Slashdot Mirror


Liberty Alliance Having Problems

torre writes "This article would suggest that there seems to be some chaos in the Liberty Alliance fight against Passport. Between Sun's Jonathan Schwartz claiming defeat to Microsoft as it has the market tightly controlled with the help of windows to Novell's Justin Taylor who says that Microsoft's Passport has got nothing to offer when it comes to the enterprise. Should be interesting to see how things pan out."

143 comments

  1. Feel better with Sun by masonbrown · · Score: 3, Insightful

    Whatever the solution, I'd feel much more secure with Sun hardware / software than I would with MS. They don't reinvent the wheel every 6 months in an attempt to correct all the mistakes they made in the previous version of the wheel.....

    1. Re:Feel better with Sun by Anonymous Coward · · Score: 0

      "shoddy hardware"

      The Internet runs on Sun, guess that's why it's so unreliable.

    2. Re:Feel better with Sun by Simon+Kongshoj · · Score: 4, Insightful

      :s/correct all the mistakes they made in/make more money on

      --
      Six sick .sigs, the Number of the Beast!
    3. Re:Feel better with Sun by Anonymous Coward · · Score: 0

      > For added security, this post has been encrypted with double ROT13
      You encryption is flawed because I could decrypt it using a simple ROT26 algorithm once!

  2. Maybe it's because... by sulli · · Score: 2
    nobody needs it?

    (Or passport? Talk about a solution-in-search-of-a-problem.)

    --

    sulli
    RTFJ.
    1. Re:Maybe it's because... by haggar · · Score: 5, Insightful

      Umm... did you think this over, really seriously? I was a user of DigitalMe, and it made my Internet life a helluva easier. I could securely log into all of my services without having to know more than one password by heart. I could personalize most of those services, using just a browser and my account at DigitalMe. I had some messaging and e-mail options at disposal just as an added benefit. I all worked together. (Unfortunately, Novell discontinued the service, but that's their old illness: got a lot of cool technology, but incapable of making profit outta it.)

      Nonetheless, I can clearly see the advantages the industry and private individuals would have from Liberty alliance's efforts. Note that I didn't even mention the B2B features that the Liberty Alliance is working on.

      --
      Sigged!
    2. Re:Maybe it's because... by Dachannien · · Score: 5, Insightful

      I can log into my services securely too, and know only one password. It's quite easy.

      Set all of your passwords to be the same. :P

      The only reason that Passport is useful is because it tries to dip its finger into a lot of pies at the same time. The end result is that corporations find out a lot more about your surfing/buying/playing habits than they otherwise would. In other words, it's *not* useful to the end user - it's useful to the service providers.

    3. Re:Maybe it's because... by sulli · · Score: 5, Insightful

      My browser (Mozilla) stores my passwords. Don't see why I need a network-based service, controlled by someone else, subject to snooping, stealing, or worse, when the browser on a PC I control will do the trick.

      --

      sulli
      RTFJ.
    4. Re:Maybe it's because... by MSBob · · Score: 3, Insightful
      wholeheartedly agree. Most people buy stuff on the net once or twice a year. It really isn't a big deal for them to just type the same info twice a year. It takes more time to find your credit cards in your stow pocket than it does to type those few lines into a web form.

      Where Passport/Alliance etc. is useful is for corporations who can easier track your browsing/shopping habits to profile you and target you with more personalized spam.

      --
      Your pizza just the way you ought to have it.
    5. Re:Maybe it's because... by torre · · Score: 2, Insightful
      The point of Liberty or Passport in an ideal situation is to be able to authenticate you anywhere you go. Period... Call it the universal Internet ID. A business case for this is that you all of a sudden can grant say an accountant from a firm that has a single sign on account setup access to your lan knowing exactly who he is and as such he can still authenticate back to his home lan to get what he needs. This can be further extended to the roaming employee, say a sales rep who logs into a machine or the web, authenticates in... and now has access to his home directory in the form of a local mount. These are things that your Local browser cannot do that these methods are intended to solve...

      For the average joe the more relevant case involves how he can now log into his phone, computer, laptop, pda, etc, and be able to identify himself such that he can get access to stuff like his contacts in an easy fashion. The example for this can be seen in web ICQ or MSN messenger.

    6. Re:Maybe it's because... by IamTheRealMike · · Score: 3, Insightful
      Set all of your passwords to be the same. :P

      And when it's compromised? I have set all my passwords to be the same for about a year now, and it's the only way I can stay sane with the number of separate accounts/identities I have. My password has been compromised twice now :(

      Luckily both times the people who saw it were friends. The first time I had to tell Adam my password so he could setup my new email/shell account for me. The second time a stupid MS connection wizard of all things printed out the password in plaintext at the end, just to helpfully confirm you'd chosen it right.

      Not to mention the difficulties I had finding a password that was easy to remember but fitted into all the various rules some sites/systems have about passwords

      Good passwords should be changed regularly. To do that, you need 1 password. To do that, you need digital identities.

    7. Re:Maybe it's because... by sheldon · · Score: 3, Insightful

      "My browser (Mozilla) stores my passwords. Don't see why I need a network-based service, controlled by someone else, subject to snooping, stealing, or worse, when the browser on a PC I control will do the trick."

      So basically you've written your passwords down underneath your keyboard, and think you are secure because nobody is going to look there.

    8. Re:Maybe it's because... by Anonymous Coward · · Score: 0

      passwords (and other private information) are encrypted in Mozilla.

      but how would a stupid MS-lover like you know that?

    9. Re:Maybe it's because... by Anonymous Coward · · Score: 0

      But then each of those services knows your password for every other service. In Passort/Liberty, they wouldn't.

    10. Re:Maybe it's because... by The+Analog+Kid · · Score: 2

      Hope no one finds your Univeral ID, or you can loose some very important information whatever it would be from your friend emailing you to directions to your brother's wedding. Its a good idea in theroy but so was communism. Your balencing convenience over security, well which one would you choose, and it may not become convenient when you have 8 different services pop-up like MSN Messenger if you open Outlook. I don't know maybe I'm a little to anti-microsoft but so is a lot of people who use Linux, but this is one issue that can't be ducked under with the line that is "Your just anti-Microsoft"

    11. Re:Maybe it's because... by Anonymous Coward · · Score: 0

      "My browser (Mozilla) stores my passwords. Don't see why I need a network-based service, controlled by someone else, subject to snooping, stealing, or worse, when the browser on a PC I control will do the trick."

      So basically you've written your passwords down underneath your keyboard, and think you are secure because nobody is going to look there.


      Of course, if security matters, you will encrypt your passwords with a master password, and remember that.
    12. Re:Maybe it's because... by 'Lose',+Not+'Loose' · · Score: 1, Insightful
      Hope no one finds your Univeral ID, or you can loose some very important information...

      Hi. That should be 'lose', not 'loose'.

      Thanks,
      'Lose', Not 'Loose' Guy

      --
      --thanks for the recent upmods! i'll be able to post again soon
    13. Re:Maybe it's because... by tshak · · Score: 3, Insightful

      In other words, it's *not* useful to the end user - it's useful to the service providers.


      Sure it is. We implemented a passport-like service for all of our corporate systems. This way, you change your password once, and it changes everywhere. It has reduced the "I forgot my password" requests considerably, and allows us to enfoce regular password changes on a global level, instead of having each system deal with passwords differently.

