Microsoft Opens Up Windows Live ID

randommsdev writes "Microsoft has announced the release of Windows Live ID Web Authentication. This means that WLID (formerly known as Passport) is now opened to third party websites to use as their authentication system. Any Windows Live user can potentially log in to a website that implements Web Authentication. Interestingly sample implementations are available in the Ruby, Python, Perl, and PHP open source languages amongst others — tested on openSUSE 10.2 but expected to work on any platform that supports these languages. More details are available in the SDK documentation."

Comments

ATTN: Top-posting whores

[Anonymous Coward]

Put your comments below this one.

Re:ATTN: Top-posting whores

[Anonymous Coward]

What is top posting?

Thanks!

Put your comments below this one.

Re:ATTN: Top-posting whores

[Anonymous Coward]

Top posting is when people intentially respond to a post that is close to the top in order to achieve higher visibility. As a result, their posts often get modded higher than if they started their own thread in the discussion or responded to something that is on-topic. If you've ever seen someone respond to a post near the top with something that has nothing to do with what they replied to, that is top posting (there's probably other terms as well) and is a sure sign of a scum-sucking karma whore. Unfortunately, the mods fall for it a lot rather than modding the post off-topic as it should be.

Re:ATTN: Top-posting whores

[laederkeps]

Top posting is when people intentially respond to a post that is close to the top in order to achieve higher visibility.
Here, maybe. Go back a few years and you'll find that "top-posting" was (and is) used to describe someone who, in a newsgroup post, puts his or her own answer above the quote it responds to, making the discussion hard to follow by the quotes in one single post.

Re:ATTN: Top-posting whores

[cbelle13013]

Why would anyone do that?

Top posting is when people intentially respond to a post that is close to the top in order to achieve higher visibility.

Here, maybe. Go back a few years and you'll find that "top-posting" was (and is) used to describe someone who, in a newsgroup post, puts his or her own answer above the quote it responds to, making the discussion hard to follow by the quotes in one single post.

Re:ATTN: Top-posting whores

[ascendant]

Maybe they don't mean to. You know, an accident.

Why would anyone do that?

Top posting is when people intentially respond to a post that is close to the top in order to achieve higher visibility.

Here, maybe. Go back a few years and you'll find that "top-posting" was (and is) used to describe someone who, in a newsgroup post, puts his or her own answer above the quote it responds to, making the discussion hard to follow by the quotes in one single post.

BTW anyone have that weird error where if you select text above a quote, and then try to drag the cursor down to select more, it jumps to the bottom of the page? ^^ testing area above =)
I know it doesn't freak out like that on Firefox
In IE, it does the opposite (selects all text above cursor)

Re:ATTN: Top-posting whores

[Brad Eleven]

I'm still wondering why most email clients work this way. It makes sense when I'm replying to one person, but if I want to expand the audience, I'd rather the preceding discussion show up first.

Then again--speaking of those golden Usenet days--I'm still trying to wean myself from fisking.

Re:ATTN: Top-posting whores

[Dolda2000]

I know you were kidding, but what bothers me very much is that top-posting is, as far as I'm aware, yet another problem initiated by Microsoft.

When replying to something in MS Outlook (at least the last time I looked), what you got was the standard "Original Message:" header, followed by the unquoted original message, more or less forcing you to top-post unless you want to quote the original message manually. I don't think that Outlook Express does the same though, although I'm not sure.

It may well be that I'm uninformed and that some other program began this vile malpractice before Outlook (cc:Mail comes to mind as a potential candidate), but at the very least it is being encouraged by Microsoft.

Re:ATTN: Top-posting whores

[RAMMS EIN]

``Go back a few years and you'll find that "top-posting" was (and is) used to describe someone who, in a newsgroup post, puts his or her own answer above the quote it responds to, making the discussion hard to follow by the quotes in one single post.''

It also goes together with actually _not_ indicating what part of the quoted message parts of the reply refer to, and quoting the whole message (and earlier ones in the thread for bonus points), even the parts that aren't relevant, even if _nothing_ in the current message actually is a reply to anything in the quoted part.

Now excuse me while i run to the bathroom. Top-posting makes me sick!

Re:ATTN: Top-posting whores

[RAMMS EIN]

It's actually worse than you describe. Outlook not only defaults to top-posting, there is no way to change it and it's virtually impossible to bottom post using it, because it will quote everything belowe the "Original message" line, including your reply.

