Passport to Nowhere

prostoalex writes "CNET News.com.com talks about less than glamorous acceptance of Microsoft's single sign-on technology, .NET Passport. Being launched as a single sign-on service for online businesses and competing heavily with open Liberty Alliance project, which so far has produced just a large amount of PDF files, .NET Passport is considered a failure (although not by Microsoft). Turns out, high licensing fees, lack of simple implementation, security leaks and server downtime, were not acceptable to most of potential clients out there."

Comments

Favorite quote from TFA

[Liselle]

"Microsoft was kind of pushing Passport for a problem that didn't exist..."

I think that more or less hits the nail on the head. This is aside from the downtime issue, which is embarassing, and privacy issues, which are disturbing. On the privacy/downtime note, the Liberty Alliance may be vapor currently, but the idea of a "federated" system sounds much better to me. It's not a problem I have with Microsoft, rather it's a problem I have with giving all of my personal information to a single organization to put into a central respository.

No sir, that's bad sauce.

Re:Favorite quote from TFA

[michael path]

I had that quote cited and ready to post as well.

It's still not an issue that exists today. However, I'm an avid user of Paypal because it's more convenient to pay with my username and password submitted only to Paypal's server, and let them return the "Success/Fail" of the payment to the vendor. It made eBay easier. It's easy to subscribe to Slashdot/OSDN using it. It's easier to subscribe to some porn sites using it.

Granted, that's just the payment piece, and not the cetnralized repository of all my useful details - but significant just the same.

Now, if Microsoft bought eBay (and thereby, Paypal), they'd have an existing solution they could extend to suit their needs.

That said, the moment Microsoft buys eBay is the moment I evaluate auction alternatives.

Re:Favorite quote from TFA

[PacoTaco]

Microsoft wants to push the distributed web services model. Web services are much easier to manage with a centralized authentication system (rather than dealing with many separate passwords/certificates per application). Whether something like Passport is right for end users is another question.

Re:Favorite quote from TFA

[Otter]

"Microsoft was kind of pushing Passport for a problem that didn't exist..."

I wouldn't say the problem doesn't exist -- every time a link takes me to an article at the LA Times, Chicago Sun, Telegraph or any other paper that requires me to remember some crazy new userid or to go through a lengthy registration process, there's a problem, usually solved by my deciding it's not worth it. Or bidding on eBay from the library, or...

As you say, a central repository seems like a bad solution but I'd really love to have a good one. (And, no, my having to carry everything around on a memory stick is not a good answer. For one thing, you can't just mount them anywhere.)

Re:Favorite quote from TFA

[TrentL]

I just use a dummy password for all those newspapers anyway. I let the browser remember it.

Oh, and I'm not a 65-year old CEO living in Ethiopia, but don't tell that to the Washington Post.

Re:Favorite quote from TFA

[Sigma 7]

Whether something like Passport is right for end users is another question.

While I'm not speaking for everybody, I'm sure there's a large group of people that always hate having to register for every individual website for the sole purpose of posting a single comment. It's one of the many good reasons why Usenet is still around. It's also the same reason why Gamespy's Forumplanet is keeping so many users in spite of having a poor forum interface.

Multiple logins aren't better either. Given the sheer quantity of internet forums, a user will eventaully give up on creating new username/password combinations that they will simply recycle them (a big security risk right there.)

Re:Favorite quote from TFA

[Otter]

Both of you guys miss my point -- yeah, Mozilla and Konqueror remember my logins, on a single computer! They don't transfer between work and home and they certainly don't help me at a public terminal! Thus, Passport.

Re:Favorite quote from TFA

[Jim_Maryland]

"Microsoft was kind of pushing Passport for a problem that didn't exist..."

The problem of single sign on (SSO) does exist, particularly in the corporate world. Vendors implimenting Web Portals (MS SharePoint, Sun Java System Portal Server, BEA WebLogic Portal, Vignette Portal, etc...) have a particular interest in SSO and identity management via Identity Services to present a single interface to various systems in an enterprise.