      The percieved problem of central systems on a global scale is simply that once the password is compromised, the whole system is compromised. Remember when car makers used to make one key for the door, and the other to the ignition? In the end it was proven that this generally added little to no security because both keys were on the same key ring. The same goes for passwords. I personally use 2 - 3 passwords accross all sites. You get one of my passwords and you can access almost half of the sites that I visit. Furthermore, most people that I talk to already use one password anyway.

      My biggest concern for security is not the concept of centralized passwords, rather, it revolves around Microsoft's ability to design a secure protocol, and if that protocol becomes an industry standard so that Microsoft doesn't have Ultimate Power over the system.

      --

      There is no longer anything that can be done with computers that is nontrivial and clearly legal. -- Paul Phillips
    14. Re:Maybe it's because... by Anonymous Coward · · Score: 0

      Hi, who really cares if you mispell something, it gets very annoying every time someone mispells something and someone has to point it out, as long as you can figure it out it doesn't matter. To go so far to make a user name Lose not loose is having no life at its best. You know if enough people actually switch the words around it will be adapted in the english language and apparently there are enough people who do it here.

      PS Mods --its not offtopic, its common sense

    15. Re:Maybe it's because... by Amtiskaw · · Score: 1
      Hi, who really cares if you mispell something
      Hi. That should be 'misspell', not 'mispell'.

      Thanks.
    16. Re:Maybe it's because... by cyberformer · · Score: 2

      And to encourage people to buy more stuff on the Internet. Of course, some online retailers already store your credit card details, something that makes me want to cancel my credit card after each purpose.PI'm almost glad that Amazon has its stupid one-click patent, because otherwise many more Web sites would hold on to your credit card details for future purchases.

  3. "Liberty" Alliance by bouis · · Score: 2, Flamebait

    They don't give a damn about "liberty"; they'd all love to be Microsoft. It seems that some words become more meaningless every day.

    1. Re:"Liberty" Alliance by Anonymous Coward · · Score: 0

      It seems that some words become more meaningless every day.

      "When words lose their meaning, people lose their freedom"

      - Confucius

  4. know BiG surprise by Anonymous Coward · · Score: 1, Interesting

    "The main reason for choosing Open Source software was:
    - Licensing Cost for Server Software
    - Openness, i.e. the ability to change software to fit our purpose
    - Security & Reliability and (last not least)
    - Low hardware requirements.

    The fourth reason was very important as I didn't want to buy any new hardware for the servers and instead reuse existing old hardware and extend its lifetime by using Open Source Server software. We decided to Use FreeBSD, Apache, mySQL+PostgreSQL, Perl+PHP

    The company I am working with is a pure-Microsoft company, i.e. they only used to use Microsoft software, and they even didn't know anything about Open Source.

    It was a painful but successful transition. But this is not the reason I am writing.

    The reason is Microsoft itself. When the local Microsoft rep "heard" (someone inside the company tipped them off), they asked to meet my team(!) and discuss the reasons for our Open Source use.

    In fact, it was a meeting of 2 1/2 hours with 3 Microsoft sales/consulting reps trying to persuade us not to use Open Source (mainy they talked about "Linux" until we told them that we don't use Linux and that we don't understand what they are talking about :-) because "it is inherently insecure, unreliable" and, what was their biggest argument, "there is nobody in this country who could give you any support for Open Source", etc.

    Also, they wanted(!) (actually they "required") us to tell them the reasons why we are using Open Source instead of the already introduced and long-time proven Microsoft Software in this company.

    Then I started explaining the four reasons above, and when we came to the point of "Licensing Costs", they offered us TO give the Windows server licences for free.

    I am not kidding. When I told them that I'd need at least ten licenses and at $400/each, this would be too much for me for the beginning, they offered to give us the license for free - and not only for now, but also for the future when we kept working on Microsoft.

    Of course, they knew that if we implement succesful projects based on Open Source in the New Media Group, this might extend to other areas, too, e.g. data servers (we are in fact planning to create a print archive fully based on Open Source now that the technicians in the company see that Open Source can be successfully implemented).

    I just wanted to let you know about this fact. The meeting was very funny as they were trying to explain us that Microsoft software is more reliable, secure and cheaper than Linux and I was trying to explain to them that a) we are not using Linux, and b) that they have wrong numbers about TCO and c) that I could prove that Open Source is cheaper and lastly d) that any survey trying to figure out the TCO is definitely wrong as they try to please the company who ordered the survey, etc. etc."

    1. Re:know BiG surprise by Anonymous Coward · · Score: 0

      Well? Is your company going to take the pay-off or are you going to stay with FreeBSD?

    2. Re:know BiG surprise by Shimbo · · Score: 3, Informative

      Well? Is your company going to take the pay-off or are you going to stay with FreeBSD?

      I think you have mistaken this AC for someone who writes his own comments.

    3. Re:know BiG surprise by Anonymous Coward · · Score: 0

      You should have asked them what OS Hotmail uses on the back end. That would have been funny.

    4. Re:know BiG surprise by olegik · · Score: 1

      Which Windows Server license would cost $400? 10 licenses don't qualify for any discount and the lowest I've seen so far was $699-$799 for Windows 2000 Server (Advanced goes for 3K+)

      "The main reason for choosing Open Source software was:
      - Licensing Cost for Server Software
      - Openness, i.e. the ability to change software to fit our purpose
      - Security & Reliability and (last not least)
      - Low hardware requirements.


      What about your time? Are you in charge of a budget? Any customizations (#2 in your list) - are they included in that budget? Maintenance moving down the road - who will be doing it?

  5. whatever by muyuubyou · · Score: 1

    Seeing the past resolutions, I've already lost any faith and belief in law in this country. Lobbyism is more powerful than law. Linux save us all.

  6. I wish.. by Anonvmous+Coward · · Score: 4, Insightful

    ...stories like these were properly labeled as "MS Troll" instead of "Technology", that way I could filter them out.

    The article basically says "We can't get into Passport's market share because MS forced people to sign up." That's a fair statement except for one minor detail: Massive numbers of people aren't running around saying "I need a single log-in point across multiple domains!".

    If the demand's not there, bleating about MS beating you isn't going to make it better. Frankly, I think the only reason this article made it to Slashdot is that juicy little line about MS "forcing" people to sign up with Passport.

    I can't be the only one who'd like to filter these stupid articles.

    1. Re:I wish.. by DoctorPepper · · Score: 0, Troll

      Except for one thing: Any time you use any Microsoft technology, you HAVE to sign-up for a passport license. How many MSN user's HAVEN'T signed-up for passport? How about Hotmail users? Do you use PayPal? Then you use passport. It's getting very difficult to sign-up for services without having to sign-up for passport!

      --

      No matter where you go... there you are.
    2. Re:I wish.. by Anonymous Coward · · Score: 0

      Paypal doesn't use passport. Unless something has changed in the last 2 months and you have evidence to that effect.

    3. Re:I wish.. by Anonymous Coward · · Score: 0

      | (I wish) stories like these were properly labeled as "MS Troll" instead of "Technology", that way I could filter them out.

      Search for 'Microsoft' in the body of the article

    4. Re:I wish.. by Anonvmous+Coward · · Score: 5, Informative

      "Any time you use any Microsoft technology, you HAVE to sign-up for a passport license."

      Not true. I've got people in my office today who have laptops running Windows XP. They are *not* forced to sign up for Passport. Let me repeat: They are not forced to sign up for Passport.