If I sound angry, it's because I am. Really, really angry. They are FORCING people to do things the wrong way. #@-%]@-*#&$#--%&%#EOAto@*$*$]#&

NO CARRIER

Re:ATTN: Top-posting whores

[Anonymous Coward]

If I sound angry, it's because I am. Really, really angry. They are FORCING people to do things the wrong way. #@-%]@-*#&$#--%&%#EOAto@*$*$]#&

Me too, and it's not just Microsoft. E.g. the Nokia Internet Tablets have an email application that forces top-posting (and this is by spec: bug reports on the behaviour get marked WONTFIX)... Fortunately the application is such a steaming pile of crap that no-one uses it.

w00t!

[doxology]

urls gone wlid!

Re:w00t!

[StarfishOne]

Intially I read "gurls gone wild" while scrolling down the page.

Then I remembered that I was reading /. with a sleepy head full of wishful thoughts...

How long

[afidel]

Until the first site with a fake passport login form shows up? I mean before semi-intelligent people weren't going to enter their passport ID into non-MS websites, but now... I bet a lot more corporate keys get exposed this way as passport is the keys to your Enterprise Licensing kingdom.

Re:How long

[smashin234]

This has been done many times in the past, and I am sure it will continue to happen. Most common were the times that people would set-up false bank of america websites and people would type in their account information....perfect set-up. What was even better was that these sites sometimes were set to bankofamrica.com or some slight variation of the site, so the common user would have no idea they were at the wrong site.

Well there are safeguards for this now, and I am sure if it gets to be a problem like that was at one time, it will also get fixed.

Re:How long

[macbort]

Google and Yahoo have both been offering similar services for awhile now, I believe, and I don't remember hearing either of them having this problem. Not to say it couldn't happen, but I imagine they've thought about this situation and have accounted for it somehow.

Re:How long

[jamesh]

I would love to have a 'single sign-on' and forever forget the hassle of remembering and entering passwords, but the flaw you mention and many others mean I don't think it will ever work. The value of pwning someone's 'single sign-on' code (whether it is Microsoft or some other solution) is just too high.

If a 'single sign-on' became everyone's only method of authenticating to anything, then it would make identity theft just too easy.

You can go to extreme lengths to protect all the sign-on pages in the world, but as long as there are people who will click on a 'your account will be deleted in 2 days unless you go to http://i.am.going.to.steal.your.identity.com/verif y.php' link in an email, none of it matters.

I can't think of any way of preventing that problem without there still being the possibility of a "man in the middle" attack...

Re:How long

[SgtChaireBourne]

[How long] Until the first site with a fake passport login form shows up? ...

It doesn't matter so much, it's not like MS WLID, formerly known as MS Passport can ever be made secure. It's fundamentally flawed from the design.

However, all the bad press was about MS Passport, so a simple name change and, Voila, no bad press about the product. Palladium was sanitize the same way.

Re:How long

[jamesh]

Well there are safeguards for this now, and I am sure if it gets to be a problem like that was at one time, it will also get fixed.

The safeguards only work if the user is paying attention. It only takes a fraction of a percent of people to click a 'log in here with your bank of america credentials to see if you have won a prize' link and the scammers can make a profit, and will keep on scamming.

Still... if you've got a way around this that is truly idiot proof, I'd like to hear it! The best thing I can come up with is that the banks themselves initiate the scam, and then send 'the boys' around to break the thumbs of anyone who falls for it, or otherwise punish the scammee (that's strange... my spell check says scammee isn't a valid word...).

Re:How long

[biocute]

Hasn't MS already got a solution?

All these partner sites must display a "Genuine Live" hologram GIF image.

Beat that!

Re:How long

[JonathanR]

Two Factor authentication using a security token (like the RSA SecurID tokens).

Re:How long

[RightSaidFred99]

Nonsense. But way to dig up a 7 year old paper. I'm sure Live is _totally_ the same thing and their complaints are still _totally_ valid.

Re:How long

[arivanov]

'log in here with your bank of america credentials to see if you have won a prize'. As a matter of fact this is the latest and probably the most successfull class of phishing sites. The ruse is a "survey" on behalf of "Bank of America" or someone else. It is surprising how many people fall for it. The website has nothing to do with the bank, the addresses are not the bank ones, but none the less the consumer enters their credentials. As a results of many years of brainwashing by direct marketeers they now consider all this to be "business as usual".