My main problem with MS Passport is that it's Microsoft's version of a standard rather than a community standard. Applications can connect via MS's SDK rather than publishing the standard. Using Open LDAP, Sun's Identity Server, etc... will generally follow open standards and have better compatibiltiy to other open source/standard applications.

Re:Favorite quote from TFA

[MagicBox]

Well the IDEA was brilliant. However, there's a huge difference between thinking the idea and implementing it the was it's supposed to to be. I also think MS had the logic of implementation correctly, and a partially working .NET passport system (which personally I have never used beyond signing in to hotmail). There is a few reasons that Passport was *doomed* from the very beginning, and two come to mind right away:

1) The venerable WEB is just not able to handle such complex task. It'll fall prey to hackers and vandals. We do not understand Internet deep enough to be able to complete such tasks in total security and privacy. There's too many holes, that even those who look for them 24/7 haven't found yet. Internet has grown much faster than our ability to understand it and study it.

2) one word: Microsoft. Yes they probbably have all my info collected little by little over the years, but I'll give that the benefit of the doubt, what I don't want to do it trust something (someone) that cannot be trusted. I am not bashing MS, I know they are trying HARD....but it's gonna take time and some radical changes for that to happen.

Re:Favorite quote from TFA

[Cecil]

I'd trust my personal information to Microsoft before I trusted it to Liberty Alliance. Founding member companies are:

American Express, AOL Time Warner, Bell Canada, Citigroup, France Telecom, General Motors, Hewlett-Packard Company, MasterCard International, Nokia, NTT DoCoMo, Openwave Systems, RSA Security, Sony Corporation, Sun Microsystems, United Airlines and Vodafone.

Perhaps it's just me, but it sure sounds like their marketers' wet dream.

Re:Favorite quote from TFA

[1010011010]

PassPort? Jeesh - you /. dorks will replace a simple 2 second process with one incredibly difficult and annoying just to stay away from MS... You may think you're some sort of "Freedom Fighter", when really you're just a retard.

How's the weather in Redmond?

I'm sure PassPort will protect you from spyware, such as keystroke loggers, on those public terminals, right? And I'm sure that giving MSFT control over my personal authentication tokens is really in my best interest, never mind passport's publicised security problems. Yeah, I'm the retard for not trusting it.

Re:Favorite quote from TFA

[Mr. Piddle]

Web services are much easier to manage with a centralized authentication system (rather than dealing with many separate passwords/certificates per application).

While true in theory, I still agree that there really isn't a problem to solve, at least not with the amount of technology in Passport.

For example, having accounts on multiple sites isn't a big problem at all. As far as security goes, I set up username/password choices in tiers. Many non-essential sites get a standard username and password (a non-dictionary hard-to-guess password at that). E-mail gets an entirely different password for better compartmentalization. My home computer gets yet another password.

With three or four levels of compartmentalization, password management isn't something I lose sleep over. Also, I'd much rather each site have its own account information, so there's little chance that one site could figure out what other sites I visit.

Re:Favorite quote from TFA

[bonhomme_de_neige]

For example, having accounts on multiple sites isn't a big problem at all.

The problem isn't remembering your passwords (you have local password managers for that, such as the one built into Mozilla, which are much more secure simply because your home PC would need to be compromised to even begin cracking at the password list... that is assuming you keep your home PC reasonably secure). The problem is signing up to all those sites. Each time you have to fill out a form, wait for an activation email, then activate your account, etc. etc.

If your sole purpose for creating an account was to post a comment on some forum, which you more than likely will never want to post on again in your life, then there's a good chance that you'll just say "fuck it" and whatever you wanted to say will go unposted. But if instead of going through that pain you can just click the "Log me in with Passport" button and then post your message, it's a lot more likely to end up posted.

I've found myself in this situation on several software support forums, where I was looking for a solution to some problem, and someone else had already posted the same problem, but it had not been answered. After I work out how to solve it by myself, often I want to be nice and post the solution, but the effort of creating an account essentially for someone else's gain is simply too much (I'm not an altruist ;p)

The reason Passport failed (apart from the ones cited already) is simple: trust. In order for such a service to work people have to trust the organisation they're giving their personal info to. This already rules out Microsoft as a viable implementor of such a program - how many people genuinely trust MS enough?

