarily against a single signon, I think for such a system to work you need a technology that uniquiely (sp?) identifies you and only you, such as an RSA token that generates a number along with an access code that only you know.

I completely agree with your points about Microsoft, they are definately a force to be reckoned with, and the open source comminities, the Linux community specifically, need to recognize that and take action. Blind zealotism that simply says "Microsoft sucks, Linux rox!" will never win the war, that's the Al Quiada way. Guerilla war is the way to win, small battles against specific targets, that is the way Apache did it, and is continuing to do it.

We can take Microsoft down, and I think that Open Source software will eventually level the battle field a bit, but it's not through zit faced teen age nerds screaming that Microsoft sucks because I can't pirate XP. Open source, no DRM, easier to learn/use/install/play/create/innovate, those are the keys, and Linux is getting there.

Just my $0.02

--
(B) + (D) + (B) + (D) = (K) + (&)
Re:Thank god by Hard_Code · 2002-09-20 05:45 · Score: 2

Excellent, now the mail server just has to authenticate your Plan 9 server! Ooh ooh, what if the Plan 9 server has it's own signon server? I bet that would solve it.

--

It's 10 PM. Do you know if you're un-American?
Re:Thank god by John+Sullivan · 2002-09-20 06:00 · Score: 2, Informative

I think for such a system to work you need a technology that uniquiely (sp?) identifies you and only you, such as an RSA token

RSA does not uniquely identify individuals. Assuming the maths works out (which I am actually pretty confident about) all it can ever say is that the entity answering the challenge has access to the private key corresponding to the public key the challege was generated with. What's the difference? Well...

that generates a number along with an access code that only you know.

This is very much harder that you realise. There are so many ways this can fail. Deliberate ones such as group or role keys shared between multiple individuals (a better solution for auditability might be to make the role a CA and have it sign special <role+individual> keys), and the more subtle fact the it's never *you* who performs the challenge-response calculation. You delegate the authority for that to your client machine, which you assume is trustworthy to not leak your key or passphrase, and also only to engage in transactions that you have authorised.

Accidental ones are the threat here though. You can have your passphrase shoulder-surfed. You can leak a non-critical password or enough information about the way your mind works to allow a good social engineer to reconstruct your passphrase. (Some people are *very* good at this.) Protocol failures may accidentally send out secret data when they shouldn't. Your system may be attacked by trojans over the wire, or by physical monitoring means by a sufficiently committed adversary. The fact is that no one's client machine is absolutely trustworthy in the sense required above, and although it may be statistically unlikely that any one person is ever attacked, or that an exploit is ever developed and deployed for the remaining vulnerabilities that even the most security conscious user inevitably leaves exposed, this still does not make their machine trustworthy.

This is why using a single key for multiple systems, and the whole single sign-on thing are bad ideas. These systems fail badly - a single compromise exposes every function of the key to abuse, and having lost your whole visible 'identity' it can be very hard to convince some people to revoke their trust in that key.

By separating different functions into different keys and different sign-ons, you both limit the scope of any one breach, and also make it easier to convince third parties (who may never have met you in the flesh, and may never do) of the problem by pointing out the different behaviour patterns in your multiple 'identities'.

--
This is my World Wide Web of Whatever
Re:Thank god by richieb · 2002-09-20 06:17 · Score: 5, Funny

... but apparently some technology I have never heard of that is named after an Ed Wood movie will defeat it.
Apparently the guys that named this technology have a record for coming up with silly names. Just imagine they named their first project "UNIX". That project also faded into obsurity. Didn't it?

--
...richie - It is a good day to code.
Re:Thank god by SquadBoy · 2002-09-20 06:28 · Score: 2

Sometime ago when I needed to find some docs in a vain attempt to figure out why a MS server was wacking a clients network. I had to sign up to download docs. I gave it nothing beyond a false name and a throwaway password but still I felt dirty. But sometimes ya gotta do what you gotta do.

--

Cypherpunks: Civil Liberty Through Complex Mathematics. Those who live by the sword die by the arrow.
Re:Thank god by Elbereth · 2002-09-20 07:04 · Score: 2

You have to do that to access most areas of the Apple web site, too.

I'd love to see all the tech support docs on Apple's web site show up on a P2P network. Who cares about this useless pop culture? If you're going to break copyright law, then make it something worthwhile.
Re:Thank god by KewlPC · 2002-09-20 08:51 · Score: 4, Informative

Plan 9 is an operating system.

To say that you've never heard of it, and because of that it is therefore worthless, is awfully presumptuous.

You can get Plan 9 from CheapBytes.

It was supposed to be the next evolution of UNIX, even created by the guys who came up with UNIX in the first place. But UNIX was too popular, and Plan 9 never really caught on.

But this article seems a bit outdated, or maybe the author has been living in the stone age. Solaris 2.9? 3.0? Unless I'm gravely mistaken, we're at Solaris 9 right now, and I don't see a lot of shops running Plan 9.
Re:Thank god by Gregg+M · 2002-09-20 11:30 · Score: 2

Simple: Blind rage of MS.
It's not blind at all! Have you seen any press on Microsoft in the past ten years? There is good reason not to trust them.

--
Linux is only free if your time has no value. Windows is only free if you threaten to use Linux.
Re:Thank god by Panoramix · 2002-09-20 13:50 · Score: 2, Informative

IIRC, Solaris 8 is actually Solaris 2.8. Solaris 9 is 2.9. Not to be confused with the SunOS version, which would be 5.8 for Solaris 8...

Don't ask. I never really understood Sun's versioning.
Re:Thank god by Eivind · 2002-09-26 01:06 · Score: 2
We don't need to. You see, this thing with single sign in is complete nonsense. We can have single-sign-in without giving up anything to any central database. All we need is one (or more) authorities willing to certify a digital certificate. Here's how it'd work.
- You make a public-key keypair.
- You go to "trusted Authority"
- TA puts his signature on your public key saying: "This public key really belongs to person X".
- When you register with a bank or whomever needs security, you give them a copy of your public key.
- The bank checks the signature and does know that the public key really belongs to you.
- When you want to sign in, you use some sort of challenge-response protocol to proove that you possess the secret key coresponding to the public key.
And there you go. No central database. No "calling home" to inform anyone of where or how you sign up. Safe authentication with the bank, no problem.
Yes, I'm aware that there's some issues I've skipped ligthly over here, such as what to do in the event a secret key is compromised. Some system to deal with such is needed. However, my basic premise, that no central controlling server is needed stands.
It migth seem that my "TA" above is such a central authority -- not so. You could have a multitude of competing TA's and it'd be up to the banks or whatever themselves which ones they'd choose to trust.

correct me if i'm wrong by discogravy · 2002-09-20 04:07 · Score: 4, Insightful

but isn't the biggest thing against single-sign-on the fact that there's a single point of failure? why would open source change that?

--
FreeBSD for the impatient.

Re:correct me if i'm wrong by Anonymous Coward · 2002-09-20 04:16 · Score: 5, Interesting

I certainly don't want a single sign on. Yes, it's a single point of failure. But it's more than that. It's one-stop shopping for anybody who wants to intrude into your life or totally violate your privacy. I don't like passport. I won't like any other system of the same ilk.

I keep differnt account names on different systems. I use multiple passwords that follow rules for mixing case, special chars, and numerics. I never have any programs remember my passwords. It's a hassle to keep up with but I feel a bit more like no one is watching all of what I do.

Am I a paranoid tin-foil hat type? No, I'm an honest up-standing citizen type. I don't think I want to give the keys to my life to anyone, though. I don't want some a hacker breaking in and messing up my life. Nor do I want to be perfectly profiled by a bunch of marketing droids.

