Slashdot Mirror
Passport to Nowhere
prostoalex writes "CNET News.com.com talks about less than glamorous acceptance of Microsoft's single sign-on technology, .NET Passport. Being launched as a single sign-on service for online businesses and competing heavily with open Liberty Alliance project, which so far has produced just a large amount of PDF files, .NET Passport is considered a failure (although not by Microsoft). Turns out, high licensing fees, lack of simple implementation, security leaks and server downtime, were not acceptable to most of potential clients out there."
I actually created a passport login to see how many places they would use it and if it would be beneficial. Thus far I have only seen it used with Hotmail and on the MSN site. Have any others seen it used on other non-Microsoft sites?
Liberty Alliance project, which so far has produced just large amount of PDF files
Which is all they intended to produce. Technically Liberty Alliance is a spec, not an implementation.
Now if you are asserting that there are no implementations, the SourceID people would probably disagree with that.
Finkployd
Hello? It's not very easy to imagine a site that's willing let a third party handle customer information for free.
Most companies aren't even willing to tell you how many customers they have, much less let you collect personal information about them.
-- this is not a
The problem isn't managing passwords for a web site. The problem is managing passwords for ALL web sites.
...? Do you use a different password for each one? Aren't you the least bit worried that the Slashdot editors will use your Slashdot password against your Amazon account?
How many accounts do you have, between eBay and paypal and Amazon and slashdot and
The idea of Single Sign-On is to put all of your eggs in one basket, then make sure it's a really good basket. Nobody trusts Microsoft to make that really good basket, but it doesn't mean that they're not trying to solve a real problem. It's a tricky one, because the trust factor is scary, and the stakes are very high.
What works well is Apple's Keychain idea.
If you want, all of your passwords (web sites, iDisk, e-mail, etc) are all stored in your encrypted keychain on your computer. When you login and authenticate your primary keychain is unlocked, allowing programs that stored passwords to access them. Programs cannot access others' passwords without your consent (in the form of "The application blah wants to access your keychain. Do you want to allow this?"). As would be expected, the whole shebang is encrypted on disk, I believe with AES. Finally, if you don't want all of your passwords in one spot, you can create multiple keychains (e-mail accounts, financial sites, other web sites) and unlock them only as needed.
It's all local, all secure, very flexible, and by default so easy it's completely transparent.
I don't know what kind of crack I was on, but I suspect it was decaf.