Personally..

[Caedar]

I never saw a need for .NET Passport in any way. Privacy issues aside, all Passport would achieve for the company using it is something they could already do with simpler, more secure, and less liable technologies already available to them.

Re:Personally..

[CdBee]

I used to use Passport to sign into eBay UK but it failed about every other time. I ended up abandoning that account and starting a new one due to the low reliability.

I lost several good auctions thanks to that POS system!
I suspect my experience wasn't atypical and has led to this.

Hmmm

[Anonymous Crowhead]

Turns out, high licensing fees, lack of simple implementation, security leaks and server downtime

Yet they still buy windows...

Re:Hmmm

[MrPoopyPants]

Who buys windows? People buy computers, it comes with windows. Most people don't know any better.

I know you were joking (at least that's what the moderation indicates) but I just don't see people flocking to the stores to get the latest copy of windows. Adoption of XP has been pretty slow (even though it's the best windows yet). People sit there with spyware, worms, memory leaks, and complete shit on their computers and don't even care. It's amazing what the average computer user will put up with.

Generic description

[nother_nix_hacker]

Turns out, high licensing fees, lack of simple implementation, security leaks and server downtime

Sounds like a generic description of MS products.

Re:Generic description

[ThogScully]

I personally think that it's becoming the groupthink/chic thing to do to point out that the Slashdot crowd doesn't like Microsoft.

Personally, I'd say the posting of that story should stand as proof that Slashdot isn't so biased as you seem to indicate. Moreover, whenever good news for Microsoft is posted here, it's generally studied with great detail and flaws are exposed in the methodology. For example, in the story you mention, they ignored worms, viruses, trojans, etc, because they didn't involve a person specifically targetting a specific windows machine for an intrusion. I remember thinking that the only valuable thing to come of that study was that Linux/Unix/whatever required actual human intervention to break into it, while Microsoft wasn't worth the bother when a thousand automated tools do it for you.
-N

"Competing Heavily"?

[American AC in Paris]

[.NET Passport is] competing heavily with open Liberty Alliance project, which so far has produced just large amount of PDF files

...by this logic, one could say that Halo is competing heavily with Duke Nukem Forever, or that Coca-Cola is competing heavily with Cola Turka...

I mean, doesn't "competing heavily" imply that there's, well, an active competition in the first place?

Problem that doesn't exist big time...

[192939495969798999]

It is widely pulicized now how to manage passwords for a website -- it's as simple as using other Microsoft tools, and so in a way, passport puts itself out of business by competing poorly with other Microsoft products. Why would anyone not just use an NT auth login, ASP, or one of the myriad of other ways to do a sign-on. The only place I see passports now is places where Microsoft already had a majorly vested business interest. Passport should go right up there with Microsoft BOB , IMHO.

Re:Problem that doesn't exist big time...

[jfengel]

The problem isn't managing passwords for a web site. The problem is managing passwords for ALL web sites.

How many accounts do you have, between eBay and paypal and Amazon and slashdot and ...? Do you use a different password for each one? Aren't you the least bit worried that the Slashdot editors will use your Slashdot password against your Amazon account?

The idea of Single Sign-On is to put all of your eggs in one basket, then make sure it's a really good basket. Nobody trusts Microsoft to make that really good basket, but it doesn't mean that they're not trying to solve a real problem. It's a tricky one, because the trust factor is scary, and the stakes are very high.

Re:Problem that doesn't exist big time...

[Jerf]

The idea of Single Sign-On is to put all of your eggs in one basket, then make sure it's a really good basket. Nobody trusts Microsoft to make that really good basket, but it doesn't mean that they're not trying to solve a real problem. It's a tricky one, because the trust factor is scary, and the stakes are very high.

The most recent Cryptogram has a highly relevant comment on this issue:

[Suppose t]here are 10 $100 piles, each secured by individual $200 security systems. They're all secure. There are another 10 $100 piles, each secured by individual $50 systems. They're all insecure.