Single sign on is great - for a single system. I do not want and will not use single sign on for the internet.
Re:correct me if i'm wrong by Pauly · 2002-09-20 04:34 · Score: 4, Insightful

but isn't the biggest thing against single-sign-on the fact that there's a single point of failure? why would open source change that?

In a word: No.
For one, this doesn't need to be implemented as a single point, physically. By your faulty assertion, DNS can be considered a "single point of failure" , and while DNS is decidedly vulernable, the internet somehow manages to have worked well for a while now. ;)
If it were me, I'd look at the architecture of DNS and copy the strengths of its distributed design. Then again, DNS is borne of scientists aiming for an open internet, not corporations looking to lock it down.
Re:correct me if i'm wrong by daviddennis · 2002-09-20 04:37 · Score: 2

If I understood the article correctly, Factorium is a way of handling a single sign on in a more distributed way, possibly sharing the signon database and cryptographic information between machines.

So in theory we could have a single sign on and multiple points of failure.

That being said, there wasn't enough detail in the article for me to know for sure.

I would say a single sign-on is fine for reading articles in the NYT and Wall Street Journal while having only one login, but I feel genuinely uncomfortable about using it for financial information, and extremely uncomfortable about giving it to Microsoft.

I think a lot of people feel the same way, and that's a major reason why Passport failed. Microsoft was unable to sign up any banks or credit card companies for its service, because they didn't want MS's greedy fingers in their customer databases. The mass of everyday consumers may not be sophisticated enough to distrust Microsoft, but banks are not in that position.

D
Re:correct me if i'm wrong by StoryMan · 2002-09-20 04:46 · Score: 2

It makes you wonder why sometimes -- at least in this case -- a low-tech solution might not be the better alternative.

I mean, cripes, just remember your passwords.

And if you can't do it, try harder.

Simple.
Re:correct me if i'm wrong by NineNine · 2002-09-20 05:07 · Score: 2

Well, that's nice and all, but you're already being tracked with credit cards, your utility bills, and just about everything else you do in real life. If you want to be completely "in control of your information", might I suggest living in a cabin in the woods somewhere with no utilities where you grow your own food? That's about the only way you can be even remotely "private".

I think that average people know that, and that's why the privacy paranoia is only among geeks. They can't see past their monitors to realize that complete and total privacy doesn't exist any more.

And beyond that, does it really matter if somebody knows what kind of toilet paper you buy? Does it matter if somebody has your name and telephone number? Unless you're somebody really, really important, you're really just talking through your tinfoil hat. Average Joe user doesn't care (and sure as hell doesn't read Slashdot).
Re:correct me if i'm wrong by Zathrus · 2002-09-20 05:25 · Score: 4, Interesting

I suggest living in a cabin in the woods somewhere with no utilities where you grow your own food? That's about the only way you can be even remotely "private"

And even then, They know where you are. Because there's a land deed somewhere with your name on it and you aren't showing up in any of Their databases as consuming goods, so the cabin is the only place you could be!

And while in the big picture you're correct, it doesn't matter unless you're important, the reality is that there is stuff I don't want getting out willy nilly. Does it matter if someone has my name and telephone number? Only if they're a telemarketer. What about medical records? Should your employer be able to access them and let you go if they believe you're too high a cost? Do you want your neighbors or coworkers knowing how much you make?

I don't really have an issue with a centralized database of this stuff, simply because I think it'll be a wash if done properly. No, I don't think we'll have an infallible system, but the current system isn't infallible either. And right now most of the data people worry about is already available - go pull your credit report at Equifax, Experian, or TransUnion. You may be amazed at just what they know about you, at least within the last 10 years of your life. And that data is nowhere near as secure as you think it is.

And the issue about companies selling your information is a red herring. It's already done, it's regulated, and it works fine most of the time. See above for the names of the companies doing this as their main profit center for 50 years now.

Design a good secure system with limitations on who can access what data and you're already ahead of the game. I know with absolute certainty that it's better than what we have now.
Re:correct me if i'm wrong by BreakWindows · 2002-09-20 07:58 · Score: 2

In keeping with your DNS analogy, wouldn't making a distributed system just mean my password and credit card information are now on thousands of servers instead of one? The whole point of DNS's distributed structure is making the information accessible, quickly, to as many people as possible.

Thanks, but no thanks :)

NDS by Mournblade · 2002-09-20 04:08 · Score: 2, Interesting

"Will we ever get a good single sign-on solution?"

What about NDS/Single Sign On from Novell? I haven't looked at it in a while, but last I checked, it ran on most server operating systems (including Linux), makes administration a *lot* easier, and is pretty secure. What's not to like? (besides the fact that it's not opensource/freesoftware) I guess I shouldn't be surprised, since Novell's marketing sucks. They have great technology, but have had a lot of trouble turning that into products.

Re:NDS by Lxy · 2002-09-20 04:09 · Score: 2

E-DIRECTORY KICKS ASS

nuff said. Need to admin that linux server, Novell server, and NT server with one ID? Problem solved.

--

There is no reasonable defense against an idiot with an agenda
:wq
Re:NDS by Lxy · 2002-09-20 06:17 · Score: 2

Your sig is worse.

--

There is no reasonable defense against an idiot with an agenda
:wq

Good thing your not biased. by Kenja · 2002-09-20 04:11 · Score: 2, Insightful

"I hate Passport's integration with XP (although that might be because I hate XP)."
Good to see people forming opinions based on facts and information rather then knee jerk reactionism.

Oh wait.....

--

"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"

Why try and recreate a bad idea by atrowe · 2002-09-20 04:11 · Score: 5, Insightful

It seems to me that Microsoft's Passport authentication is a bad idea in the first place, and the free software community should look toward more intelligent alternatives rather than try and emulate Passport's functionality.

Not only does Passport go against the KISS philosophy embraced by many Unix and Linux developers, but the potential for security breaches is only magnified when a single universal authentication system is developed. It seems to me we'd be better off leaving authentication procedures up to the individual site owner rather than having a universal authentication protocol built-into Apache. This would also be a more practical solution as a single authentication system cannot be tailored to fit all sites. I sure don't want to trust all of my on-line bank transactions to something like Passport, so the need exists for highly encrypted ultra-secure authentication on some sites, while other less secure sites like Slashdot which transmit passwords across the 'net in plain text could probably get by with using a much more basic authentication system.

--

-atrowe: Card-carrying Mensa member. I have no toleranse for stupidity.

Re:Why try and recreate a bad idea by ceejayoz · 2002-09-20 04:27 · Score: 3, Insightful

I'll agree with the security criticism, but how does Passport violate KISS? It does simplify things on the user side of things.

And if you think Unix/Linux devs "embrace" KISS, just try browsing Sourceforge a little... most of the programs are anything but user friendly.
Re:Why try and recreate a bad idea by sjames · 2002-09-21 14:15 · Score: 2

Until Linux/Open Source can start shooting their own widely publicized technological salvos at Business, they will always have to live on the coat-tails of Microsoft's way of doing business.

It won't happen by imitating ill concieved 'features' from Microsoft. The problem with Passport is not implementation details. The problem is that the idea itself is intrinsically flawed.

It's a bit like the whole macro virus situation. The first Outlook and Word viruses didn't exploit implementation problems (bugs), they exploited the half baked idea of exchanging executable documents with strangers. The macro capabilities in Outlook and Word do exactly what they were designed to do when they execute 'I love you' or Melissa.

Catchy Quote by QEDog · 2002-09-20 04:11 · Score: 2, Interesting

"Money and social skills define the in-crowd, and only nerds kvetch about the importance of better technology."

Someone should come up with a catchy quote against that.

--
"There is no teacher but the enemy."-Mazer Rackham

Liberty?? Passport??? Plan 9???? by ziadleb · 2002-09-20 04:11 · Score: 2, Troll

Having 3 plans instead of one defeats the whole purpose of SINGLE sign on.
What we should have, as with any other Internet succesfull strategy is a single standard and competing implementations. That way we are insured to have compatibility and the added benefit of market competition.

