Slashdot Mirror
Liberty Alliance Plans Passport Interoperability
EvanDelay writes "The Liberty Alliance Project, which is developing Web technology to facilitate single sign-on authentication, plans to support interoperability between its system and Microsoft Corp.'s rival Passport system.
Computerworld has the story."
They've changed their name to "The Alliance Project"
I dont mind having the *choice* to let MS have some of my personal data.
Interoperability is great if it increases choice - although I hope that we'll also have the choice not to interoperate.
I really hope it will work with linux. If it does we will have a free ride onto passport-only sites. I cant imagine MS letting off a passport client for linux by themselves (or anyone using it for that matter).
HTTP/1.1 400
Sure, it's probably the last nail, but for which service? As much as the majority of the userbase hates MS, it doesn't really change these two simple facts:
1) They have a single platform they can use to push their services from
2) They have a Scrooge MacDuck style bank-vault to dip into whenever they start to feel the sting of competition. Interoperability with Passport is only going to force Liberty into anonymity, not give it the huge marketshare we're all hoping for.
Karma: Dyn-o-mite!(mostly affected by Jimmy Walker reading your comments)
This is too early to give in to Microsoft. As neither version has any significant market advantage yet it is not good to make the systems one-way compatible. This only makes it easier for customers to move to .Net, not the otherway around.
.Net, not to become the little brother of it. There are a number of points that need to be equally good/better than .Net:
The priority must be to compete with
1. Ease of use (both user-wise and coder-wise).
2. Security and user control of information
3. User base (on both sides again).
The first point is the reason of the project from the start and must be maintained.
The second point is the advantage, no-one can reach me, and on-one can reach the customer-records of a competing company without authorization. Not only geek users should be afraid of giving too much info away, also the companies utilizing these platforms must be aware and protect their customer bases.
The third point is probably the pass/fail issue of the entire project. It must get adopted, from the average user and by the service providing companies.
Looks to me like Microsoft is getting far more than LAP out of this deal:
Hotmail will still tell you to get a Passport logon, no-one will tell you to get a liberty alliance logon. So MS still gets the majority of the customers.
Added to this, MS gets your information free from liberty alliance, so the obsessive geeks who just had to go with the minority service are still giving all their information to MS, so they get marketing info for even more people, basically at no cost to them.
Whereas liberty alliance gets.. nothing really. Maybe some people who wouldn't otherwise sign up will now that their logon works with Hotmail. But not many. Out of the 1% of the population that knows Liberty Alliance exists, 50% won't be signing up for either system if they can avoid it, because they understand the stupidity of the idea security-wise, and 90% of the people who do are signing up just because they don't like MS, so the added ability to use Hotmail is not going to make any difference.
No, it's extremely smart security wise. Now, for all I know you may be the paragon of good security practice, but most people are not. In fact, most people, faced with a morass of passwords for various different services do something that is extremely bad and set all their passwords to the same thing. I've done this, for instance, because it's either that or write down all my passwords (which of course some people do) and keep them on my computer, which means I cannot access any services when I don't have that list.
There is this fantastically common misconception that centralising your various digital identities will somehow decrease security. Not true! There's a reason most of us have 1 (perhaps 2) personal email accounts. We don't have 100 email accounts with different user names and passwords because the truly minor increase in security that would bring is nowhere near worth the major increase in hassle.
Single sign on is coming people, and when it arrives not only will 95% of the computer using population be more secure because of it, but computers will be dramatically easier to use as well.
I've read the liberty specs in more detail than most of the people here on slashdot I'd bet, as I'm working on a server that contains an (open source) implementation of them. No, it's not released yet, perhaps in a few months. But believe me, the LA specs are not scary, they will not force you to tell the government what your favourite colour is, they will not take your first born child. They will make your life easier.
In the past, Passport has been shown to have zero security. See the Wired News article, Stealing MS Passport's Wallet.
On August 8, 2002, the U.S. Government's Federal Trade Commission (FTC) ordered Microsoft to stop lying about its Passport service. The FTC's order is titled Microsoft Settles FTC Charges Alleging False Security and Privacy Promises.
From: Windows XP Shows the Direction Microsoft is Going.
2) Even if they did decide to co-operate, it'd largely be meaningless. There are so few websites using Passport the list can fit into less than a screenful.