Clearly something must be done.

One suggestion is to replace all the individual security systems by a single centralized system. The new system is much better than the ones being replaced; it's a $500 system.

Unfortunately, the new system won't provide more security. Under the old systems, 10 piles of money could be stolen at a cost of $50 per pile; an attacker would realize a total profit of $500. Under the new system, we have 20 $100 piles all secured by a single $500 system. An attacker now has an incentive to break that more-secure system, since he can steal $2000 by spending $500 -- a profit of $1500.

The problem is centralization. When individual security systems are combined in one centralized system, the incentive to break that new system is generally higher. Even though the centralized system may be harder to break than any of the individual systems, if it is easier to break than ALL of the individual systems, it may result in less security overall.

There is a security benefit to decentralized security.

Only used in hotmail

[sapped]

I actually created a passport login to see how many places they would use it and if it would be beneficial. Thus far I have only seen it used with Hotmail and on the MSN site. Have any others seen it used on other non-Microsoft sites?

No thanks

[Orien]

I like the concept of passport, but I'm not going to get in bed with Microsoft to put it on my web servers. Besides, it has always seemed to me that doing a scheme like that would introduce so many more points of failure to your web system, that it wouldn't be worth the trouble. That's not to mention security. Somehow I just feel safer when I have to log in to each site separatly.

Re:No thanks

[AnotherBlackHat]

I like the concept of passport ...

The entire concept is flawed from the get-go.

If I wanted my passwords stored on a computer, then I might as well do away with them completely.

But assuming I did want to to store my passwords on a computer, I'd want them on my computer.

And if for some reason, I wanted to store them with a third party, I wouldn't want the storage to be a single sourced service.

And if was willing to accept a single sourced service, I still wouldn't want that source to be Microsoft.

And assuming you get past all of the above, you still need to convince the vendor that it's good for them too - and you'll need to convince a lot of them to make it worth while.

-- this is not a .sig

Just PDF files?

[finkployd]

Liberty Alliance project, which so far has produced just large amount of PDF files

Which is all they intended to produce. Technically Liberty Alliance is a spec, not an implementation.

Now if you are asserting that there are no implementations, the SourceID people would probably disagree with that.

Finkployd

2 Things

[panthro]

1. I have yet to meet someone who actually has (let alone uses) a .NET Passport.

2. If you are thinking about replying to this message with "I Do!", then I probably won't meet you, so see 1.

Re:2 Things

[lpangelrob2]

1.) If you're saying that you've never met anyone that's used/uses a Hotmail account, I would find that hard to believe.

2.) If you really haven't... hi, I'm Rob! Nice to meet you. :-)

Re:2 Things

[El]

Every one of the tens of millions of hotmail customers have and use a .NET passport. That includes many slashdotters (like me). Granted, most of these are throw-away email accounts, but still, they are used.

Concept Good, at first.

[jolyonr]

At first, the concept of a global authentication system seems great. We all have too many passwords to remember, the idea behind Passport seems great.

But in reality, there isn't anyone who is secure enough, trustworthy enough, powerful enough and smart enough to pull off a system that would work and would be trusted.

You need to have the strength and power to be able to build such a system, and with those, trust invariably goes out of the window.

So for now I'll keep all my passwords in my brain, and pay the price of my mistrust.

Jolyon

Perhaps entering passwords and form fields...

[Anonymous Coward]

...isn't such a chore that we would need a freakishly-complex infrastructure to save us a couple of keystrokes.

Re:Microsoft and the FBI

[ioErr]

Interesting claim. Care to, you know, back it up with something?

Re:Microsoft and the FBI

[Anonymous Coward]

Interesting claim. Care to, you know, back it up with something?

Back it up? You must be new here.

Vendors don't want it.

[AnotherBlackHat]

From the article

"I can't imagine a Web site today being willing to pay $10,000 a year and go through the whole process necessary to implement Passport."

Hello? It's not very easy to imagine a site that's willing let a third party handle customer information for free.