Re:Liberty?? Passport??? Plan 9???? by poot_rootbeer · 2002-09-20 04:25 · Score: 2

But what do we do when a fundamental flaw is found in the one single standard? Then EVERYONE is fucked.
Re:Liberty?? Passport??? Plan 9???? by ddilling · 2002-09-20 05:49 · Score: 2, Funny

Yeah, really! Having a zillion different Grand Unified Logon services is totally going to make them worthless.

I mean, look at how many different 'Adult Verification Service' (AVS) accounts you need, just to visit more than one or two porn sites! AdultLogin, AgeTicket, AdultCheck, SexSentry, and so on and so on and so on.

Not that I would need any of those...

--
Mahnamahna!

I have an idea... by Lethyos · 2002-09-20 04:13 · Score: 2

Will we ever get a good single sign-on solution?

How about username and password over SSL?

--
Why bother.

Re:I have an idea... by Ogerman · 2002-09-23 17:17 · Score: 2

Put your unique passwords in a single encrypted text file or use a utility to simplify.. Universal logins are a retarded and inherently insecure idea that only serve to destroy your privacy and make you liable to identity theft. Try thinking next time before you troll.

Single sign-ons. by Christopher+Thomas · 2002-09-20 04:14 · Score: 5, Funny

Will we ever get a good single sign-on solution?

Yes; several of them.

Wait a minute...

Lol by autopr0n · 2002-09-20 04:14 · Score: 2

As a group, the so-called "mainstream press" often appears to favor Microsoft and show an appalling lack of technical depth in its enthusiastic repetition of the latest Microsoft press release. There's been a lot of speculation on why this is and whether it even happens. So far, no definitive research provides answers one way or the other.

Hrm, is this guy trying to be funny, or is actualy that dry?

--
autopr0n is like, down and stuff.

who is the controller? by pretzel_logic · 2002-09-20 04:16 · Score: 3, Insightful

An open source sign on would have to store passwords and usernames in a database. Where would this data be stored, who would maintain it and whos going to pay for the upkeep. Single Sign in is really just away to capture all the data a site needs in order to sort and display ads that might interest the user. Sometimes its really cool to have personalized web experiences but where do we draw the line. When passport came out I remember saying, "Ill never use that" But as larger sites incorporated it in I found it to be useful. I think that SUN will have the answer with their new N1 plans.

--

pretzel_logic

Question.... by DarkWarriorSS · 2002-09-20 04:17 · Score: 2, Interesting

I've seen alot about single sign on with Windows. I have liked the stuff that Novell has put in. I do like some parts, and I don't like other parts. I don't like Passport, only because then it give M$ access to all my personal information(which I wouldn't doubt they already...). But, I've seen a lot about the windows front, and MONO and other projects for GNU/Linux And/or Open Source in general. But... Has anything been done to try and combine the two where you have a single sign on for both *nix and Windows, where you can have the same favorites, address book, etc?? This is what I would like to see happen, as I use GNU/Linux (gentoo/slack) at my house, in my room, but Windows at my church/family computer/ and school. I would like to have it where I could get the same stuff on all of these machines, but I haven't seen anything about combining the two of them yet. Does anyone know if there is such a project going on??

My plan... by T3kno · 2002-09-20 04:19 · Score: 5, Funny

Plan 10: Blank Passwords.

Why Plan 10? Heres why...

1) No one cares about me
2) Steal my credit cards they're maxed out anyways
3) I probably wouldn't mind if you changed my investments you probably would make more money that I do in the stock market
4) All of my email is mailing lists and spam, I have no friends
5) You could probably accumulate more karma on /. that I can
6) Sneak preview of my bank account $0.02 (which I'm giving away here right now)
7) My social security number has been reused more times than the sayings "going forward" and "at the end of the day" combined
8) All passwords are hackable by the NSA anyways
9) At some point all information will be decrypted
10) You can have my body, but you cant take my mind

--
(B) + (D) + (B) + (D) = (K) + (&)

Re:My plan... by Takeel · 2002-09-20 05:37 · Score: 2

This comment is definitely humourous, but doesn't it perfectly illustrate one of today's biggest hinderances to information security implementation? "Who would target me, and why should i care anyway? I have nothing to hide."
Re:My plan... by Elbereth · 2002-09-20 07:17 · Score: 2

There's a difference between being paranoid ("but THEY might be watching me!") and caring about security ("Maybe I should encrypt my password...").

Maybe as a "privacy advocate" you find the idea of someone knowing your salary frightening, but I sure don't. If you ask me, I'll tell you. Maybe you don't want anyone to know how much you weigh or what your favorite softdrink is. I really don't care who knows this.

When it comes to something like people being able to get to material possessions of mine, I start to care. This is when I demand high security and good encryption. I don't want hackers to get into my bank account with a minimum of effort. That's just ridiculous and lazy on the part of the bank.

I really find that log on screen at Yahoo annoying. I'd rather have my account be public, with no password. I don't care who sees my Yahoo e-mail. I'm sick of entering passwords all the time.
Re:My plan... by Elbereth · 2002-09-20 11:00 · Score: 2

This is from the link you posted:

"I can't reveal my source, but a federal agency involved in espionage actually did a rating system of almost every citizen in this country," Ponemon claims. "It was based on all sorts of information-public sources, private sources. If people are not opted in"-meaning they haven't chosen to participate-"one can generally assume that information was gathered through an illegal system."

Uhhh... do you really believe this nonsense? Let's see what's on the front page of your "news source":

Taken FATAL ABDUCTION?

Was Pennsylvania Man Abducted
And Killed By ETs?

"I WILL be as brief as possible. A man named Todd Sees was abducted and murdered by aliens on Montour Ridge in Northumberland County near the town of Northumberland, Pa. This is a big sloppy coverup if there ever was one."

Uhhhh.... can you say Weekly World News?

You know, your post just made me even more sure of my position, not less. If every privacy advocate is as wacky as you are, then I was right all along when I insinuated that you're paranoid.

single sign on by Apreche · 2002-09-20 04:20 · Score: 2

is a great idea. It means you have one name and one password and you don't have to bother remembering different log-ons for every different website and computer you use. However, it does provide one big problem. Someone who is trying to crack you now only has to figure out one name and password to have everything.
currently I have seperate password for online banking and my credit card and my computer and a random ftp server. If I have a single log-on someone who cracks the ftp server now has access to my bank account and credit card. Joy!

--
The GeekNights podcast is going strong. Listen!

Its a crap Idea by night_flyer · 2002-09-20 04:20 · Score: 2

no matter who does it, I didnt like passport because I dont want one group/entity holding my data, not because it was Microsoft. That still hasnt changed

--

Thanks to file sharing, I purchase more CDs
Thanks to the RIAA, I buy them used...

At the risk of being modded redundant. . . by kfg · 2002-09-20 04:21 · Score: 4, Insightful

I too will question the very advisability of single sign on. There are good reasons I keep multiple banking, credit card and merchant accounts. I specifically * don't want* one single authority to be tracking my every move. I * don't want* all my finacial and personal assets and records piled up in one location. I keep a *diversified* portfolio.

What good is having your system backed up on removable media if your house burns down and * you don't have a copy off site?*

When Egghead was hacked I knew for a fact that I had to be concerned about *one* of my credit card accounts. I could watch that *one* like a hawk and the risk didn't steamroll through my whole life. The argument is, of course, that there is less risk with a well protected central account, but that account is an all or nothing sort of deal. You're either safe, or you lose everything.

I'll take the slightly greater overall risk at sustaining *some* sort of loss against the lower risk of complete and total devestation.