      When you do need (note: I didn't say forced) to sign up for Passport is when you use their IM stuff. That is a choice you can make. It's a choice you make when you sign up for Hotmail. There's no forcing going on.

      And no, Paypal doesn't require a Passport to sign up. I have no idea where you conjured up that idea.

    5. Re:I wish.. by Anonymous Coward · · Score: 0

      And Microsoft probably made companies that support passport to sign a non-compete clause preventing them from implementing logins compatible with the liberty alliance. I wouldn't put it past them. Corporate power killed capitalism.

    6. Re:I wish.. by Life2Short · · Score: 5, Informative

      I played Asheron's Call (online RPG published by Microsoft) for about 2 years. Then one day, poof, you can't log on to play the game without Passport. I guess you could argue that I didn't have to play that game, but after a 2 year investment... Personally, I'd call that an example of being forced to sign up for passport. It actually adds a step in the logon process, slowing things down for me.

    7. Re:I wish.. by Quarters · · Score: 2
      Except for one thing: Any time you use any Microsoft technology, you HAVE to sign-up for a passport license.


      Really? How odd. I have WindowsXP at work and at home. I have Office 2000 at work. I have MS Flight Simulator 200x at home. Yet, I do not have a Passport account. I've never been forced to get one.

      How many MSN user's HAVEN'T signed-up for passport?

      And how many AOL users don't have a ScreenName? Exactly 0. Passport is how MSN authenticates their users. If you don't like it then don't use MSN.

      How about Hotmail users?

      Again, if you don't like the service, go elsewhere. Yahoo! doesn't use Passport, so get an email address there.

      Do you use PayPal? Then you use passport.

      No, no you don't.

      It's getting very difficult to sign-up for services without having to sign-up for passport!


      That should read, "It's getting very difficult to sign-up(sic) for Microsoft services without having to sign-up(sic) for passport(sic)!"

      If you use The Zone, MSN Messenger, MSN, Hotmail, or any other Microsoft service then, yes, you will probably have to get a Passport account. Microsoft invented a user authentication system and they are using it on their services. That's their business choice. That doesn't mean that every computer user is being herded into Passport.
    8. Re:I wish.. by Anonymous Coward · · Score: 0

      Who says you have to sign up for Hotmail to access Microsoft's IM service?

    9. Re:I wish.. by Anonvmous+Coward · · Score: 2

      "Who says you have to sign up for Hotmail to access Microsoft's IM service?"

      I didn't, although it's more or less true. When you sign up for Hotmail, you're signing up for Passport. Sign up for Messenger, and you're signing up for Passport.

    10. Re:I wish.. by Martin+S. · · Score: 2

      not forced to sign up for Passport.

      This is pure BS, XP nags to register for an MS-Passport and stops functioning if you do not.

      The 'other' choice is to use the XP crack even when you've paid for the OS.

    11. Re:I wish.. by Anonvmous+Coward · · Score: 2

      "This is pure BS, XP nags to register for an MS-Passport and stops functioning if you do not."

      100% untrue. I *maintain* XP machines here, nobody's been nagged to register with Passport.

  7. Who uses passport anyway by esac17 · · Score: 4, Interesting

    Except for a few select Microsoft sites which use it, (You really have the same thing for AOL), no site I have visited in the past 2 years has used Microsoft Passport (tm).

    I can't believe they think that Microsoft has the market 'tied down'. How hard would it be to develop a new client authentication scheme and convince the millions of websites out there NOT using passport to use your new scheme? Sure it may be hard in some cases, but there is a hell of a lot of room for getting a huge chunk of the market.

    1. Re:Who uses passport anyway by greechneb · · Score: 4, Insightful

      I'd have to agree - I've never used it, other than signing into an old hotmail account. Microsoft may force me to sign up, but that doesn't mean I'll use it. That doesn't mean that I'll use liberty alliance or whatever it is called.

      I seem to remember microsoft trying this with microsoft wallet for storing all of your credit card information. That never flew, and I doubt that passport will really be such a big thing. Personally I like having everything seperate, so in case somehow it gets broken into/cracked, I'll only be vulnerable at one website/domain. I try to keep seperate passwords for security, and keep things divided for more protection.

    2. Re:Who uses passport anyway by inteller · · Score: 1

      well yes and no. As far as being forced to use passport for hotmail....you don't HAVE to have a passport to read hotmail, but a passport account is automatically created for you when you get a hotmail account. and No the microsoft wallet hasn't gone away, it has transitioned to MSN Wallet, which will be a LOT more successful as MSN will make all sites in its shopping section use MSN wallet. The pieces are all in place, the checkmate has still not been executed.

    3. Re:Who uses passport anyway by sheldon · · Score: 2
    4. Re:Who uses passport anyway by ihistand · · Score: 1

      eBay uses it. But not this eBay user. I've noticed that the passport button has decreased in prominance on that site, it now is underneath the main login prompts, and requires an extra pageview to use. eBay also doesn't say anything about why a user should use it rather than the regular sign in.

    5. Re:Who uses passport anyway by HashDefine · · Score: 1

      Except for a few select Microsoft sites which use it, (You really have the same thing for AOL), no site I have visited in the past 2 years has used Microsoft Passport (tm).

      Hmm .... looks like you have not visited eBay recently
    6. Re:Who uses passport anyway by Ilgaz · · Score: 1

      Hmm , I am not impressed at all. Sorry.

    7. Re:Who uses passport anyway by sheldon · · Score: 1, Troll

      Why do you feel the need to be impressed?

      The fact is there are websites using Passport.

    8. Re:Who uses passport anyway by Anonymous Coward · · Score: 0

      with a poor small list
      that's why I or he ain't impressed.

  8. Couldn't this be as simple creating passport ... by SirGeek · · Score: 4, Insightful

    As a browser plugin ? That way the person decides who can access their information ? The keys, credit card and personal information/etc. are stored in an encrypted file on the machine and only those with permission can get at the information ? It would eliminate the need for a hugemungous server (run by an evil corporation) and this way it would be pretty simple to access the information (with some authentication of course) and not need to pay an arm and a left testicle to an Evil Corporation..

  9. AOL Screen Name Service by kriston · · Score: 3, Informative
    --

    Kriston

    1. Re:AOL Screen Name Service by LostCluster · · Score: 2

      Let's not read too much into this.

      AOL's ending its Magic Carpet service, which allowed non-AOL sites to accept AOL ScreenNames as a logon, in much the way that Microsoft is offering up its .Net Passport to not-Microsoft sites. Magic Carpet's biggest site, CDNow, is about to stop operations and essentially direct it's traffic to Amazon.com, so the service was declared a failure because nobody wanted to buy it.

      However, this doesn't mean ScreenName Service is going away completely. That is, your AIM screenname will still let you log into every site AOL/TW controls, and that's quite a few of them. That's still a lot of personal info for AOL/TW to possess.

  10. Very misleading article by pubjames · · Score: 5, Informative

    This article seems to have written in a deliberately misleading manner from a few out of context quotes. They put words in a Sun executives mouth (as far as I can see nobody has "conceded defeat") and then makes out that there is a rift because others haven't "conceded defeat".

    One of the thing the Sun guy says is "I don't think it will be very long before we have a pervasive non-Microsoft client". That doesn't sound like conceding defeat to me.