Most companies aren't even willing to tell you how many customers they have, much less let you collect personal information about them.

-- this is not a .sig

Look for the .NET Passport Sign In button

[GillBates0]

From the .NET Passport page linked to in the blurb, people are supposed to look out for the "button" and when they see it on their site, they can login with their .NET account.

What's to prevent me from copying their pretty gif and collecting people's logins/passwords?

MS isn't giving up...

[brucmack]

I attended an MS tech talk a couple of months ago about the identity system coming in Longhorn. It seems like they are really targetting mass acceptance with that one too.

While I can't remember exactly how everything worked (hey, I was there for the food), it was basically an RSA key system, with the private key stored on ones own computer. The main MS involvement was to have some servers set up to allow one to back up their private key so they aren't screwed over if their computer crashes without a backup... and the presenter seemed confident that there would be non-MS providers of the service as well.

It seemed like a pretty neat idea anyway... There were also systems in place to allow one to deactivate their key if it was compromised. Basically one's computer could notify all of the places it had exchanged its public key with to tell them that it is no longer valid anymore. It seemed like an interesting system that took a lot of the control away from MS, as long as one trusts the OS not to beam the keys back to them :)

The only real downside was that it seemed like they weren't too keen on getting the server-side software operating on non-MS platforms. But who knows... It certainly seems to be a better solution than Passport, since there would be no fees beyond having a supported OS.

Too expensive

[truelight]

Passport has extremely high potential. I tried it out a while back... I went to Slate.com after signing up for a passport, and clicked the "Sign In" button. Now, I had never visited Slate, nor did they have any data on me prior to this. When I clicked "Sign In", that was it. I was registered. No filling out forms. No nothing. From a usability standpoint, Passport has tremendous potential.

With that said, the fees are absolutely horrendous. I checked it out - $1000/year for "small implementations", and $10000 for other. While I'm all for paying for a good solution, I can't see how having a single-sign-in solution on any website would generate $10000/year in profits.

I'm sure it would catch on like wildfire if they just lowered the fees to more manageble levels.

Oh, and buy paypal.

Re:What's .NET again?

[Gr8Apes]

.NET was originally a set of web services, then a service platform, then a server OS, then a set of services on a server OS, then a development platform, and, now, the most known .NET (because I think there's more than one, MS couldn't tell me for sure though) is the multiple language to bytecode platform/compiler.

Is it any surprise that .NET appears to be fading away? Anything that mucked up by schizophrenic marketing would have to be simply the best thing since the goose that laid gold eggs to survive. And MS's products are definitely not that. (that's not an opinion, see the recent virus outbreak reports for why - just about every major MS product's been hit in the last 6 months)

No, I'm New Here

[New Here]

No, I'm New Here

Crap can flow uphill

[cyberlotnet]

The problem with the whole concept in general to me is security.

Company A holds your credit card information and controls the sign up system.

Company B You make purchases through there system, credit card details are pulled from company A, your happy

Slap on 100 Company B's each with the ability to pull your credit card data so you can make purchases.

You now have 100 new possible locations for a hacker to crack, giving them access to a massive database of credit card data.

A chain is only as strong as its weakest link. The more merchants you add to this style system, the better change your chain will break one day.

Passport's Compeitors...

[LostCluster]

Passport has gotten a lot of bad press, but there's three other major single signon systems in circulation that nobody talks about...

AOL's ScreenName Service is used on all Time Warner web properties and partners, including AIM, the Netscape sites, all of the magazines they own and EA's Pogo games site.

Disney's Go Network may have failed as a portal, but every web domain Disney owns still redirects to a subdomain of go.com such as ABC.go.com and ESPN.go.com. Therefore, there's a full network of news content, e-mail, and a few shopping sites contained there, all of which are Disney-owned properties.

Yahoo also has a full "network" of sites within the Yahoo.com domain... e-mail, an IM client, games, shopping, and let's not forget there's a serach engine there too. Yahoo lets several partners have your entire account infomation simply by offering a one-click registration into a site such as WorldWinner.com from their games section.