Do you have sort of financial insurance? Say on your car? Exact same deal. You "lose" your insurance payment against the protection from greater potential loss.

Obviously others disagree but I think that single access is just plain dumb, and all to save you a rather miniscule risk to save a few minutes of typing a year.

KFG

Re:At the risk of being modded redundant. . . by Entrope · 2002-09-20 04:31 · Score: 2, Interesting

"Single sign-on" does not mean you have to trust some third party with all your records, or that you cannot have a fallback.

To solve the first, keep your authentication cookies on your machine (or other secure hardware local to your person). Just pick a single sign-on solution that allows you to use that. You only need to worry about making it secure from interlopers.

To solve the second, your bank/insurance company/email provider/etc can reissue you an authentication cookie once you prove to them through some other trusted mechanism (say, showing up in person, or answering hard-to-research personal questions over the phone).

("Authentication cookie" could be a password, asymmetric key pair, or whatever.)
Re:At the risk of being modded redundant. . . by krogoth · 2002-09-20 05:28 · Score: 2

The solution is simple: if they want to store your credit card information, buy from someone else.

--

They that quote Benjamin Franklin on liberty and safety deserve neither.
Re:At the risk of being modded redundant. . . by Zathrus · 2002-09-20 05:40 · Score: 2

I too will question the very advisability of single sign on. There are good reasons I keep multiple banking, credit card and merchant accounts. I specifically * don't want* one single authority to be tracking my every move. I * don't want* all my finacial and personal assets and records piled up in one location.

Well, fortunately for you, there isn't one single authority tracking your every move.

There's four.

Equifax.
Experian.
Trans Union.
IRS.

Oh, and if you live outside the US, trust me, the same info is available. Just change the last one to the appropriate regional authority, and maybe change one or two of the first three names to someone else.

Obviously others disagree but I think that single access is just plain dumb

Well, oddly, the entities listed above disagree. They very much prefer to track you by a single method of access.

And just how secure do you think that is?

The argument is, of course, that there is less risk with a well protected central account, but that account is an all or nothing sort of deal

As it is with the current system. And the current system has essentially no safe guards. Once I have the magic number I can get every other account number you have. And through the wonders of Automated Clearing House and Electronic Funds Transfer I don't need any other information to get every penny out of the accounts. Nifty, huh?

The only thing protecting you from having this happen is that nobody gives a crap about you. Which is pretty much the same thing that will protect you in any future system.
Re:At the risk of being modded redundant. . . by Zapman · 2002-09-20 05:53 · Score: 2

When Egghead was hacked I knew for a fact that I had to be concerned about *one* of my credit card accounts. I could watch that *one* like a hawk and the risk didn't steamroll through my whole life.

We're geeks. We're lazy. I hated reconciling (balancing) my checkbook and visa. So I didn't do it. Then I spent the best $30 I ever spent. I bought something called "pocketmoney" for my palm pilot.

I have control of my accounts now. I cought immediatly when my credit card number was stolen last year.

I can't recommend enough investing the time to reconcile things. No computer can replace your own diligence in these security and financial matters.

--
Zapman
Re:At the risk of being modded redundant. . . by sheldon · 2002-09-20 06:55 · Score: 2

Well, let's think about this. I actually think that the security is far more complicated than you make it out to be.

I have multiple banking, credit card and merchant accounts. I also have a whole lot of worthless accounts with places like slashdot.org, nytimes.com and so forth. It's these worthless accounts that I think are good solutions for single-signon passport type accounts. In fact this is pretty much what MS has done throughout their support websites.

As far as having multiple authorities being safer than a single one. Somewhat true, as long as you are using completely different usernames and passwords for each one of those authorities. Oh yeah, and don't write them down because that puts you at risk.

As far as credit cards, there are three well known authorities that track all of your purchases. They are named MasterCard, Visa and Discover... oh yeah and AmEx. AmEx even sends you a statement at the end of the year telling you everthing you bought.

But now how many different credit cards do you have? Hopefully you are using a different card for each merchant account you signed up for, otherwise once again you increase your risk because unfortunately these web merchants save the damn credit cards in their databases. For your convenience, of course... (weird how brick and mortar stores never do this, and it's also no coincidence they don't lose lists of thousands of valid credit card numbers either... hmm) So now we've established you've been spreading your credit card number around to dozens of websites, each one with probably questionable security.

I don't know what the answer is. I only believe Passport is a good idea for all of my less important accounts, for right now. But I also worry about my more important accounts, and I really worry about Amazon.com storing my credit card number for my convenience. It is a complicated thing, and I don't agree that saying a single signon system is dumb, because it ignores the fact that the status-quo, the way things are today is also very incredibly dumb.

We do need something better, but I'm not sure what that will be. I had some hopes of AmEx's smart card system, but they never really got that working.

Re:Solaris 2.9 is the current version? by Loligo · 2002-09-20 04:21 · Score: 3, Informative

>Correct me if I'm wrong, but isn't Solaris on
>version 9 or something?

"Solaris 7", "Solaris 8", and "Solaris 9" are actually 2.7, 2.8, and 2.9 respectively.

To add confusion, internally it's SunOS 5.x.

-l

single sign-on by af_robot · 2002-09-20 04:21 · Score: 3, Funny

Will we ever get a good single sign-on solution?

Yeap. This is really easy.
all you need is just enter "linux single" during lilo startup.

Re:single sign-on by unicron · 2002-09-20 04:53 · Score: 5, Funny

The terms "linux" and "single" seem to go hand in hand.

--
Finally, math books without any of that base 6 crap in them.
Re:single sign-on by tgd · 2002-09-20 06:12 · Score: 3, Funny

Or at least something in hand.

Why? by sdjunky · 2002-09-20 04:29 · Score: 2, Redundant

Why do we need a single signon? This is so unsecure as to not be funny.

E.g. a wife figures out the password to a husbands email account. Now she can

Read his bank account information
Read all of his other emails
Peruse his wishlist on enterbookstore.com here
etc.

Sure... most people use the same password for everything so it's a moot point but it still bothers me

Re:Why? by Yo+Grark · 2002-09-20 04:48 · Score: 2

"Sure... most people use the same password for everything so it's a moot point but it still bothers me"

I used to have 1 password for everything. But no longer. I started using a great FREE little app:

http://www.roboform.com/

No Spyware, No Adware, lets me create/use unique login/passes, fills in all my info on websites, and has a "single login" to unlock the program.

This, IMHO, is as close to a common login as we should get.

But it still has a single point of failure, namely the login to the app. But if you don't use the "launch on windows startup" she'll never know to lauch the app BEFORE surfing....Shit, now she does...uhhh honey? Asiababe is an old friend...really!

- Yo Grark

Candian Bred with American Buttering

--
Canadian Bred with American Buttering
Re:Why? by Ctrl-Z · 2002-09-20 06:23 · Score: 2

You know, Mozilla has this nice built in password manager which can store account information for you. You can also set it up so that you need to enter a password before you can access the whole mother lode of them.

This is pretty much the same thing as you are describing, but you don't need to install yet another app to use it.

--
www.timcoleman.com is a total waste of your time. Never go there.
Re:Why? by Yo+Grark · 2002-09-20 06:30 · Score: 2

Yup, but in the corporate world, Mozilla isn't compatible with internal developed apps. I LOVED mozilla, but when push came to shove I couldn't use it at work where I spend most of my time on the PC. :( -YG

--
Canadian Bred with American Buttering

Unfortunately not by WildBeast · 2002-09-20 04:29 · Score: 2

I don't think that we'll ever get a single sign-on solution. Corporations always want to have there own registration forms.

There's no doubt that Passport failed for that and so did Sun.

Sorry but it just won't work. I wish it would but it just wouldn't.