Re:How long

[aichpvee]

That's because scamming is a victimless crime.

Though apparently victimless isn't a word either, making the previous statement impossible while at the same time the previous statement must be true. I'll let one of you contemplate this paradox as I would hate to be responsible for the annihilation of the universe.

Re:How long

[aichpvee]

"live" is just the flavor of the week label at microsoft. It's the same old crap that they've always done, just now with a different name and probably a shiny new look lifted from a preschool toy. Maybe if they didn't come up with such retarded names for their brands (or maybe if they had better quality products, though that doesn't stop apple [that's right fanbois, mod me troll, I don't care]) they wouldn't have to change the names every 3 years.

Re:How long

[Anonymous Coward]

Could this be used with genuine windows verification to ensure the ID is being validated on the users home PC?

Re:How long

[Anonymous Coward]

Too expensive to give out to consumers. Better to use randomised two-factor schemes in software, like what these guys do: http://www.bharosa.com/

Re:How long

[baboonlogic]

There is nothing in a single sign on system to force you to use only one id. Using openid and the few sites that actually allow you to use it, I have already brought down my username password combos needed from about 10 to 2. So I can decrease the number of sign ons with systems like openid.

Secondly, as far as identity theft is concerned, my email accounts are already single points for attack. Once you have the email, the password recovery services will do your bidding. A single-identity-solution allows you to just shift this from email to some server which was created to keep and handle this data. Whats more you could be the one setting up that server... (not in the ms case but in the case of openid).

So, on the whole, single sign ons can work and openid hopefully will. I dont even want to rtfa. If I cant decide who keeps my username password for my single signon, I am just not interested.

Re:How long

[jombeewoof]

Software tokens are terrible, they fail much more often than not. SecurID tokens are the best thing to happen to computers since parc. The greatest thing is the simplicity, a random number shot through an algorithm changed every 60 seconds. If the numbers don't match you don't get in. They're simple to resync if the two sides fall out of skew. And reasonably difficult to counterfeit. In a few years(decades) the price will come down and you'll have one of these for just about everything. Your bank, your job, even some fancy car keys have similar technology in them. While they're not without their flaws, the securid's and similar 2 factor id have a lot of potential to cut down on identity theft.

Re:How long

[initialE]

How about a windows component that runs straight off your computer, and has tie-ins to internet explorer? sounds like the way microsoft would do it.

Re:How long

[gujo-odori]

Single sign-on would be fine as long as it was done in conjunction with two-factor authentication. For example, where I work, I use a one-time password generator to get on the VPN. Having my username and PIN won't help you unless you also have that generator. I also have a real estate license, and access to MLS also uses a one-time password generator.

Now, if Microsoft, openID, or *someone* in the single sign-on space implemented a system that used a one-time password generator, you'd have something that would be pretty secure, while at the same time keeping you from having a generator for every important site you use, if outfits like banks, etc., ever get their crap together and start using those. That is something I would use. In the meantime, in the interests of security, I so maintain separate userids and passwords at different sites, and store them in Firefox, encrypted with the master password. For non-web resources, the OS X keychain takes care of it. These two things together give me something that's almost as good as Passport and a lot more secure, because it's under my control.

Note to anyone who's in bank IT: if your bank is first to market with a one-time password generator sign-on in California, I *will* move all of my accounts there.

Re:How long

[Yvanhoe]

Well, how many people use 10 different passwords anyway ? I think that most people end up using the same password again and again. The man in the middle attack can be prevented using a good crypto and certificates provided by the OS during installation (ie. not downloaded)

Re:How long

[Scruffy Dan]

paypal already offers one for only 5 bucks

Re:How long

[Propaganda13]

This is a lot different. Before bankofamrica.com had to set up a website then send out email. Halfway smart people wouldn't click on the link because they'd be wondering why their bank is emailing them. Now, I can set up joesfreeporn.com with a fake sign-in. If you're used to going to a lot of sites(bobsfreeporn.com and mikesfreeporn.com), using the sign-in isn't going to throw up a red flag at all.

The signon form should only be on one secured site, not added to any site.