  11. Re:Couldn't this be as simple creating passport .. by znaps · · Score: 2, Insightful

    And/Or a physical key which can be plugged into the USB slot. People want to use single sign on technology on any machine and still feel secure.

  12. Talk about rolling over by SpaceRook · · Score: 5, Funny

    Give me liberty or give me something else. I'm cool with either, really.

  13. Huh? by The+Fanta+Menace · · Score: 1
    Between Sun?s Jonathan Schwartz

    What's with all these question marks replacing apostrophes?

    --
    -- Even if a god did exist, why the fsck should I worship it?
    1. Re:Huh? by zulux · · Score: 5, Informative


      Microsoft added a fake left curling single-quote to most of it's fonts about ten years ago. Toy 'desktop' systems like Word, MS Publisher, BOB use these quotes in order to look 'cool'.

      Standards-based browsers: Netscape, Mozilla, Konqueror, Opera don't nesesarily display this non-standard 'quote' the way IE does. They default to showing a question mark when confronted with theis non-standard quote.

      --

      Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.

    2. Re:Huh? by RabidOverYou · · Score: 0, Offtopic

      How can someone even remotely familiar with quotes misspell its?

    3. Re:Huh? by Alien+Being · · Score: 3, Funny

      Good point, but you?ve got to admit, it?s an easy mistake to make.

    4. Re:Huh? by MntlChaos · · Score: 1

      umm it appeared fine on this mozilla browser (winxp)

    5. Re:Huh? by Anonymous Coward · · Score: 0

      Yes! It really pises me off when I'm trying to rename an mp3 I've downloaded and it's got one of those ` things in it. My file manager of choice doesn't know what to do with them and I end up having to use windows explorer to nuke them.
      Here's a good Windows trick kids - get a DOS prompt and rename a directory to alt-255 :-) (hold down alt and type 255 on the numeric keypad) It should look like a space. Then see what windows explorer/file manager makes of it.

    6. Re:Huh? by zulux · · Score: 2

      I made a little Pascal program was called format.exe - all it did was look like the real format, but it just read random blocks of stuff off the disk to keep the drive light flikering. It was fun to type it into the command line - it looked like someone typed 'format C:' and press Y for Yes, but there was that hidden psudo-space infront of it.

      Whee!

      --

      Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.

  14. Endrun around MS by burgburgburg · · Score: 3, Informative
    Considering the lack of success of MS in invading the smartphone field, this might be an effective tool to get arond the MS omnipresence on the desktop and build a foundation.

    However, it is a valid point that Passport has been a major failure up until now (tens of millions of forced signups and nothing substantive to show for it) and even with monopolistic momentum, a few new major Passport security failures could make a serious, well supported competitor that much more attractive.

    1. Re:Endrun around MS by skilef · · Score: 1

      This is exactly what I was thinking when I was reading the article. Microsoft most likely won't dominate the smartphone arena, Symbian will. Wouldn't this qualify as a "pervasive non-microsoft platform"?

      --

      You do not exist. Go away.
  15. pr0n by Dachannien · · Score: 3, Funny

    You know, the whole concept behind Passport isn't far off from the purported usefulness of the "adult verification services": you pay them a LOW LOW monthly fee and supposedly get access to thousands of online porn sites.

    It's good to know that Bill still surfs for pr0n every now and then.

  16. Advantage Microsoft by zanerock · · Score: 3, Insightful

    Besides the question of how useful single sign of stuff is, security questions, and adoption rates, etc., this shows how nice it is to be one, large, powerful entity. In this case, MS says, "this is the way we'll go." No one else has the market share to do similar things without forming alliances and consortiums which, while they may have a better idea, usually falter for exactly this reason: they cannot agree on what it is they are doing or why.

    The causes for this are interesting, but far to many, complicated, and inter-related to get into during a 5 minute work break. Too bad.

    1. Re:Advantage Microsoft by Zico · · Score: 2

      That and they simply don't have the vision that Microsoft has to get it done, either. Basically Microsoft announces something, then the usual suspects scramble around and announce something of their own just so they can be against Microsoft, not because they have any idea of their own about how they envision the given service. It's funny really, and actually reminds me of Canada's knee-jerk reaction to basically oppose any of them there *gasp!* Americanized ideas. Just like the anti-Microsoft crew, they're getting left in the dust.


  17. what payoff? by Anonymous Coward · · Score: 0

    "giving" somebody defective payper liesense hostage ransom agreedmeNT "software", is a FraUDuleNT disservice as far as we can tell.

    the "payoff", if there is won hear, is knowing how desperate the evile minions of the kingdumb are becoming.

    they've ALWAYS been BiG liars, now they're dooing IT for "free"? that's good gnus i guess.

  18. What a vague article by Twid · · Score: 4, Insightful

    Well that was a refreshingly content-free article, allow me to summarize:

    Sun: Windows is better at whatever Liberty/Passport does
    Novell: Maybe in the home market, but we do whatever Liberty/Passport does much better in the Enterprise!
    Netegrity: Maybe Microsoft does whatever Liberty/Passport does better on Windows, but the true value is doing that cross-platform and cross-domain!

    I still don't see how any of this is more than a niche market. Yes, there is a need in large enterprises for single sign-on, but that's largely a Fortune 100 issue, so no huge market there. For smaller companies, it's far cheaper to staff a helpdesk than it is to do an enterprise single-sign-on implementation. Yes, home-users have to manage a lot of userids and passwords too, but integrated browser password functions cover the 90% of people who don't move from their base computer. So for the home as well it's a niche function.

    The only value I see is the value of Microsoft or AOL with extending their MSN or AOL login to new functions and thereby making it more "sticky", giving users an effective barrier to leaving their service. To me, that's really all this posturing is about.

    Also, I fail to see why my cell-phone and my SSH session need to share a password.

    P.S. Justin Taylor is a big geek. 8-)

    --
    - "When you want something with all your heart, the entire universe conspires to give it to you" -Paulo Coelho
  19. Lack of will not ability by justanumber · · Score: 4, Insightful

    The AOL-Sun-Netscape alliance and the other charter members definately have the ability to push Liberty, but perhaps not the will.

    If they wanted to AOL, Netscape, Mastercard, Visa and American Express could deliver a *staggering* amount of particpants. This would dwarf the several million Microsoft passport holders overnight.

    I think that the main problem here with Sun's technical leadership is that it's too busy trying to work out what it does for a business to worry about taking on Microsoft in yet another arena.

    Another reason is that the when you're a holding a hammer, everything looks like a nail.

    Sun sees Liberty as a battle with Microsoft, Novell sees it as glorified LDAP server, while the credit card and mobile phone companies see it as a targeted advertsing and aggregation tool.

    The conflict is being caused by each charter member having a different vision of what Liberty actually *is*.

  20. Both are DOA by Ars-Fartsica · · Score: 3, Informative
    The Liberty Alliance never had a chance - its only goal was to exist as a foil to Passport. Those types of product strategies never pan out, they end up being mostly PR. Passport itself has very diminished interest from vendors and much less press from MS itself given public hysteria (well deserved as it is) over computer privacy and identity theft.

    It will be a while before anyone picks up this hot potato again. Until then, single sign-on is dead.

  21. The single-logons nobody ever talks about... by LostCluster · · Score: 3, Insightful

    Has anybody noticed that there are two other Passport-like systems floating out there as well?

