Slashdot Mirror
The Liberty Alliance Grows Again
sempf writes "The Liberty Alliance, a Sun-backed open-specification alternative to the Microsoft platform's Passport system, has added two very powerful members, Oracle and Intel. Now over 150 members, one wonders at the future of a world where we have two single sign-on systems. With the three big IM platforms joining forces, is the identity standard of the world going to be Microsoft, or Sun? Is this going to be the next Browser War?"
No. There won't be a war because no one wants it. MSN's passport has been around for a long time now and barely anyone uses it.
It's called Mac OS X's Keychain.
Who cares what company has the new identification standard? I'd rather keep my multiple passwords than rely on one breach of one system to lose my entire online life. I'd assume most geeks are the same and I've met some pretty paranoid non-geeks out there about having any information on the web. So unless we really believe that the information we need to have to exist in our online world won't be available outside of the authentication standards of a few companies, we have nothing to worry about.
When I tell an object to delete this, am I killing it or telling it to kill me?
I'll believe there's a "sign-on war" the day Ebay locks people out for not having a passport/liberty alliance account. (Currently they support Passport+their own system.)
Honestly, site-specific sign-on systems are easy to develop and most e-tailers have a powerful motive to offer their customers as many choices as possible. This is stark contrast to the one-or-the-other image a "war" connotes.
Go somewhere random
Does Microsoft have a patent on this kind of single signon? It sure wouldn't suprise me if they have one or one in the works.
Evolution or ID?
How universal can any kind of "identity system" be before it gets scary and/or illegal? (Illegal in countries with data protection laws anyway.)
Nokia is on board with this, and as more and more of my personal information gets concentrated on my phone I'll probably end up using it.
Eventually we'll probably all have a digital "passport" of some kind - and much better this way than the Microsoft way - but it's still a bit creepy.
This Like That - fun with words!
With, as you point out, over 150 member companies the Liberty Alliance is scarcely just "Sun".
Galileo: "The Earth revolves around the Sun!"
Score: -1 100% Flamebait
So they're all finally joining forces.
.NET hardware independent toolset will allow MS to move away from x86 at will and set up their own chip division. MS can't grow their software division much more in a saturated market, but if they use their own chipset (or licence it to a couple of 3rd party suppliers) they can take over all of Intel's current profit.
Intel is terrified that Longhorn's
Oracle is of course competing against SQL Server.
All these large IT companies have known for years that MS is going to eat their lunch, but they couldn't work out what to do about it.
The penny has finally dropped - the only way to combat MS is for them all to work together using common standards : hence, their support for Linux, the Liberty Alliance, J2EE and so on.
Liberty is a pretty good standard, it allows federated and distributed authoring instead of Microsoft's "only we know who you are" approach.
It's a shame that everything this alliance has produced up to date is just a pile of PDF specifications. Hope it will change soon.
Be sure that this will be the next big war. But it will most certainly not be fought in the open field. My guess is that this will mostly influence companies as they move more and more to single sign-on solutions.
Article from Internet News
June 30, 2004
Single Sign-On Gains Liberty Support
By Clint Boulton
Although a lack of interoperability has threatened to hold Web services adoption back, Liberty Alliance, a group dedicated to forging an open identity standard, cracked that barrier by certifying nine single sign-in products this week.
The group awarded Ericsson, Hewlett-Packard, IBM, Netegrity, Novell, Oracle, Ping Identity, Sun, and Trustgenix its "Liberty Alliance Interoperable" mark in a conformance test.
The certification, which covers Liberty Alliance Identity Federation Framework (ID-FF) version 1.1 and 1.2 for single sign-on services, involves a rigorous testing process that gauges identity federation, authentication, session management and privacy protection. Vendors must demonstrate interoperability with two other randomly selected participants.
Secure single sign-on services are a key ingredient for Web services, a high-flying concept for distributed computing that allows applications to talk to one another to perform tasks. But customers are afraid to "sign-on" without a secure brand, because crackers can swipe their personal information if the site is not safeguarded properly.
According to a Liberty statement, the products are interoperable out-of-the-box, which pares deployment schedules and saves costs. This is key, as customers are loathe to license technology if it isn't supported by a validated standard, according to Gartner analyst Ray Wagner.
Customers who are thinking about federation projects need some reassurance that there won't be a huge amount of manual integration necessary between partners with different infrastructures," Wagner told internetnews.com. "Requiring compliance with Liberty, SAML, WS-Federation, and WS-I Basic Security Profile, or a subset of the above, will provide some assurance that systems have the capability to work together."
Wagner said he believes most vendors who make identity management products will provide compatibility with specs or standards in the short term, noting that Federation protocols in particular (SAML, Liberty, WS-Federation) will likely converge in the medium term.
With Liberty's certification, companies can say that their products are compliant with the Liberty identity standard, making their identity management software more appealing to customers looking to shore up their Web services platforms with authentication via single sign-on services.