Lucky underwear by 2Bits · 2002-09-20 04:36 · Score: 3, Funny

Kludges like NIS+ and FNS could be made to work for as long as the sysadmins wore their lucky underwear,...

Good journalist will provide resource links to where one can buy lucky underwear.

Please reply if you know of any, please...

Oh yeah by The+Bungi · 2002-09-20 04:37 · Score: 2, Insightful

I'm really looking forward to this type of technology

And why, oh why must every "open source/free software columnist" being their articles with a potshot to Microsoft as a way to justify Linux's existence? Must they always do that? How about letting the technology stand by itself?

If ya don't like it, don't use it by caudron · 2002-09-20 04:40 · Score: 2, Interesting

It's not like apache and plan9 are looking to make it mandatory. They just want the option available for those instances when it is a useful addition. Like ChiliASP and Tomcat, if you don't need what it provides, just don't add it to your server install. But definately do not gripe that they should do it at all. Such griping is shortsighted and pointless.

Nonrepudiation and psuedonymic technologies will /have/ to emerge if we want to see real commerce online, while I don't approve of MS having control of that technology, I recognize that MS is in some sense right...for some transactions to occur, nonrepudiation is a must.

The more people who are willing to act as trust servers in that sense, the better. Right now we have MS Hailstorm, XNS and OneName, Sun and the Liberty Alliance, and I see no reason not to add another to the mix, so long as we are moving toward standardization where players can compete on implementation of the standard.

--
-Tom

Single Sign On (SSO) worked within a limited realm by plcurechax · 2002-09-20 04:42 · Score: 4, Informative

Single Sign On (SSO) works within a limited realm under the same control, such as within the scope of a government agency, a corporation, or a school. These bodies already exist deal with issues of various policies including privacy policies within the scope of the "realm" (i.e. the laws of the nations a multinational corporation is functioning within).

Universial SSO, such as this plan and Passport, breaks that and cannot be consistant since different companies want different privacy policies, are governed by different government legistation, yet are suppose to "control" and use the same information (the online identity credientials).

So the goal of only needing one online identity, whether a username/password, or a PIN and smartcard, within a given controlled realm such as your university does make sense. This is possible through sensible use of existing services like directory services and secure network authentication. The use of directory services such as X.400, RADIUS, and more recently LDAP (and LDAP perversions like Active Directory) can help towards this. As well as secure network authentication like Kerberos.

Universial SSO does not make sense, because of the shift of power and control is not carefully thought out in the contexts of legal issues (privacy, evidence, children online protection), contractual issues, limited and total revocation, ownership, and other issues.

Universial identities for an unlimited number of purposes does not make sense, it is a nightmare of management logistics, a total lack of correctness, legal quandary, and telemarketing hell.

Incredible by kiwimate · 2002-09-20 04:43 · Score: 2

An open source single sign-on won't solve the problem of a single sign-on.
The reason people hate passport isn't because its written by MS. Why don't people understand that?

Simple: Blind rage of MS.

This is, without a doubt, one of the most succinct and lucid comments I've ever read on Slashdot. Thank you, FortKnox.

Re:What a fucking useless article by Chris+Pimlott · 2002-09-20 04:45 · Score: 2

But in order to actually find out if the way Plan 9 is actually better, I have go read the Liberty Alliance specifications. That article completely wasted my time.

I have to agree with you here. The extended history of markup languages and primer on public key incryption are completely superfluous and add nothing useful to the article. I keep hearing good things about Plan 9 but he doesn't go into enough detail to understand what is really so great about its model.

Save your time by Chris+Pimlott · 2002-09-20 04:48 · Score: 2

... and just read pages 1 and 5. The middle is composed of a longish explanation and history of markup languages and a basic primer on public key encryption. Most /.-type tech-saavy people will already know enough about these topics and the details provided really aren't important to the focus of the article.

The Day for Single-Sign-On by Kaz+Riprock · 2002-09-20 04:49 · Score: 4, Funny

This day will come. But it will be at the time when we implant chips which contain the code for the single-sign-on. You will wave your hand over a pad and everything will come to life as you need it.

This will also be The Day for Increased Finger Theft.

--
Mordor...a magical, mythical land where women are more rare than dragons--but where every man would rather find a dragon

Misunderstanding "single signon" by mcrbids · 2002-09-20 04:52 · Score: 4, Insightful

It's a common misunderstanding what "single signon" actually means. Even in this article that doesn't cover Passport in detail, when indicating the passport authentication process, look at step 3:

#3 Which redirects it back to its authorized Passport server

Notice that it's not "the" passport server, it's "its authorized...". The passport server may or may not be at Microsoft!

I'm busy setting up an LDAP server to allow a rapidly growing (and I do mean RAPIDLY growing, 4x growth in the last year) ISP to scale. We need to allow for future virtual servers, FTP, email, etc. and do so with a single authentication scheme.

LDAP does all this, and more, in a distributed, secure and encrypted fashion. Why are we bothering with HTTP "web services", when LDAP will do all this and lots more?

(Scratches head)

"Single Signon" doesn't mean there's some Microsoft server someplace the whole world logs in to, it means there's ONE server provided by somebody you trust, that authenticates you as YOU and which manages information on your behalf to determine what you should be granted/denied access to. You sign in once, and have immediate access to all the services you have set up.

There can be any number of authentication servers!

Passport, Plan 9, Kerberos, LDAP, and to a lesser extent, NIS and a few others give that ability!

--
I have no problem with your religion until you decide it's reason to deprive others of the truth.

Re:Misunderstanding "single signon" by radish · 2002-09-20 05:14 · Score: 2

"Single Signon" doesn't mean there's some Microsoft server someplace the whole world logs in to, it means there's ONE server provided by somebody you trust, that authenticates you as YOU and which manages information on your behalf to determine what you should be granted/denied access to. You sign in once, and have immediate access to all the services you have set up.

Actually no, it doesn't. Single sign-on means you only sign-on on once to access a variety of distinct systems. What you describe is one way to do that.

Kerberos is another, you obtain a token from a server, and present that token to each service provider. They examine that, decide whether they trust it, and then decide what services to offer you.

Another solution would be a network of service providers who all trust each other. You log into one of those, using it's own authentication scheme. If you want to visit another site in the same group, you hit a special link which directs you there along with an ID, the second service provider then implicitly trusts that and skips it's own authentication.

Yet another solution is one where you have normal accounts with different id's and passwords at different sites, but one agent (could be local, could be remote) holds all those, and doles them out in the background as you surf around.

There are plenty more :)

--
---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"
Re:Misunderstanding "single signon" by mcrbids · 2002-09-20 07:11 · Score: 2

Isn't that what I said?

What I understand of what you said is almost exactly what I thought I was saying when I said what I said... Er... we agree, we just haven't agreed on that, yet!

What I mean by "services" you call "distinct systems". And yes, Kerberos is yet another existing, already proven method of doing this.

So, anybody want to re-invent the wheel today?

--
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Re:Misunderstanding "single signon" by Dirtside · 2002-09-20 11:06 · Score: 2

Offtopic:

Would you be able to provide me with a link to something that might explain, as to a child, what LDAP is? I've been hearing about it for years but have never managed to find out exactly what it *is*, what it's *for*, and so on. I know I probably sound dumb but every time I look, all I find is oblique references that don't actually explain it.

--
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
Re:Misunderstanding "single signon" by HamNRye · 2002-09-20 11:19 · Score: 2

Here.
You're welcome.

first things that comes to mind... by Ender+Ryan · 2002-09-20 04:54 · Score: 2

is the license "agreement", and the upgrade path...

Palladium - All your freedom are belong to Microsoft and the *AA

--
Sticking feathers up your butt does not make you a chicken - Tyler Durden

Re:Which one? by Lussarn · 2002-09-20 04:54 · Score: 2, Insightful

Since most websites are apache on unix anyway they can't choose passport. And open source generaly is quite well respected these days.