So, while all the bad press is being aimed at MS... several just as invasive services have quietly gained power.

Just how many Google logons do I need?

[LostCluster]

Every registration-requiring service of Google nicely collects no more infomation than it needs to, but there also seems to be very little support for cross-linking registrations from one service to another. As a result, they have distinct logon screens for...

- AdWords
- AdSense
- Google API
- SiteSearch / Websearch
- Blogger

They just keep adding new services, but there's no sign of any unity coming...

Wrong way around

[realnowhereman]

I think the idea of single sign on is a good one. The problem is, it shouldn't be implemented on the server side. KDE's new KWallet system is a very good example of how this should work - I keep all my logons locally, encrypted, and in a trusted place - my privacy is not at any more risk than it ever was. Now, I single sign on to the KWallet system which is then used by konqueror/kopete/kmail/whatever to auto-logon whereever i go.

With a little bit of support server side (perhaps a standard way of passing logon information to HTTP servers - if the existing method is not deemed good enough) this could easily fake the entire passport system with no need for any centralised server.

My "Passport"

[oldmildog]

For each web site I visit, I have a user ID and then make up a 10 character random password. That's stored in a text file on my laptop which is then encrypted with PGP. When I need to log in to a site, I unencrypt the file, copy/paste the password into the browser, and wipe the file. This is a few more steps than what MS Passport does but is infinitely more valuable to me in making me feel my passwords are relatively secure. BOTH solutions rely on one password to protect all my accounts, but at least in my solution it's a 20-character phrase stored my head instead of one stored in Redmond.

Apple's Keychain

[diamondsw]

What works well is Apple's Keychain idea.

If you want, all of your passwords (web sites, iDisk, e-mail, etc) are all stored in your encrypted keychain on your computer. When you login and authenticate your primary keychain is unlocked, allowing programs that stored passwords to access them. Programs cannot access others' passwords without your consent (in the form of "The application blah wants to access your keychain. Do you want to allow this?"). As would be expected, the whole shebang is encrypted on disk, I believe with AES. Finally, if you don't want all of your passwords in one spot, you can create multiple keychains (e-mail accounts, financial sites, other web sites) and unlock them only as needed.

It's all local, all secure, very flexible, and by default so easy it's completely transparent.

Not sure how MS works, but

[mdfst13]

I'm not sure how the Microsoft version works, but if I were implementing something like this, I would never allow logins to come from the site. Instead, I would require the site and user to log in to my system separately. Then I would give them a unique identifier or something to check if the user is logged on to the central system.

For example, I might create two unique encryption/decryption key pairs and give one decrypt to the site and the corresponding encrypt to the user and give the other decrypt to the user and the corresponding encrypt to the site. Now they can communicate safely with private key encryption.

Note that neither the site nor the user ever has login info for the other. Remember to discard the keys when done.

A side effect of this is that instead of getting a login page when you try to connect to a site using the system when you are not logged in, you would get an error page (you are not logged in; please go to the appropriate place and log in). This would be mildly inconvenient but much more secure.

Of course Passport is flopping.

[Zathras26]

First of all, as others in this thread are already pointing out, the security issues are problematic, to say the least... you want to store all that financial information in a Microsoft server, with Microsoft's terrible security record? No, thanks.

Second, Microsoft already has a ridiculous amount of power over the lives of the ordinary consumer, and the ordinary consumer knows it and deeply resents it. Even if they're not technically literate enough to be able to use non-MS products regularly, they still don't want to give Billgatus of Borg any more power over them than they absolutely have to.

Related to that, Passport is designed to force people to use MS products. I have a Passport ID (which I created only because I have friends on MS Messenger, not because I wanted to), and it's nothing but one solid headache. Just as an experiment, I've tried to log in to a number of sites with Passport using my regular browser, Safari, and it never works. It works fine in Internet Explorer, though -- gee, you don't suppose MS purposely designed it not to function with any browser other than its own, do you? Nah... I mean, they've never done anything like that before...

My background on this..

