Passport to Nowhere

prostoalex writes "CNET News.com.com talks about less than glamorous acceptance of Microsoft's single sign-on technology, .NET Passport. Being launched as a single sign-on service for online businesses and competing heavily with open Liberty Alliance project, which so far has produced just a large amount of PDF files, .NET Passport is considered a failure (although not by Microsoft). Turns out, high licensing fees, lack of simple implementation, security leaks and server downtime, were not acceptable to most of potential clients out there."

Comments

Favorite quote from TFA

[Liselle]

"Microsoft was kind of pushing Passport for a problem that didn't exist..."

I think that more or less hits the nail on the head. This is aside from the downtime issue, which is embarassing, and privacy issues, which are disturbing. On the privacy/downtime note, the Liberty Alliance may be vapor currently, but the idea of a "federated" system sounds much better to me. It's not a problem I have with Microsoft, rather it's a problem I have with giving all of my personal information to a single organization to put into a central respository.

No sir, that's bad sauce.

Re:Favorite quote from TFA

[PacoTaco]

Microsoft wants to push the distributed web services model. Web services are much easier to manage with a centralized authentication system (rather than dealing with many separate passwords/certificates per application). Whether something like Passport is right for end users is another question.

Re:Favorite quote from TFA

[Sigma 7]

Whether something like Passport is right for end users is another question.

While I'm not speaking for everybody, I'm sure there's a large group of people that always hate having to register for every individual website for the sole purpose of posting a single comment. It's one of the many good reasons why Usenet is still around. It's also the same reason why Gamespy's Forumplanet is keeping so many users in spite of having a poor forum interface.

Multiple logins aren't better either. Given the sheer quantity of internet forums, a user will eventaully give up on creating new username/password combinations that they will simply recycle them (a big security risk right there.)

Re:Favorite quote from TFA

[Jim_Maryland]

"Microsoft was kind of pushing Passport for a problem that didn't exist..."

The problem of single sign on (SSO) does exist, particularly in the corporate world. Vendors implimenting Web Portals (MS SharePoint, Sun Java System Portal Server, BEA WebLogic Portal, Vignette Portal, etc...) have a particular interest in SSO and identity management via Identity Services to present a single interface to various systems in an enterprise.

My main problem with MS Passport is that it's Microsoft's version of a standard rather than a community standard. Applications can connect via MS's SDK rather than publishing the standard. Using Open LDAP, Sun's Identity Server, etc... will generally follow open standards and have better compatibiltiy to other open source/standard applications.

Re:Favorite quote from TFA

[1010011010]

PassPort? Jeesh - you /. dorks will replace a simple 2 second process with one incredibly difficult and annoying just to stay away from MS... You may think you're some sort of "Freedom Fighter", when really you're just a retard.

How's the weather in Redmond?

I'm sure PassPort will protect you from spyware, such as keystroke loggers, on those public terminals, right? And I'm sure that giving MSFT control over my personal authentication tokens is really in my best interest, never mind passport's publicised security problems. Yeah, I'm the retard for not trusting it.

Personally..

[Caedar]

I never saw a need for .NET Passport in any way. Privacy issues aside, all Passport would achieve for the company using it is something they could already do with simpler, more secure, and less liable technologies already available to them.

"Competing Heavily"?

[American AC in Paris]

[.NET Passport is] competing heavily with open Liberty Alliance project, which so far has produced just large amount of PDF files

...by this logic, one could say that Halo is competing heavily with Duke Nukem Forever, or that Coca-Cola is competing heavily with Cola Turka...

I mean, doesn't "competing heavily" imply that there's, well, an active competition in the first place?

No thanks

[Orien]

I like the concept of passport, but I'm not going to get in bed with Microsoft to put it on my web servers. Besides, it has always seemed to me that doing a scheme like that would introduce so many more points of failure to your web system, that it wouldn't be worth the trouble. That's not to mention security. Somehow I just feel safer when I have to log in to each site separatly.

Re:No thanks

[AnotherBlackHat]

I like the concept of passport ...

The entire concept is flawed from the get-go.

If I wanted my passwords stored on a computer, then I might as well do away with them completely.

But assuming I did want to to store my passwords on a computer, I'd want them on my computer.

And if for some reason, I wanted to store them with a third party, I wouldn't want the storage to be a single sourced service.

And if was willing to accept a single sourced service, I still wouldn't want that source to be Microsoft.

And assuming you get past all of the above, you still need to convince the vendor that it's good for them too - and you'll need to convince a lot of them to make it worth while.

-- this is not a .sig

Concept Good, at first.

[jolyonr]

At first, the concept of a global authentication system seems great. We all have too many passwords to remember, the idea behind Passport seems great.

But in reality, there isn't anyone who is secure enough, trustworthy enough, powerful enough and smart enough to pull off a system that would work and would be trusted.

You need to have the strength and power to be able to build such a system, and with those, trust invariably goes out of the window.

So for now I'll keep all my passwords in my brain, and pay the price of my mistrust.

Jolyon

Re:Generic description

[ThogScully]

I personally think that it's becoming the groupthink/chic thing to do to point out that the Slashdot crowd doesn't like Microsoft.

Personally, I'd say the posting of that story should stand as proof that Slashdot isn't so biased as you seem to indicate. Moreover, whenever good news for Microsoft is posted here, it's generally studied with great detail and flaws are exposed in the methodology. For example, in the story you mention, they ignored worms, viruses, trojans, etc, because they didn't involve a person specifically targetting a specific windows machine for an intrusion. I remember thinking that the only valuable thing to come of that study was that Linux/Unix/whatever required actual human intervention to break into it, while Microsoft wasn't worth the bother when a thousand automated tools do it for you.
-N

Re:Problem that doesn't exist big time...

[Jerf]

The idea of Single Sign-On is to put all of your eggs in one basket, then make sure it's a really good basket. Nobody trusts Microsoft to make that really good basket, but it doesn't mean that they're not trying to solve a real problem. It's a tricky one, because the trust factor is scary, and the stakes are very high.

The most recent Cryptogram has a highly relevant comment on this issue:

[Suppose t]here are 10 $100 piles, each secured by individual $200 security systems. They're all secure. There are another 10 $100 piles, each secured by individual $50 systems. They're all insecure.

Clearly something must be done.

One suggestion is to replace all the individual security systems by a single centralized system. The new system is much better than the ones being replaced; it's a $500 system.

Unfortunately, the new system won't provide more security. Under the old systems, 10 piles of money could be stolen at a cost of $50 per pile; an attacker would realize a total profit of $500. Under the new system, we have 20 $100 piles all secured by a single $500 system. An attacker now has an incentive to break that more-secure system, since he can steal $2000 by spending $500 -- a profit of $1500.

The problem is centralization. When individual security systems are combined in one centralized system, the incentive to break that new system is generally higher. Even though the centralized system may be harder to break than any of the individual systems, if it is easier to break than ALL of the individual systems, it may result in less security overall.

There is a security benefit to decentralized security.

Crap can flow uphill

[cyberlotnet]

The problem with the whole concept in general to me is security.

Company A holds your credit card information and controls the sign up system.

Company B You make purchases through there system, credit card details are pulled from company A, your happy

Slap on 100 Company B's each with the ability to pull your credit card data so you can make purchases.

You now have 100 new possible locations for a hacker to crack, giving them access to a massive database of credit card data.

A chain is only as strong as its weakest link. The more merchants you add to this style system, the better change your chain will break one day.