Re: yep 40 accounts, is so simple... by GigsVT · 2002-09-20 04:55 · Score: 5, Informative

haahhhhahahah

i love keeping track of 40 accounts/passwords.

Who said you had to do that?

We have already solved the problem of single password authentication, it is built right into SSH. Basically, you send you public key to anyone you want to authenticate to. Your private key resides on your computer and is password protected. A local key agent manages your private key. When you authenticate the first time, your key agent asks you for your private key's password. Note that this password is never transmitted over the network, neither is the private key. The key agent makes it unnecessary to enter the password again for any site that has your public key, a real single sign on for any system that has your public key.

Even if your system is compromised, your private key is protected by the passphrase you set for it. If the Internet sites are compromised, all the attacker gets are worthless public keys.

Why hasn't someone implemented this instead of this passport silliness? The technology has been around to do this right, why do people keep trying to do it wrong?

--
I've had enough abrasive sigs. Kittens are cute and fuzzy.

Insecure and border-line fascist... by pVoid · 2002-09-20 05:00 · Score: 2, Interesting

I agree with the insecurity thing of single point of failure. But I personally think the issue at hand is much greater here: the fact that one single entity (company) has the power to sign you on to anything on earth from Subway cars (a-la retina scan in Minority Report) to your home computer just rings the bells of fascism to me.

The saying goes: deviate and inch, and lose a thousand miles. If we let this kind of centralization intrude our lives now (early on, while we still have some say over it), we eventually might never be able to break loose of it.

But that's just me.

Re:Insecure and border-line fascist... by NineNine · 2002-09-20 05:14 · Score: 2, Interesting

I can use my VISA card to buy anything anywhere. Same principle. I don't exactly feel oppressed. I guess that you don't use credit cards, huh?

just hijack the authentication cookie? by 2Bits · 2002-09-20 05:00 · Score: 2

Agree.

According to the Passport Single Signon Protocol described in the article, it's probably much easier to break than what executives are made to believe.

The user has to be authenticated only once, and an authenticated cookie is issued, then the user is automatically authenticated to all Passport partner sites. A hijacked cookie will break the whole thing.

Attack by hijacking cookies is well known, I really don't understand why people can still buy into this kind of scheme, especially those make decision to adopt it.

How to disable Passport integration with XP by Drakonian · 2002-09-20 05:04 · Score: 5, Informative

Remove Windows Messenger by running this command:

Start/Run/RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove

This worked for me. It finally stopped telling me to register my .NET Passport, and doesn't run Messenger all the time.

Here is a site with more info: http://www.kellys-korner-xp.com/xp_messenger.htm

PS: Am I violating the DMCA by posting this? Well I'm not an American citizen, but if I was?

--
Random is the New Order.

Re:How to disable Passport integration with XP by Doppleganger · 2002-09-20 05:41 · Score: 2

You can also use msconfig to remove "msmsgs" from the startup list.. much less potential for mistyping.
Re:How to disable Passport integration with XP by Doppleganger · 2002-09-20 08:48 · Score: 2

I've used the msconfig method quite a few times, and never had msn messenger reappear. There's a dialog that comes up when you reboot asking whether you want to keep what you changed, but you can blow right by it (the language is a little confusing, but you want to tell it *not* to pop back up again).

As for copy-paste.. I'd be leery of using it on strange command lines that are posted on Slashdot. I understand what yours does, but after the hijinks in the "bash shell prompts" article...
Re:How to disable Passport integration with XP by alexburke · 2002-09-21 00:52 · Score: 2

Why bother tearing it out?

Windows XP will only ask you five (5) times to register a .NET Passport with your Windows XP user account. If all five reminders are dismissed, you shouldn't ever hear anything more about it.

As far as Windows Messenger goes, open it by double-clicking its icon in the notification area (formerly the system tray), then click the Tools menu, then Options, then the Preferences tab, and uncheck the "Run this program when Windows starts" checkbox. Then click OK. Close the Windows Messenger window, then right-click its tray icon and click Exit.

You should never see it again unless you invoke it from its icon on the Start Menu under Programs (and that shortcut can easily be deleted).

We'll get a single sign-on.... by zerofoo · 2002-09-20 05:06 · Score: 3, Insightful

right about the same time when Linux gets a single unified desktop/window manager.

-ted

Re: yep 40 accounts, is so simple... by radish · 2002-09-20 05:06 · Score: 2

That already was tried (remember personal certificates?) - most SSL enabled browsers support them. The big problem (apart from the admin overhead which stopped your average joe user being interested) was that you could only log into sites from a machine which had your private key installed. Made use of cafes, public terminals etc virtually impossible. Besides which, even if I could give my private key to a public access machine, I wouldn't!

--

---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"

Re:Plan 9 ?!?!?!? by macdaddy357 · 2002-09-20 05:08 · Score: 3, Funny

More on Plan 9.

"My friends, can your hearts stand the shocking facts about grave robbers from outer space?"

"Ah yes, Plan 9 deals with the resurrection of the dead. Long distance electrodes shot into the pineal pituitary glands of recent dead."

"Sometimes in the night when it does get a little lonely I reach over and touch it, then it doesn't seem so lonely anymore."

"Because all you of Earth are idiots!"

--
How ya like dat?

Re:Double sign on? Sign-on and a half? by GigsVT · 2002-09-20 05:13 · Score: 2

Single sign on, where you log in once and can get straight into a load of different accounts (webmail, credit card, bank, local council benefits office, etc.) is clearly a bad idea, because of the single-point-of-failure problem.

That's what's great about the way SSH does it. Basically, you upload your public key to any server you want to authenticate to, your private key resides on your computer and is encrypted with a passphrase. ssh-agent is a resident program that manages your private keys. It will ask you for your private key passphrase the first time you use it, then you don't have to type it again, unless you step away from your computer, after a time-out interval, ssh-agent will forget your passphrase for security purposes.

For having multiple levels of security, you just have multiple keysets, you upload the public key for one private key to the throwaway sites, and set a relatively weak passphrase for it, since it isn't as important, and have another private/public pair that you use for high security sites, which has a really hard password on it.

In case of a local compromise, your private keys are protected by the passphrase encryption, in the case of a compromise of the Internet host, the attacker gets nothing but your public key, which is useless anyway.

These problems are already solved. I don't see what the debate is about, and why people are afraid of single sign on... after all, one really really hard password that never leaves your local computer is way more secure than 10 easy to remember passwords, some of which may be the same password.

--
I've had enough abrasive sigs. Kittens are cute and fuzzy.

Re: yep 40 accounts, is so simple... by GigsVT · 2002-09-20 05:18 · Score: 2, Insightful

Then what we need is a small hardware device that the private key resides in, which only responds to the challenge-reponse of challenges generated by your public key. A smart card could easily fill this purpose. This device would only be used if you needed to use public terminals, for home use, you could just use your hard disk to store the encrypted private key.

--
I've had enough abrasive sigs. Kittens are cute and fuzzy.

I would consider it if... by aliusblank · 2002-09-20 05:32 · Score: 2, Interesting

I would consider a single login system if I could physically hold the key in my hand instead of storing it on some ubersever in some datacenter ill never see.. maybe a pda type thing with a bluetooth adapter you could use to login to the bank terminal, mail account, etc

Structured Markup by kalidasa · 2002-09-20 05:39 · Score: 2, Informative

On the editorial (or printing) side, SGML got its start the day after Gutenberg's invention of movable type made it necessary to formalize editorial instructions to typesetters. From this perspective, SGML's tags were instructional in nature, as in "start using 42 lines per page here".