Forrester analyst Randy Heffner said using Identity Web Services Framework (ID-WSF) requires Liberty's ID-FF and offers an interoperable path to Web services as long as users start with Liberty's ID-FF.
"There is a test suite to ensure broad testing coverage of the technical interfaces," Heffner told internetnews.com. "But successful operation of the tests is sort of on the honor system -- except that a vendor who wants the Liberty logo must participate in an interoperability event and successfully connect with a couple of other randomly chosen products."
"This is better than a simple, pre-planned interoperability event, which only proves that there is 'at least one' configuration by which products can work together -- but not that this is the configuration that any given user might need," Heffner concluded.
Web services have been slow to take off over the last few years, due to obstacles such as interoperability, security and manageability. But this is changing, owing in part to the steady work companies have been putting into the matter and the increasing acceptance of the more broad service-oriented architecture approach to software services.
The following products are now Liberty compliant: the Ericsson User S
StarTrek.org Free Webmail
There a can be no indentity standard, because there can be no indentity.
IPs can be spoofed, mail foraged, add to that proxies and firewall... There is no way of telling who is really on either end of the connection. Now, add single signon security, without forced timeout of passwords and without heavy forced editing preventing reuse and dictonary attacks.
Look to windowsupdate.microsoft.com. Are you connecting to truly to microsoft? No, you are not. So you are taking a SECURITY download from a site, that may have an associtation with MS but not MS itself. Boy are we trusting.
So where does that leave the rest?
that something is the 'new browser war' is the new black.
...Single sign-on outside the corporate network (aka, the Internet at large) is a problem that doesn't need much solving..
..and both MS and Sun will fail at solving a problem that doesn't really need solving.
A better approach would be for either MS or Sun to develop multi-langauge, multi-platform products that will help web developers implement standard password requirements, username/password schemes, etc.
Forcing a lame implementation of bad technology isn't going to work.
Both Microsoft and Sun to make equally useless products that nobody really wants to use... for now.
To everyone here doing their favorite pasttime, bashing Microsoft, do you really think your information will be so much safer with Sun or Apple? Don't be so naive. Eggs in one basket, especially as it pertains to computers and networking (both with terrible records on security) is a bad thing.
...who gets to give you herpes.
The big IM providers are NOT joining forces, they're just making a tidy sum providing Microsoft with a way of routing messages between networks. IM convergence would mean being able to send a message to a user on another network directly, that still is not on the cards.
I'm just waiting for Google to offer a Messenger service, using a gMail account as a login. I think they could bring great things to the IM market, especially if the based an offering on an OSS project like Jabber, for which other IM software providers could then incorporate support.
Passport is already tied closely to Messenger and Windows XP in particular, I don't see the opposition gaining ground without going the same way.
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
The Liberty Alliance is not a single signon like Passport. It doesn't put all your data in the hands on one organisation. It basically allows you to link logins and share data between them.
It's a tricky concept to grasp but I've found these two introductions helpful:
How about I just keep my identity and NOT have any single company owning my personal data? Yes convince is what America is all about, but there are still many steps needed to be taken in the real world to prove your identity, why do we need one system that everything will be required to use (think about the future). With something like this, I can see something bad happening. The US government (world government too) has been trying to remove the ability to be anonymous on the internet, with a system like this INFORCED at many different levels, the ability to be anonymous would no longer exist, the moment you connect your pc to the internet (LAN?) you would be authenticated.
TruePunk | Games
Here is a research project (here) that is building a replacement for Passport. The main idea, as I understand it, is to use multiple authenticators in different administration domains (unlike Passport controlled by a single entity, namely MS) to authenticate a user, and then use threshold crypto to combine the result into a single authentication token.
Does anyone know what dotGNU proposes to do?
From their website it seems that they are making some kind of decentralized "passport". Is The Liberty Alliance also pushing a decentralized solution?
Microsoft or Sun, we need more choices, like a different single sign on system for everything we log into. Oh, wait, we already have that. Now what where we trying to fix again?
I found the logo (and even the name) to be vaguely reminiscent of the Alliance and Leicester bank. I wonder if it's just a coincidence?
The first link says MS, AOL and Yahoo have joined forces.
The Liberty Alliance page shows AOL as one of the 15 "Management Board Members".
Seems AOL is positioning themselves to be a win/win member.
I prefer "Coalition of the Willing (TM)."
This article and the replies contained therein clearly demonstrate BIg Brothers ability to polarize the American public on who is the best provider of security while keeping the focus off the real issue at hand, the sytematic destruction of your personal privacy. Who cares which one is better! I don't want either! Who really believes you can catch the bad guys by keeping track of the good guys? We have proven that to be false and flawed, over and over, and that that approach simply doesn't work. The bad guys never abide by the system, but find ways around it. Does gun registration stop people from obtaining illegal guns for use in crimes? Does all the information a bank collects on you stop someone from ripping off your bank account? Meanwhile the rest of us have more and more laws to abide by, more hoops to jump through, more restrictions on our movements and more eyes watching our every move. Maybe if there were camera's in my house watching me, my neighbor wouldn't kill anyone. Wake up, before it's too late!