[zeno_2]

I used to work helpdesk for Microsoft. Well it was another company that they contracted, but anyway. After doing Win98 support I got moved to multimedia and games. Part of that support was for Asherons Call.

Asherons Call (when it originally came out) used the MSN Zone login system to keep track of whos in the game, who has accounts, etc. Probably a year or so later, they (being Microsoft) decided that it would be better of all of the MSN Gaming Zone went to passport instead of using their own login system. When this first went thru, the passport servers got hammered, and people were unable to make passport accounts. Most of these people that were making new accounts were because of Asherons Call. Then the real troubles began.

First, they had it setup so only one active Asherons Call account could be tied to a passport. Sure, you could have multiple accounts under one passport, but you would have to go to the Asherons Call website each time you wanted to use a different account, and change that info on the webpage. (What pretty much happens is you login to passport when you go to the AC page, and then you go into the game, you dont put another password or anything in the actual game interface). So, when you logged in, it just used the "active" AC account tied to the passport you used. This really isn't a big deal for those who have just one account, but there was a lady who called in with 22 AC accounts. Don't ask me why she had so many, people get a little crazy with these games I guess. So, for her to be able to easily login to each one of those accounts, she would have to create 22 seperate passport accounts. So much for the "single sign in system" that they like to tout so much.

Second, the MSN Gaming Zone, and Microsoft are pretty much 2 seperate companies. They don't really share much info behind the scenes (im talking support wise). So, when someone called me up, they would say they couldn't login to Asheron's Call. I would have them go thru the process of making a passport account. At times, the passport account creation wouldn't go well, and Microsoft (at least at that time) had not a single person who could really help me with the passport system at all. There really isn't a phone extension I could have called to get more info, i just had to like figure it out on my own. Not something I dont think really should be done in a big support deal. Anyway, walk the person thru creating the passport account, and then going in and linking the AC account with the newely created passport account. For the few weeks after they decided to do this, it was the worst that you could think of, having to fix that 20 times in a day. It wasn't really our problem (games and multimedia) but they didn't have anywhere else for them to go.

Ok, so that said, I couldn't imagine what a seperate company would get in terms of support when trying to, lets say, integrate passport into thier website. I was representing myself as a Microsoft employee and I couldn't really find anyone to help fix problems with passport, and I was access to the full MSKB (one of the cool things they have, even if it is all just text)Eventually we got some tools towards the end of my days that we could look up what account was tied to what passport, but it really didn't matter much because all the problems we had with it were pretty much taken care of. As a side note, if you were to call them up today, you would be talking to someone in India.

Passports generate spam

[quoll]

Last year we took on a Windows programming contract, so I went ahead and bought an MSDN subscription. In order to log into the online stuff I needed a .Net passport, and this required an email address.

The address I gave had been around for 3 years and had never received more than a couple of spam messages a week. Within 24 hours of getting the .Net passport that email address was getting over 20 spams a day, and it has grown significantly since then. (Thank goodness it wasn't my primary email account!)

Conclusion: either the passport user list is being sold, or security is nonexistent. Either way this is not a system anyone sane person would subscribe to!

There's a lot of really random comments, here.

[g_lightyear]

Time to clear this up.

1) Liberty Alliance protocols aren't about setting up a single auth provider that the world uses to authenticate you: It's a way of businesses and sites to create an agreement to allow each other to cross-login, or to support logins from foreign systems. Any site wishing to turn its login system into an Identity Provider is free to do so - other sites can then use that federated identity.

2) Liberty Alliance protocols don't require that one central identity hold all information. Each service provider has a local account which can hold information specific to that service without requiring your private information to be shared indiscriminately.

You can Liberty-enable a set of websites today. This can be done transparently to users, and is about businesses sharing sign-ons and authentication information without actually having to share your data. Site X doesn't need to have your account information, or your password; it can find out from the identity provider enough information to know whether you've been authenticated, or direct you over to them to authenticate safely.

Read the docs, folks. It's not Passport. It's not even really *like* passport, in its intended use. It's real, it's implementable, it serves a real purpose, and it's going to be BIG.