The author of this sentence should not be allowed to write on the subject of structured markup. SGML has NOTHING to do with "start using 42 lines per page here." It is NOT a typesetting language; TeX is. SGML is a language that makes it possible to represent the semantic structure of a document (rather like sentence diagramming, only on a document scale), not the appearance of a document.

The rest of the discussion of SGML is equally illinformed. Imagine if someone posted an article that described Apache as a method of implementing SSL on a web server. That's how bad his understanding of SGML is.

OT: How to get your piece posted to the front page by targo · 2002-09-20 05:41 · Score: 2

Repeat as many times as possible how much you hate Microsoft and it's products, even if it's not really relevant to the topic (how does hating XP matter here?)
Slashdot (whether you like it or not) is a semi-commercial enterprise, hence it should (theoretically) try to reach as wide an audience as possible. But it's truly amazing how it keeps shooting itself into foot by posting such inane stuff (here's a newsflash for you: geek's definition is not 'someone who hates Microsoft', there are many geeks who have a positive or at least neutral attitude towards this company), and thus alienating sensible people.
Yes, I know that this emotional bashing is probably very appealing to Slashdot's younger readers. I used to be like that. But you know what, once you've worked in the industry for a while, your attitude becomes much calmer and more reasonable.
And who does actually have the purchasing power really keep Slashdot alive by subscriptions or buying goods from sponsoring companies? Not your teenage MS-basher.

Disclaimer: This was not intended as a flame, just a thought on how Slashdot could ease its financial problems.

--
When men used to be men

We don't need single sign on by tubabeat · 2002-09-20 05:41 · Score: 2, Interesting

What we do need is some consitency between the information sites ask for. If sites were consistent about asking for, say, a 10 character mixed case username, a 10 character mixed case alphanumeric password, a 6 digit numeric passcode or whatever (the numbers are arbitary & not intended to represent any ideal of security) then it would be easy to just have a few passwords etc. which are used for different trust levels.

I guess most people do this already, but I'm always getting thrown by being asked for subtle variants of this information. Now if the sites were kind enough to display a number of my choosing on the login screen(to remind me which password to use) and maybe the date I last changed my password life would be much more simple. There are some sites that I have lost count of how many times I have registered because I can't recall which varient of my username I entered.

The chief problem would be keeping usernames unique - although I'm not convinced this is a problem so long as the combined credentials are unique(?)

--
"Linux is a serious competitor"
- Steve Ballmer, Chief Executive Microsoft Corp.

Re:That's anyone put the same password to all ? by PDHoss · 2002-09-20 05:48 · Score: 2

Assuming the a bank caves into the pressure of offering single sign on services (be they Sun/MS/NKOTB/etc.), what well-respected financial institution worth its salt would not request some other little widget of confirmation info? Kinda like extra 3-4 digit number on CCs now.

"Welcome back, Joe Blow, please provide your Ferderal Massive Dollars of Walla Walla ID number."

Single sign in would then be for the more harmless kinda stuff. And if a bank did rely entirely on Passport/whatever, then change banks.

This whole thing doesn't seem quite some earth-shattering to me.

PDHoss

--
======================================
Writers get in shape by pumping irony.

Take it or leave it by noelp · 2002-09-20 06:03 · Score: 2, Insightful

I like Linux. I like Unix. I use Windows a lot. I have a Passport and, yes, it is integrated into the XP OS. Once you get past the narrow-minded M$ hating notions, it is actually quite handy.

Do I worry about it leaving me open to hack attacks and marketing invasion? No, not really. Information I really care about is not exposed via my passport. It is all safely locked up elsewhere. Dont dismiss it on principle - if you dont like the idea dont use it. Simple as that.

--
'Internet! Is that thing still around?' - Homer Simpson

Re:Take it or leave it by Tony-A · 2002-09-20 18:36 · Score: 2

Information I really care about is not exposed via my passport. It is all safely locked up elsewhere.
Not *yet*. The problem is that the information exposed via passport is monotonically increasing. Sooner or later the scope of passport includes this, includes that. You can hold out for awhile, but eventually all the information you really care about *will* be in passport.
I don't particularly trust Sun or any of the other members of Liberty Alliance, but there are some heavywights who will not take kindly to other members using it as their private feeding ground.

excuse me... but you suck... by sluggie · 2002-09-20 06:14 · Score: 2

"I hate Passport" "I hate XP" "I want something new"

Everybody agrees with him.

What would be if he said:
"I hate Plan 9" "I hate Linux" "I want something new"
Flame war time!

Maybe if some people would concetrate on how to deploy certain products and apply certain solutions, they wouldn't be so narrow minded. Now mod me down as a troll, just because there is no "-1, MS friendly" button.

Plan 9 by 0x0d0a · 2002-09-20 06:15 · Score: 2

Haven't seen the movie. Plan 9 has been around for some time -- big AT&T research project into distributed systems.

I believe there was also a Plan 9 video game -- based on the movie, not the operating system.

--
May we never see th

Re:Plan 9 ?!?!?!? by xanadu-xtroot.com · 2002-09-20 06:27 · Score: 2

Personally, I'm still trying to figure out what Glenn Danzig has to do with all this.

Maybe it's just me.

--
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.

Who needs it? by Tom7 · 2002-09-20 06:30 · Score: 2

There are plenty of things I want from computing before getting rid of the simple inconvenience of remembering multiple passwords and user names. Let's work on those first. For instance: Encrypted email and instant message traffic. Network daemons without remote security holes in them. More fine-grained access control to resources. Universal unicode support. Support for writing real applications in modern programming languages.

Jabber Jabber Jabber Jabber by infiniti99 · 2002-09-20 06:31 · Score: 2

There was a similar article recently about "roaming profiles", and I brought up the same idea. Seriously, Jabber is capable of having a single-signon in its current state (no change to clients). And because Jabber is a distributed system where anyone can run a server, basically any problem anyone has mentioned so far in this entire comment board is non-existent.

Slashdot could easily allow logins via Jabber presence. Passwords aren't even needed, since Jabber presence is authoritative. Then I could log into such websites from wherever there is a Jabber client, all using my own personal server (none of this Microsoft-controlled Passport BS).

-Justin

factotum is not necessarily single sign on by rpeppe · 2002-09-20 06:33 · Score: 4, Insightful

oh, i wish that at least someone out there would go and read the original article before mouthing off.

factotum (plan 9's authentication agent) is not a single sign-on solution, although it can be when used in conjunction with secstore. what it does mean is that applications do not have to be burdened with complex and error-prone authentication code, and that there is one, well-verified, point in the system that holds secrets and understands the protocols.

in the factotum scheme, you can mark certain accounts (e.g. your bank account access) so that they will always require a password to be entered; you can also use the scheme without secstore (which is what i'm doing currently) which just forces you to type in each password the first time it's required. secstore is a means to store all your passwords in one place securely, which you can then use to prime factotum.

this is the essence of the plan 9 approach - choose an abstraction and write it in a simple, modular way so that it's applicable to a wide range of previously unanticipated scenarios. it's a wonderful system, and one that carries forward the true unix tradition, something that UNIX lost long ago.

Re:Solaris 2.9 is the current version? by EraseMe · 2002-09-20 06:42 · Score: 2

SunOS is the kernel, Solaris is the distribution. Solaris version numbers changed with the relase of SunOS 5.7.

Solaris 9 is sometimes refered to as Solaris 2.9.

SunOS 5.0 = Solaris 2.0
SunOS 5.1 = Solaris 2.1
SunOS 5.2 = Solaris 2.2
SunOS 5.3 = Solaris 2.3
SunOS 5.4 = Solaris 2.4
SunOS 5.5 = Solaris 2.5
SunOS 5.5.1 = Solaris 2.5.1
SunOS 5.6 = Solaris 2.6
SunOS 5.7 = Solaris 7
SunOS 5.8 = Solaris 8
SunOS 5.9 = Solaris 9

ssh and ssh-agent by g4dget · 2002-09-20 07:04 · Score: 2

The idea of using a process to perform authentication on your behalf is pretty old (as Cox's paper points out). Most of Cox's paper is concerned with how to integrate this idea into Plan 9's file system and file-server-based architecture. It's "this is how we integrated a key agent into Plan 9" paper, not "here is a completely new idea for how to manage keys and authentication" paper.