    The first is AOL's. AOL Time Warner has gone around and tied the login systems of almost all of their properties from CNN to Netscape to use the same logon system as AOL/AIM ScreenNames. AOL has direct competitors to almost everything MSN has and then some, and can collect just as much personal info to send to a media empire.

    The second is Yahoo's. Now, I know the Yahoo logon is only valid at the Yahoo.com domain, but Yahoo has within its domain content that MSN spreads out into dozens of domains. Everything including a Hotmail-like e-mail site, an Expedia-like travel site, a CNBC-like financial site, and an MSNBC-like news site all accept the same Yahoo logon. Yahoo wants your credit card numbers in your Yahoo Wallet let's not forget...

    Yeah, Microsoft is the most annoying in getting you to sign up for a .Net Passport so that you can use MSN Messenger, but there are millions of people who dashed to aim.aol.com to get AIM and therefore ScreenName Service account, and Yahoo's got an IM client too if you want it.

    There are really three web empires... yet only one is getting all the heat. What's up with that?

    1. Re:The single-logons nobody ever talks about... by slide-rule · · Score: 1

      Regarding Yahoo, my local telco dialup service recently went over to "SBC Yahoo! Dial" service, where my dialup phone number, DNS, POP/SMTP, etc. all needed to be changed. Why's this interesting? Because doing this (i.e., staying on the same service, which has been pretty solid, actually, for a renter that can't get broadband) required getting a Yahoo account setup... since my dialup and e-mail send/retrieval passwords are now connected to my new Yahoo account. Joy...

    2. Re:The single-logons nobody ever talks about... by Anonymous Coward · · Score: 0

      Perhaps it has something to do with neither of the non-MS companies you named being convicted of abusive monopolistic acts?

    3. Re:The single-logons nobody ever talks about... by MntlChaos · · Score: 1

      AOL has direct competitors to almost everything MSN has and then some, and can collect just as much personal info to send to a media empire. umm AOL is a media empire (Time Warner)

  22. Re:Huh" by Tingler · · Score: 0, Offtopic

    What are you talking about" I didn't notice anything.

  23. Re:Sara Michelle Gellar - TEAT SHOT by Anonymous Coward · · Score: 0

    Off-topic and fake. Good trolls all have cool usernames. Please comply or stop posting.

  24. security versus convenience by bcrowell · · Score: 3, Insightful
    MS has staked out one end of the spectrum that runs from security to convenience. It's sort of like the way credit card fraud works: the companies want to make it really really convenient for you to apply for a credit card and use a credit card, and that tradeoff results in low security --- credit card fraud and identity theft are distressingly common. The companies have figured out that this is just a cost of doing business, and they've found a balance that maximizes their profits.

    With a single sign-on, you really have some security problems is return for the convenience. One shoulder-surfer can completely steal your online identity. And is anyone under the illusion that people will pick strong passwords for their Passport accounts? Nope, they'll pick their pets' names, kids' birthdays, favorite sports teams, etc.

    MS may be insulated from competition with Passport, because the good guys wouldn't dream of implementing it insecurely, and that means their implemenbtations will be less convenient than MS's.

    At this point, security is the one single strongest reason for people to switch away from MS and start using open-source software and open protocols. The problem is that very few people really care very much about security, and they don't really understand security well enough to know what they're missing.

    1. Re:security versus convenience by Zico · · Score: 2

      What a bunch of twaddle. Your examples of Passport insecurity are people stealing info from over other peoples' shoulders, and people picking poor passwords. Then you say this supposed insecurity is why people should switch away from MS, completely ignoring the fact that these things would be problems under any other system, too. Unskilled users are the only people who would leave themselves open to such holes, so why suggest that they switch and have to learn a whole new system only to find out that the exact same holes are there?


    2. Re:security versus convenience by nyseal · · Score: 1

      One thing I've always wondered about in switching from Windows to Linux is how do I truly know my boxen is safe? I'm not a sysadmin; I'm a home user. I'm also NOT a programmer. With that in mind, I realize that I fall under the general premise of the MS 'umbrella' of security but I know even less about protecting my privacy using Linux. With MS, I read, screen my updates, try not to use IE whenever possible (although some websites make it difficult) and keep my AV services and definitions up to date; automatically. I'm not scared to try something new, just worried about something I have little experience, training and knowledge about.

      --
      [SIG] Remember Mattel handheld games?
    3. Re:security versus convenience by bcrowell · · Score: 1

      Basically, you need to read a book. My public library has at least one, and if you're willing to pay, there are quite a few books on Linux security. It depends on a lot of factors. An out-of-the-box Linux install that is only connected to the net via a modem is generally pretty secure. Things get hairier if you've got an always-on connection and turn on various ports and services.

  25. Insightful by bouis · · Score: 1

    It's a shame that so few people here realize it. Thanks, AC.

  26. Slashdot poll idea: by chunkwhite86 · · Score: 2, Interesting

    Do you use Micro$oft Passport?

    - Yes
    - No
    - I'm Afraid to
    - Cowboyneal is my Passport

    --
    I'd rather be a conservative nutjob than a liberal with no nuts and no job.
  27. Then you're DOA on another machine by GroundBounce · · Score: 3, Insightful

    I used to have different passwords for different services and had my browswer remember them. The problem was that if I needed to access something from somewhere else, it was a royal pain because I didn't remember all the passwords and my home computer is not accessable over the internet. There were times when I had to have a service email me my password, which opens up its own security problems.

    Also, if you have your browser store passwords at work, then you're extremely insecure as well.

    I used to think different passwords for different services was more secure, but I now use the same password for all sites and then change this password everywhere periodically. It's a minor hassle to change them but it's probably more secure than either Passport or browser storage, and I can access everything no matter where I am.

    1. Re:Then you're DOA on another machine by bogasity · · Score: 2, Informative

      I think Apple's Keychain is a good answer to this, especially if they could rig up iSync to sync Keychains between different computers. (The Keychain is an encrypted file that contains all your passwords, and can be moved from one computer to another.) Chimera (and any other program that wants to add the support) can store/retrieve passwords to/from the Keychain. All you need to know is the one password to unlock the Keychain. Right now, you have to manually copy the Keychain file between computers, but you could put it on any online storage you have available - no need for Microsoft in the loop at all.

  28. this might be a stupid question, but by Anonymous Coward · · Score: 0

    now that homeland security is passed and they plan on having a national ID, doesn't that effectively do what both standards are attempting to do?

  29. Zero knowledge by Anonymous Coward · · Score: 3, Interesting

    I implemented a single-sign on solution quite easily for my own side project (see suprasphere). It uses a zero-knowledge proof called the "Secure Remote Password Protocol" done by Thomas Wu of stanford. My solution is full Java, but there are other implementations, some of which I think even work for SSH.

    The way it works is that the password is never sent to the remote host, ever. Instead, it only proves that you know the password beyond a statistical reasonable doubt. The advantage to this, is that I can use the same password "verifier" many places without having to trust them.

    Just for the heck of it, I decided to provide a way to use a 1024 bit random integer as the basis for a roaming profile. You can use a human memorizable passphrase to login one place (such as your PC), and then pick up the large random number that will be used to prove yourself to all of the sites where you have an account. Assuming you use the 1024 bit number for verification, there's virtually no chance that someone will be able to forge your identity.

