Microsoft Loses Passport

nikkoslack copies and pastes: "Microsoft is abandoning one of its most controversial attempts to dominate the Internet after rival companies banded together to oppose it and consumers failed to embrace it. The Redmond software company said Wednesday it would stop trying to persuade Web sites to use its Passport service, which stores consumers' credit-card and other information as Internet users surf from place to place."

Comments

It's often implemented without https

[HawkinsD]

Thank God.

I realize that it's probably the fault of the implementer, and not the technology, but I can't tell you how many times I've supplied my password to a page that was rendered without https.

So I had to get two Passport accounts: one for secure things, like my MSDN account, and one for things that I didn't care who stole my password for.

Re:It's often implemented without https

[Dr. Evil]

Often the page is sent in the clear, but the submit action is an https link.

Not that I think that such behaviour is good practice... just that it might very well have been encrypted.

Not Totally Abandoned

[p0]

Microsoft will still use Passport for MSN services like Hotmail.

Re:A few years down the line ...

[finkployd]

You don't really know much about liberty alliance do you? It is a federated identity management service, using OASIS's SAML to assert authentication status and attributes, not like passport's "store everything in one place" service.

It is also licensed such that MS cannot modify or extend it in a way that is interoperable with the spec (which would make it useless anyway).

Finkployd

Misconceptions

[RupW]

The Redmond software company said Wednesday it would stop trying to persuade Web sites to use its Passport service, which stores consumers' credit-card and other information as Internet users surf from place to place."

• Passport does not store your credit-card details any more. You had to opt in to passport's Wallet service to do this. Microsoft discontinued Wallet a long time ago.
• You do not have to provide any personal details to Passport. If you do, you can refuse Passport permission to pass them on to other sites. In this case, all the end sites get is your 64-bit user ID.
• End sites cannot store information in your Passport account. The API is one way only. To alter the details in your Passport you have to go to passport.net
• Passport is a trusted third-party for authentication. You don't log into any passport-enabled site directly; they redirect you to a secure page on passport.net (often with some source-site branding) and Passport redirects you back to them once you've logged in.
• Passport absolutely DOES NOT "store your passwords". A few people said this in the eBay story's comments (!). Come on people, we're supposed to be tech-savvy here.

I'm almost sorry to see it go - it was a usable, simple to integrate single-sign-on with a big name, money and a fair critical mass behind it. Shame the entry price was so high.

Re:no trust... no passport

[hugesmile]

A friend of mine - yeah, that's it.. a friend - runs a website that has a registration process, whereby people create their own accounts and passwords. To my amazement (my friend tells me that...) the vast majority of users sign up and provide an email address and password that is obviously the same password used elsewhere around the internet. With this password, my friend can easily retrieve / delete people's email, access some paypal accounts, and sign into other common services around the net.

Good thing my friend is ethical! I can't emphasize enough - USE A DIFFRENT PASSWORD FOR EACH WEBSITE, such that no DB Admin from one site can guess your other passwords!