But UNIX and Linux have SSH and ssh-agent. It's not as elegant as Plan 9's file servers, but it is just as flexible. SSH is built around the idea of establishing secure and authenticated tunnels. And SSH with ssh-agent has become, for many purposes, the separate entity into which cryptography has been factored on Linux and UNIX: SSH gives you secure, authenticated remote system administration, the ability to transfer large amounts of data securely, the ability to create secure communications channels, and it is used by systems like rsync as its secure and authenticated transport protocol.

Maybe rather than reinventing the wheel, we should figure out how to extend what is already used and works. For that, we need a clearer idea of what problem "single sign-on" is supposed to solve that ssh and key agents/keychains aren't already solving, and then to figure out what we can do about it. And there isn't a whole lot I can think of that ssh isn't solving, at least in principle. Of course, wide, practical deployment for something like web services would require a set of UIs to be developed for Windows users and a lot of salesmanship. But, then, the same is true for whatever Sun cooks up.

Single Sign On by dasheiff · 2002-09-20 07:19 · Score: 2

Though I would never use a single sign on myself so many people would that I do believe it's good that we have an open source alternative.

do we WANT a single-sign-on ? by Tom · 2002-09-20 07:20 · Score: 2

I don't know what the whole hype is about, and why nobody stops and asks if we really want a "single sign-on", any of them.

Yes, it's easier and people are lazy. From a security POV, however, it's a nightmare come true - everything from your banking details to your private e-mail protected by:

a) a single, usually bad, password on your side
b) the security of a central database on the server side

Sounds like a desaster waiting to happen.

--
Assorted stuff I do sometimes: Lemuria.org

My worries by InnovATIONS · 2002-09-20 07:29 · Score: 2, Insightful

That much marketing material in one place is too much temptation for anybody. MS, and every other single sign on provider, swears that they would never sell or use such information. I can't trust them that far. And if it were some sort of open source provider I would have no more reason to trust them, maybe even less (Open source providers are not wealthy, thus more likely to be tempted by the wealth on their hard disks. Even if your trust their current mangagement, that can change overnight.)

If someone learns your single source login then they can easily impersonate you everywhere, not just on one site.

It is real easy to trick ordinary users into giving away their passport login names and user IDs. Create a bogus site. Have the bogus site display a realistic Passport login page that says "Your Passport Login has expired, please re-enter it." Most folks will just follow the instruction. The page then just stores the login name and password in a file. It is the oldest computer Trogan Horse known and it will still work amazingly well because users won't realize that it isn't a Microsoft Login Page.

Now if they had a single sign on solution, possibly also a roming profile, built into a flash memory card in an encrypted form then I might be quite enthusiastic about the idea.

Re: yep 40 accounts, is so simple... by Wesley+Felter · 2002-09-20 07:33 · Score: 2

Too bad no public terminals support smart cards.

SSO: The Corruptor of Good Companies by guttentag · 2002-09-20 07:59 · Score: 3, Informative

SSO is like "The Ruling Ring" in Lord of the Rings. Anyone who wears it will be overcome by its evil power and will ultimately be driven to enslave the End Users (a people closely related to humans).

I once joined a startup that was based on a good idea that incorporated SSO, but the VP of Engineering swore to me the company would never abuse that power. Within months, marketing managers were telling me that end users "wanted" us to abuse SSO "for their own good." For legal reasons, I won't go into more detail, but the company I left was not the company I joined -- all because of the temptation SSO brings.

End Users believe that SSO is a gift from heaven because it allows them to mindlessly go through the "troublesome" task of authenticating themselves. This has several implications:

Authentication is designed to require you to use your brain. It's like the roughed-up pavement that precedes many toll booths, saying, "you're going to need to wake up now."
Authentication is designed to require you to use your brain. It helps ensure that you are the only one who has access to certain data. You should not be entrusting this to a conscience-free multinational who has no qualms about "sharing" your access with all its employees, partners and anyone who pays them enough money.
One of the places most consumers often see authentication forms are on shopping sites. When you are going to buy something, you have to go through the steps of entering your username and password, entering your credit card number, your address, etc. It's a protective speed bump that makes you think before you purchase. With SSO (or One-Click), you have no way of knowing when you've "authorized" a charge to your credit card. You assume that it's only when you click a button, but the fact is you've authorized the company to charge your card whenever it claims you want to buy something.
Single point of failure. Enough said.
Memory decay. When you use SSO, you tend to forget your user names and passwords because you don't need them. Then when your SSO provider does something you don't like and you decide to leave, you feel like you can't. You're trapped because you can't remember that data -- you think you need that service to continue accessing your other services. Even if the SSO service provides a method of retrieving your passwords, most users are unaware of it.
Then, of course, there are the tracking issues. The SSO provider will track all the sites you visit, sell that data and market appropriately. Common sense, yet commonly ignored by the common End User.

A wise wizard would do well to distance himself and everyone he can from this evil.

Plan9 not Open Source/Free/Libre/Whatever by Xtifr · 2002-09-20 09:33 · Score: 3, Informative

Paul Murphy (the LW author of the article) seems to have been fooled by the Plan9 folk's self-proclaimed status as "Open Source". However, neither the OSI nor the FSF agrees. The FSF has even posted a detailed analysis of the problems with the Plan9 license.

Now, depending on your own philosophy (or lack thereof), you may or may not care personally whether this code is truly free/OSS/whatever, but in practical terms, what it means is that neither Red Hat nor Debian is going to buy into this solution, which pretty much means that it's probably dead in the water. Oh, I suppose it might be accepted by the UnitedLinux folks, but I'm not holding my breath on that.

Single signon bad no matter what. by neoevans · 2002-09-20 09:44 · Score: 2, Interesting

I work for a large bank, one of the largest. A few years back we adopted a single-signon technology to try and apease the 6000+ users in the company who were complaining that they had to remember 20 different passwords that had different requirements and all expired at different intervals.

Actually we didn't adopt it, it cost us millions of dollars. The company that sold it to us said it would put an end to our password woes and we would reap the rewards by cutting our support staff and lessening the load on our call-centre. It did no such thing... Our call-centre volume tripled, the cost of implementation (not to mention training) was horrendous and our support staff were overwhelmed.

Fast forward to now, 4 years later. We have an entire department dedicated to customizing our in-house applications (and some purchaced via the regular sources) to work with this beast, the helpdesk and support staff are still inindated with calls to do with our single-signon menace and management won't get rid of the thing because it would mean admitting a mistake was made that cost us millions and having to retrain our user population would cost even more!

And security!? It used to be when a password was guessed and a system compromised, the guesser still had to guess the password(s) to any application(s) they needed to do any real damage. Now...we've eliminated that inconvenience.

Now I like Windows XP. Yet I don't use hotmail. I don't even have a Passport. So what's all this about needing one for WinXP?

--
"You are not a beautiful and unique snowflake."...Tyler Durden

Re: yep 40 accounts, is so simple... by sjames · 2002-09-21 14:26 · Score: 2

That already was tried (remember personal certificates?) - most SSL enabled browsers support them.

The problem with personal certs is that they were designed to make money for the cert authorities, not to make life easier for the user.

If the browser install procedure included a create presonal cert, upload public key to keyserver, it might have caught on. As another reply suggested, smart cards handling signatures would also have helped.

123 of 334 comments (clear)