This is in not simply a single sign-on system like MS Passport, where only they manager/control your identity. This is just an API for identity and authentication, and the "identity provider" can be anybody such as the company you work for, the government, or a third party identification service like Thawte.
What will the Microsoft-led coalition be called? Team Advantage? (In a perfect world, Liberty Alliance would be US Alliance. I know.)
"Even for Slashdot, that was a very obscure reference!" - Anonymous Coward
Liberty Alliance has devolved into an industry interest and lobbying group. I dson't think there are any plans to roll out a united sign-on anytime soon. When Passport died, so did the utility of this body. One has to wonder why it still exists.
This is only a half-solution, however. It still requires creating separate accounts on each host, doesn't allow you to use computers other than your already configured Mac to access those sites, and doesn't let sites share authentication data. (i.e., site A authenticates you, site B authenticates you, and those two sites want to make sure they're both talking to the same person.)
There is a big different between actual single sign on and (for lack of a better word) hacks that auto sign on for you.
..then we could back it unreservedly
you download a form, fill it out, and send it back to them. No online verification, and no electronic forms. I give it a thumbs down. Join the 21st century, Liberty Alliance!
"Warning slippery when sarcastic!"
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Coming to a Marvel comic book near you soon
You don't need a lab to make mud.
convince is what America is all about?
What the hell are you on about.
And it's Enforced, not inforced.
And if you've got an IP address, then you're not exactly anonymous anyway.
I want multiple signons, so a single server crack doesn't jeopardize all my info, along with everyone else's. I want a single client that manages all those signons. That security architecture also makes any one crack less profitable - getting all my info isn't nearly as attractive as getting every customer of a big web merchant. The distributed security will reduce the damage, and increase the trust of the infrastructure.
--
make install -not war
There's another single sign-in solution called public key cryptography. I'm a little confused as to what problem passport and liberty alliance are trying to solve that wasn't solved 20 years ago by diffie, hellman, rivest, shamir, and addleman. Perhaps someone can enlighten me. With PK, you can authenticate yourself to anyone without revealing your secret key.
Is passport/liberty alliance a solution to the public key distribution problem? Is it a hack to support PK-like authentication without requiring client browser modifications?
-jim
Some vendors already have Liberty-compliant solutions ready for production, with mobile operators running trials. I am not allowed to name such operators, but here is a list of products conforming to Liberty specs . It is a very interesting market, where vendors with a telecom background clash against classical IT ones.
It seems like there is a major problem with cross-site scripting that is very hard to fix in all cases. For example, here's one related to Passport. The point is that css is hard to fix because you can't guarantee that another website that uses the same single signon system won't be vulnerable. So if there is a single signon system, then it seems to me that it's all only as secure as the most insecure website in the network.
Last I heard, Sun sold their soul to M$ for about $2 billion.
Loading...
The Identity Commons is also working on the same problem, but they have taken a more useful approach than the Liberty Alliance.
Scott Draves
" you already have a powerful means of authentication, the one allowing you to attach to the network and place calls."
In Europe it's already there, it's a SIM card. So again, what's the point? When authenication is implemented in hardware and can be easily passed around by the operator why implement a software solution?
In the spirit of FOSS - to wit, building a working one to back up your specifications - try this. If 50% of websites got a clean bill of health there, the world would be a better place.The error messages there recently got much better. See if you can spot which explicatory message I contributed to the list. The takeaway message is, don't just whine - fix it.
They may be a bunch of meeting-bound administrators, but W3C do produce working code to their own specifications.
Got time? Spend some of it coding or testing
I won't trust anything or anyone online since everything has to be decoded at one point. Also, you can proof that true security is impossible without true anonymity so an ID system does not make sense by any means.
There are numerous reasons that nobody wants such a system and the industry should accept that fact instead of trying to push it on us and sell our aggregated profiles to telemarketers, spammers, scammers, etc.
Therefore you simply might want to say "NO, THANKS!"
The SIM card is used to authenticate to the mobile network -implemented in hardware, as you well said. This authentication can also be reused by the operator for the services it sells to its customers. But, if no other mechanism is implemented, it remains limited to the operator realm.
The advantage of the Liberty single-sign-on specification is that it provides a method to share the SIM authentication with third parties, so that the end-user does not have to go through the login procedure each time.
Liberty is a standard API, so this 'passing around' of the authentication can be used by a much bigger number of service providers than a proprietary solution like the ones in place at some mobile operators, the so-called Walled Garden single-sign-on solutions.