3) Even if this wasn't a problem, making Passport interoperate with anything would be a major technical headache. It simply wasn't designed for that at all. It's centralised so badly it'd need to be ripped apart and rebuilt to allow for "federation". Notice how that using Kerberos to open it up idea seems to have faded away? That's because Kerby was never meant for that anyway, and because it's extremely hard to open up Passport.
4) Passport is growing at a snails pace, with good reason. The gain you get from it is small (often the user needs to give a password anyway, regardless of whether they use passport or not) and the cost is huge, both in developer time and various costs involved in working with Microsoft.
OK, this could happen already because I have an amazon cookie on my system which means I don't need to log in each time. But, I can always remove the cookie and force a sign on the next time I go there. With single sign on you won't have that option, you will always be logged in.
A chain is only as strong as it's weakest link. This may be good for garnering general acceptance, but for those of us who are looking for a complete alternative to Passport, is it really a good idea?
I'm a writer, a poet, a genius, I know it. I don't buy software, I grow it.
I see your point, but it could be argued that its not the signon system thats stupid - it's the person signing on and then walking away to get coffee.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
Well, I have separate secure passwords for the few
services I care about (like my bank, credit
card, and other stuff); but I would happily
have a single account for nytimes, slashdot,
various online fora, and other sites that
require membership - who really cares?
Considered harmful.
From PingID
All Rights Reversed.
What happened to all those people who were slamming single sign-on a few days ago?
There is this fantastically common misconception that centralising your various digital identities will somehow decrease security. Not true!
Absolutely true. The annals of computer crime are full of cases where crackers have accessed systems B, C, D and E by harvesting passwords from system A and users re-used the same password on those other systems. Now true, if those other systems had some other gaping hole that would let them be compromised without a password, then in some theoretical absolute sense the security isn't any less because of the shared password (since there was no real security to start with), but such holes are bugs and fixable by the sysadmin, whereas shared passwords are not.
Single sign-on, whether Passport or Liberty Alliance, seems like a disaster waiting to happen, although if properly designed and correctly implemented (bloody big "if"), it'd be safer than multiple sign-ons all using the same password (because the latter gives multiple points of attack). But it's also painting a huge target and sign on itself that says "crack me!". And it's still less-safe than multiple sign-on with different passwords. (Think about it -- if you're a big-time crook (or terrorist, etc), do you go for the high-stakes bank job, or just stick up a string of 7-11s? It all comes down to effort vs payoff.)
-- Alastair
Why would I give Microsoft the password for my doctor's or stock trading website when I won't give my own family members the root password to my computer?
While I may trust Liberty Alliance more than Microsoft, I still would prefer to manage my passwords myself. Single sign on just provides a single point of attack.
This space intentionally left blank.
Possibly, but bear in mind if you break into somebodies email account you can usually compromise most of their web passwords anyway, as almost all sites have an "email me my password feature". In effect, your email account is your digital identity, as it holds the keys to all your other passwords too. So that's also a pretty big target in a way, yet email breakins are fairly rare - possibly because people recognise its importance and choose good passwords?
Yeah, let's hear it for the Liberty Alliance! You know, because I always associate "liberty" with "centralization of power and resources," as opposed to, "distrbution of power so that people may have more control over their destinies." 'Cause, you know, that would suck.
(My weapon is the razor-sharp sting of sarcasm!)
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
What if I'm signed in, and reading some mail, and then I get up for a coffee. Now, while I'm AFK, somebody else comes along and starts using my browser to go to amazon.com
:o), and created an account using his email address - as he was away, I was able to 'OK' the email confirmation on his behalf.. (and then promptly delete it :o)
Funny Story:
A few years ago (1996 or so), a guy at work and I got into a practical joke war.. He got up to get himself cofee, and (as was his habit,) left his email client open.
I went to an online personals site (new at the time
Using 'his' new account, I posted an ad in the Gay Encounter section, saying that he was just discovered his sexuality, and asking for someone who would be gentle with him..
The look on his face when he started recieving photos was priceless.
Now, he learned a lesson that he never forgot, and it's one that you should know as well - if you have sensitive windows open, close them or lock your workstation when it's unattended.
Even before single sign-on's were thought of, the scenario you envision is still possible.