    This is no different than using a private key in conjunction with a public key, but it's nice because it also works with human passwords, with a nice migration path to using more secure authentication means. Furthermore, since you in theory don't know if a verifier was created using a human password or a big integer, it makes it highly improbable to try to brute force guess using either an offline or online dictionary attack.

    Also, I just came across this IBE solution, also from Stanford that works for regular email, which suprasphere doesn't support yet. (see Stanford IBE Crypto) My email is david@suprasphere.com if you want to contact me.

    1. Re:Zero knowledge by sg_oneill · · Score: 2

      Dude. Kill the marketing talk on the site.
      It all sounds very nice and all, but I can't for the life of me figure out what you sell. Perhaps get a marketing-droid to put a more sensible spin on it, or if youve got one, get a different droid.
      A friendly suggestion :)

      --
      Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
  30. Grrrrrrrr by IamTheRealMike · · Score: 5, Interesting
    OK, this type of article pisses me off.

    Full disclosure time, I work for Andre Durand who setup Jabber Inc and whos latest venture is PingID. We got together, along with Adam Theo (who got our server slashdotted with the ransom thingy a few weeks back) because we'd been working on open source digital identity for about a year. Andre knows the balance between commercial and open source well in our opinions, and he's been sponsoring the effort.

    I've been to DIDW 2002, met the guys designing the protocols and met Justin Taylor from Novell. All those links were to say, I've been following this scene since before people were talking about "identity" and I want to shout my thoughts loud and clear.

    Firstly, the idea that Microsoft have authentication tied down is laughable. Passport is in its current incarnation a piece of crap. By version 3.1 I'm sure it'll be peachy, but right now it stinks. The extent of their "integration" with Windows is having IE6 use some native dialog boxes instead of web forms and being able to automatically sign on when you login (does anybody actually use that?). It is most definately possible to do something better than this in a seamless enough way that users would go for it. In fact when I was in Denver me and Adam sketched out an idea for how to do it.

    Secondly, the Alliance is a rather mixed organisation. It's made up of lots of big corps who are not in fact enormous big baddies who want to steal your privacy just for the hell of it, but they do want to enable better business relationships. The example Esther Dyson gave was that the airline company should remember whether she likes window seats or not. I'm sure some Slashdotters would find this freaky/scary but she is a smart lady and she knew that she wanted that kind of information to make her life easier.

    BUT - the LA is attempting to tackle a slightly different problem to the one that interests me and Adam. What we want to do is simple: we want to be able to run a server on theoretic.com that lets me sign in to Slashdot with my network address, lets me sign up for mailman mailing lists without inventing passwords each time, links my Jabber account with my email account with my personal profiles so people can locate me based on interest, so I can sign in to Linux GDM with my network address and get my roaming desktop and so on. We have LOTS of ideas! :)

    What the LA are doing is linking currently existing identities together. They gave a demo of the technology in Denver. In fact, it was Justin Taylor who did this demo. It was entirely corporate focussed, they started from an intranet and were automatically signed in to some flight reservation service. That sort of tech has its place, and they're being realistic in that linking identities is a good way to start until people start getting their own identities hosted for them like email addresses.

    The LA has some good points to it, don't mindlessly bash it. However, it also has some bad points. One is the stupid requirements for membership, which they admitted to me privately are basically to keep the little guys out. Another is the hideous complexity of their protocols. The ones we've developed sacrifice a small amount of flexibility for a huge increase (imho) in implementability and understandability.

    Well having plugged it now (i seem to be plugging a lot of my projects today), I guess I'd better point out that what we're doing actually consists of two parts. The first is the protocol. This is (currently) called the Genio Protocol, and will be getting its own website soon (look for an announcement here when it does). It's simple, open and as far as we know free of IP claims. The second is the SourceID reference server, which is under a pseudo open source license.

    We have user profiles working, and I was coding up basic tickets functionality (authentication/authorization tokens) last weekend. Hopefully genioprotocol.org will be up soon and then it'll make more sense.

    Believe me, this is totally scratching an itch on my part (though I do get paid for it now too [grin]) because I think a good set of solid open digital identity protocols will make my life easier, and totally kick ass into the bargain.

  31. I just want my global telephone number by Jan+Venema · · Score: 1

    Liberty. Pasport. When can I get my global telephone number then this pasport shit will all be over.

  32. ISO latin-1 characters by Hubert+Q.+Gruntley · · Score: 2, Interesting

    The acute accent U+00B4 is in the ISO latin-1 character set. Alternatively, the author might have used one of the Unicode characters:

    U+2018 ‘ left single quotation mark
    U+2019 ’ right single quotation mark

    But when it's posted without a character-encoding MIME type, the processor just sees a strange character, and replaces it with a default character, in this case a question mark.

    --
    Laugh at my Lisp and I keeell you.
  33. Link to the stolen story please by oliverthered · · Score: 2, Informative

    go visit the register

    --
    thank God the internet isn't a human right.
  34. what about registration? by GunFodder · · Score: 3, Insightful

    Every password-protected site requires a separate registration process. Wouldn't it be simpler to cache registration information on a central server?

    The obvious disadvantage to this is that a poorly designed system could release personal info to unscrupulous businesses. A well-designed system could show you which fields a particular site wanted and ask for your approval. Better yet you could configure your account to release different levels of info to sites based on their privacy policy.

    1. Re:what about registration? by sulli · · Score: 3, Insightful
      Wouldn't it be simpler to cache registration information on a central server?

      No. I'd much prefer to keep the info in the browser, or in my head. I don't trust the central server as much as I trust my own PC.

      --

      sulli
      RTFJ.
    2. Re:what about registration? by gorilla · · Score: 3, Interesting
      Wouldn't it be even easier to have a standardized registration process that the browser could interact with on it's own?

      There is already the ability to negotiate image formats, languages and authentication schemes. Adding in registration shouldn't be a problem.

    3. Re:what about registration? by scrytch · · Score: 2

      Wouldn't it be even easier to have a standardized registration process that the browser could interact with on it's own?

      There is already the ability to negotiate image formats, languages and authentication schemes. Adding in registration shouldn't be a problem.


      And then you could call it Passport. Passport is an API. It works on more than one browser on more than one machine. But frankly, until it's tied to a physical token you can put on your keyring, I don't give single-sign on much chance of escaping into the net at large.

      --
      I've finally had it: until slashdot gets article moderation, I am not coming back.
    4. Re:what about registration? by gorilla · · Score: 2

      No I couldn't, because passport is server based, not browser based. I go into my browser's preferences and configure my prefered languages. I should be able to go into my browser and configure my preferences about personal information and what I want to give out, and when I click on a signon page, that information is transfered automatically to register and sign me onto the site. If we don't have agreement on what information we want to exchange (eg if I don't want to expose my email address and the site wants it), then the automatic registration would fail.

  35. Re:Couldn't this be as simple creating passport .. by Jan+Venema · · Score: 1

    Verry good idea. I trust my bank. They can sign for me (My certificate that is. That I am me!)

  36. Why is Sun always this pessimistic? by openbear · · Score: 3, Insightful

    Sun's Jonathan Schwartz claiming defeat to Microsoft as it has the market tightly controlled with the help of windows

    Pardon me for being a bit cranky and harsh, but why does Sun always seem to pull this line? They are declaring defeat before the battle really begins. If they want to pull out and quit then let them, but they have no need to declare the whole project a failure.

    Besides, isn't a bit early for them to start their standard "we can't do this because of Microsoft" whine.

  37. The Liberty Alliance isn't really an alternative. by Brett+Glass · · Score: 2, Insightful
    The biggest problem with the The Liberty Alliance is that it is not a real alternative to Microsoft's Passport. Passport is a single-signon systemthat forces users to put all of their eggs in one basket and trust their identities to potentially untrustworthy third parties. So is The Liberty Alliance. What's more, the name "Liberty Alliance" is Big Brotherish in a "freedom is slavery" sense: One does not get liberty from any system in which one must surrender one's personal information or control of one's digital identity to others.

    The Liberty Alliance could offer a true alternative to Passport by creating a system in which users, not large, faceless, and untrustworthy corporations, were in control of their identities. But it hasn't, and that's why it's floundering.

  38. Sheesh.... by r_j_prahad · · Score: 2

    Those insightful comments by Sun and Novell illustrate in no uncertain terms exactly why Microsoft has 97% of the frigging market. Gates and company are competing against morons, that's why. It'd be damn near impossible for him to lose, faced with that kind of gormless opposition.

  39. I wouldn't want to be coerced by either system. by Brett+Glass · · Score: 1

    Microsoft -- and its Passport partners -- are already attempting to coerce users to sign up and give them personal information. For example, if you attempt to visit the Starbucks.com Web site, and your system is set up to refuse unwanted cookies, you get this page. Far from convincing me to sign up for Passport, this message has, instead, convinced me not to patronize Starbucks.

    1. Re:I wouldn't want to be coerced by either system. by Anonymous Coward · · Score: 0

      I'm sure they'll go down in flames by losing you as a customer...

    2. Re:I wouldn't want to be coerced by either system. by Brett+Glass · · Score: 1
      I'm sure they'll go down in flames by losing you as a customer...

      If enough people refuse to visit their Web site because of their obnoxious insistence upon dropping Passport cookies on visitors, it'll hurt Starbucks; pocketbook sufficiently that the company will start to care.

    3. Re:I wouldn't want to be coerced by either system. by Anonymous Coward · · Score: 0

      You don't have to sign up for Passport to get on their site, you just have to allow session cookies... duh

  40. Re:Couldn't this be as simple creating passport .. by Salsaman · · Score: 2
    Yeah...guy I know showed me this cool little gadget he had from IBM. It looked like a pen, but when you pulled the top off, there was a USB connector on one end, and 8M of non-volatile memory inside it. You could just plug it straight into a USB port and use it like a hard drive.

    Anyway, if IBM can give away stuff like that (he got it at the end of a DB2 course), surely they could make some kind of simple USB smartcard ? I mean Big Blue already work with Mozilla to make the OS/2 browser, and with various Linux companies.

    So what's holding them back ?

  41. I use it all the time... by NineNine · · Score: 2

    I like Yahoo. Yahoo really has their shit together. I use a lot of different Yahoo services, and I use their single sign-on. I work from many different places from many different computers, but no matter where I am (even in a mall, for example), I've got access to my mail, my contacts, my to do list, auctions I'm watching, stock quotes, news, etc. Yahoo is doing it right.

    1. Re:I use it all the time... by nelsonal · · Score: 1

      I have to agree! There is nothing easier than finding a PC & access anywhere, and being able to email, check all my quotes, and see the latest news. Radio Shack is really nice about providing an open browser to show off their high speed access. All without screwing with the other person's settings, unless they need to reauthenticate for a cookie. By the way Exchange's web access is pretty useful as well, for all the corporate outlook users out there.

      --
      Degaussing scares the bad magnetism out of the monitor and fills it with good karma.
  42. Never let the facts stand in the way of an article by Anonymous Coward · · Score: 1, Informative

    Funnily enough, I heard about this article prior to its publication. So, we asked Jonathon via a contact at Sun whether this was indeed what he said, and the answer was "No - I asked Jonathon and he said that he didn't say that, and that he'd *never* say anything that even hinted that Sun conceded any segment of the marketplace to MS."

    As someone "close to the Alliance", I should mention that the basic premise of the article is simply incorrect. The Liberty Alliance is about defining open standards (there's that open word - means it ought to run on any platform, including Windows); whereas Passport is a service operated by MS. Chalk & Cheese.

  43. perhaps a politically correct MS Passport? by esarjeant · · Score: 2

    Hmm, and how else would you propose establishing a unified authentication mechanism?

    It might be more politically correct if my PayPal account gave me the option to create a PayPal account or a Passport account, but the truth is it's a lot easier to maintain if there is a single source for the user database. In this case, it just happens that MS has the proper Internet real estate to ensure that their SSO becomes the most popular.

    Unfortunately, I'm not convinced a web-based infrastructure is the right solution (ala: Passport). For that matter a distributed network identity authority (ala: Liberty Alliance) isn't all that much better.

    I think the time has come for *real* identity management, biometric authorization by means of a physical connection to a computer. Let's get rid username/password management before it gets the better of us.

    --

    Eric Sarjeant
    eric[@]sarjeant.com

  44. Every site has a unique password, easy to remember by krray · · Score: 1

    I never trusted Passport or anything of the like for web based services. Set ALL your passwords to the same thing? That's nuts too -- trusting webmasters not to try and hack into other accounts is just asking for trouble...

    Storing passwords within Mozilla or some such is just waiting for trouble too (IMHO). What will you do when it breaks and you can't remember your password to anything? Sure, most sites have ways to deal with lusers who forget their password, but that is just a pain and time consuming.

    My wife asked me this exact question (how to remember) recently. It's easy: come up with something you WILL remember and use the same IDEA across many, many platforms.

    For example:
    I drive a subaru. All passwords will start with SUB.
    My birthday may be 03/31/1968 (impossible :), so I'll use ... 8630
    I'm on SlAsHdot, so SAH ...my password here would be: sub8630sah

    Guess THAT. What would the password be for Yahoo? Easy: sub8630yho

    Unfortunately ... people don't like to THINK. Sad.

  45. Re:Couldn't this be as simple creating passport .. by SirGeek · · Score: 2
    Perhaps because it isn't universal ? Who would write the drivers for M$, Mac OS X, Linux, FreeBSD, Solaris, NetBSD, OpenBSD, DecUnix, etc. ?

    That alone may be reasons for NOT using it. They would prolly need something that has a file system that is ISO 9660 compliant so that it could read/loaded on the majority of systems.

  46. Re:Couldn't this be as simple creating passport .. by Zeinfeld · · Score: 2
    As a browser plugin ? That way the person decides who can access their information ? The keys, credit card and personal information/etc. are stored in an encrypted file on the machine and only those with permission can get at the information ?

    No way shoulod you do that unless you are running trusted hardware. I don't care what encryption is used for the file, the keys are still vulnerable, as is the data itself when it is decrypted.

    So yes that is a great design if you are using a Palladium class machine, but there are not many of those arround at present.

    It would eliminate the need for a hugemungous server (run by an evil corporation) and this way it would be pretty simple to access the information (with some authentication of course) and not need to pay an arm and a left testicle to an Evil Corporation..

    I find it difficult to take this type of approach seriously. I am much more worried about John Piondexter than I am about corporations at this point. I can't think off hand of any corporation who illegally sold arms to terrorists in Iran to fund more terorrists in Latin America.

    That aside, what you call 'authentication' is no more and no less than what Passport and Liberty both do. You are thinking about the problem from one angle alone, confidentiality. That is a bad mistake when talking about an authentication scheme.

    --
    Looking for an Information Security student project suggestion?
    Try http://dotcrimeManifesto.com/
  47. MICROSOFT ROCKS! by Anonymous Coward · · Score: 0

    is no surprise they kicked sun's and novell's ass you cannot beat the best out there

  48. Re:Couldn't this be as simple creating passport .. by Zeinfeld · · Score: 2
    Anyway, if IBM can give away stuff like that (he got it at the end of a DB2 course), surely they could make some kind of simple USB smartcard ?

    Rainbow have been making a smartcard in a USB form factor for several years. Thats why the SAML spec on which Liberty is based mentions 'hardware tokens' rather than smart cards.

    --
    Looking for an Information Security student project suggestion?
    Try http://dotcrimeManifesto.com/
  49. I'm starting to use Yahoo too by mrkurt · · Score: 1

    I have recently started to fully use Yahoo to give me a portal to a lot of the stuff from their site. I am preparing to abandon Hotmail and pAssport-- the Hotmail account is full of nothing but spam anymore, and one really can't stop it-- I think you can only have 250 or 500 addresses on your block list. So, I am moving everything that I used my Hotmail account for to Yahoo. There really isn't much of a need otherwise for me to use pAssport-- I used it to access (of course!) a .net user group site, but I have jumped ship on .net, so I won't need it anymore. When you think about it, Yahoo or some other portal/content provider has just as much of an opportunity to create a single sign-on service, instead of a software vendor-- it really has to be driven by the needs of users instead of just what product the vendors have to offer. Where it comes to security and spam prevention, MS just doesn't rate in my eyes.

    --
    Always look on the briight side of life! (whistle, whistle)
    1. Re:I'm starting to use Yahoo too by NineNine · · Score: 2

      I think that Yahoo is already doing the all-encompassing portal thing. The difference between them and .Net/Passport/whaterver it's called this week is that Yahoo is quietly going about their business. They're not tooting their own horn with buzzwords. They don't need to. While they're not perfect, they definitely have the best multi-service integrated platform on the Web today.

      As far as spam goes, yes, Yahoo is thousands of tiems better than Hotmail. That being said, Yahoo has started to slip a bit recently. I'm now seeing a message or two a day coming in from spam, whereas I saw zero about 6 months ago, and I'm not doing anything differently with my email (especially my personal one). So while it may be the best, it's not perfect, and I sure as shit hope they're not slipping.

  50. get the poiNT? by Anonymous Coward · · Score: 0

    the quoted text IS relevant. a 1000 pardons for not posting the link.

    the poiNT, of course, is that ill eagle shyteriousness .continues, despite the BiG "deal" with yOUR unclesam.US

    to put it another way, the original author of the text (which he/she posted anonymousely), SHOULD get LOTs of credit, for speaking out.

  51. Re:Couldn't this be as simple creating passport .. by deblau · · Score: 2

    You're missing the point. Passport was designed as single-signon from anywhere in the world. The first consequence of this is that you can't do anything client-side. Doesn't matter if it's OSS or not, it's basic network software design.

    --
    This post expresses my opinion, not that of my employer. And yes, IAAL.
  52. Perhaps its not about Microsoft vs Sun by Zeinfeld · · Score: 4, Informative
    Well thats good to know. I'm sure that Sun is feeling pretty good about themselves right now, and at Microsoft's expense, who I bet is busy rethinking strategy after reading your comment.

    I wrote most of the SAML specs which are the basis of the Liberty design. I really wish that people would stop trying to define the problem as one company bashing another.

    I have absolutely no interest in the issue of whether Sun can stop Microsoft or Microsoft can stop Sun. I have been trying to deploy global authentication schemes for ten years now, I believe that the problem is sufficiently hard that it is not going to be solve by any party that makes its primary objective the defeat of another party.

    First off lets recognize that companies working together can be a good thing for the consumer and can also be a bad thing. It is good when stuff works together, it is bad when working together effectively means a cartel.

    I don't fault Microsoft for using their deployed base to build the user base for passport. After all AOL did the same thing by buying up rival instant messaging services.

    What I do not see is how any party can reasonably expect the idea of global authentication to turn into some sort of monopoly. The competative forces involved are just too great.

    Consider the problem of getting access to my frequent flyer plan at United. It would be pretty handy if I could simply log on to United transparently through my browser without having the browser store lots of personal data on my machine that could itself be a security vulnerability. On the other hand I don't see United paying anyone $10 per year for the privillege of offering this facility or anything like it.

    Now consider what happens if we have 50 single sign on schemes, I don't see any advantage over having separate log ins.

    So there has to be a critical mass for any of these schemes to be worthwhile, there has to be a reasonable cost structure and there has to be confidence that the operators of the scheme will not impose new costs or hidden restrictions at a future date.

    I think that there is a value here but I think that both Liberty and Passport need to be radically rethunk before either can achieve the stated goals.

    Before that happens however I think that there has to be a political realignment. In particular I think we need to get Liberty to stop promoting itself as a 'stop Microsoft' scheme and we need Passport and Liberty to agree to some form of convergence in the same way that Visa and Mastercard converged.

    Specifically we should adopt SAML as the underlying architecture for global authentication. The ability to carry kerberos tickets and passport credentials is already designed into the SAML specs.

    Once there is agreement on a technology base Liberty and Passport would both evolve into federated authentication brands in the same way that Mastercard and Visa have. There would be a strong assumption that merchants and web sites would support both brands rather than expecting consumers to cope with both sets of credentials.

    Finally we need to work out who is going to actually pay for such a system to be established. Charging end users is really hard, charging merchants cuts out sites like slashdot. Where is the compelling value proposition? I believe that there is one to be found but we have not got there yet.

    --
    Looking for an Information Security student project suggestion?
    Try http://dotcrimeManifesto.com/
  53. Re:Every site has a unique password, easy to remem by The+Analog+Kid · · Score: 1

    If microsoft did that they would go out of buissness, because if one person found out, any john doe could say that they cracked into their account to and their would be many multi-million dollar lawsuits, yes they are a billion dollar company but there are billons people of which atleast 1 billion probably use passport

  54. It's just a peer-to-peer version of single signon by Woodrose · · Score: 0
    Liberty Alliance, Passport are just attempts at providing peer-to-peer version of enterprise single-signon solutions such as those provided by Netegrity's SiteMinder etc.

    Of course there's always a server involved somewhere, isn't there? Can't ever be true peer-to-peer, just "mostly distributed".

    Like UDDI, great idea but I'll keep my own registry, thanks.

    My life, my world, my data.

    --

    Thou hast damnable iteration, and art indeed able to corrupt a saint - Henry IV, Act I scene II

  55. "claiming defeat"? by jellybear · · Score: 2

    Schwartz is "claiming defeat"? As opposed to "admitting victory"?

  56. Re:The Liberty Alliance isn't really an alternativ by philipdl71 · · Score: 1

    I guess we'll just have to wait for the dotGNU project to save us all from this hell.

    http://www.gnu.org/projects/dotgnu/web-services. ht ml

  57. Last Post! by alpg · · Score: 1

    By long-standing tradition, I take this opportunity to savage other
    designers in the thin disguise of good, clean fun.
    -- P.J. Plauger, "Computer Language", 1988, April
    Fool's column.

    - this post brought to you by the Automated Last Post Generator...