Re:How long

[Catil]

Thanks to the forgot-password-option every site offers, using a single email address to register to everything makes that email account already the weakest link anyway. With the millions of blogs and forums these days, however, that all require people to register and validate via email just to leave a comment, a "single sign-on system" is still a good idea. I guess secure critical sites like Paypal wouldn't cause a problem because they hopefully would never provide to login with such a system in the first place.
It's a pity that OpenID somehow doesn't take off as many expected and I don't think a Microsoft solution will either. Google comes to mind as one company that could probably do it successfully.

Re:How long

[pe1chl]

But a reasonable bank would use multifactor authentication. Is the bank of america still relying on a simple username/password authentication? Then they deserve to become victim of such attacks.

Re:How long

[weicco]

We found out something is broken, they fixed it the same day but we still believe it is broken. Wow!

Only thing I found interesting in that article was the 3DES encryption thing. Passport could use per-client key but did TFA say it should be assigned to user's address, IP address? I get dynamic IP address from ISP so if keys would be assigned to my IP address and ISP's DHCP server decides to change my address wouldn't I be force to reauthenticate?

Other attack mechanism aren't solely entangled to Passport. If attacker gets his computer to act as man-in-the-middle or is able to attack name server(s) you are basically screwed anyway. Same goes if attacker is able to attack the actual server (Passport or business server).

But there's easier way to get user's information, I think. Just release email-worm which says "cool emoticons for you Messenger/Skype/whatever" and you have 1000000 teenagers downloading your trojan EXE the next day :) I've cleaned up couple of computers infected this way. It is pretty efficient attack and enables attacker to do lot's of kind nasty things at least on Windows 98/ME/2K/XP.

But should we start crusade against every goddamn software which is subject of somekind of security hole, not matter how abstract or theoritical? Don't get me wrong, security holes are bad but if we decide that attacking DNS server is compromising Passport, then we could ban all the web browsers also.

Re:How long

[Mantaar]

Unfortunately, it's not the bank who's the victim, but their costumers. The bank actually doesn't really care as long as the costumers don't get too concerned about their own security -

This means, of course, that we are the only ones that are able to stop the bank from acting stupid

Re:How long

[KiloByte]

Well, how many people use 10 different passwords anyway ?

I use... lemme estimate the count... somewhere around 50 different passwords, with little to remember.

All you need is any mapping you remember anyway. For me, that's ASCII codes, names of Doom2 levels, etc, but for you it could be for example episode names of Star Trek (bleh), or even, horrors, results of 1976 baseball league. Everyone has something of this kind.

Next, pick a scheme of turning account/host names into the domain of your mapping.
Then, do the same for turning the mapping's codomain into short strings.

This does have a potential vulnerability of letting an attacker guess the scheme if he intercepts several of your passwords and the scheme itself is very obvious, but hey, that's a whole world harder than learning a single password and using it to get a good part of your accounts. And I don't use the main scheme for accounts I don't give a damn about.

Re:How long

[hawkinspeter]

Whenever I've gone to a bank, they just wear suits and business clothes. Why is the wardrobe department involved with this? I'm confused.

Re:How long

[PopeRatzo]

All you need is any mapping you remember anyway. For me, that's ASCII codes, names of Doom2 levels, etc, but for you it could be for example episode names of Star Trek (bleh), or even, horrors, results of 1976 baseball league. Everyone has something of this kind.

ahem.

I'm not sure I do have "something of this kind", not being a sufferer of OCD. However, the idea intrigues.

What do you mean when you say "a scheme of turning the account/hostnames into the domain of your mapping". Can you give me an example? I'd like to try this.

Re:How long

[jamesh]

That prevents the re-use of your credentials, but doesn't stop a phishing site from grabbing them and using them there and then. And, given the idea of 'single sign-on', they could still do a lot of damage with a single authenticated session.

Don't get me wrong, two factor authentication is a good idea, it solves a lot of problems completely (eg if someone is stupid enough to give away their password), and minimizes many others. But man-in-the-middle attacks are not really very well addressed. The _only_ way I can think of for the second factor to completely solve all the problems is that if it is a device that you connect to the network, and it establishes a secure session between the end points, and that you enter your password into it. And i wouldn't be surprised if someone found a hole in that!

Re:How long

[MMC Monster]

Absolutely. I know the MSPassport IDs and passwords for a number of people I used to be close to. One of them is now actively hostile towards me. Should I use their ID/Password to do something illegitimate? Well, only if I'm pushed...

Re:How long

[twokay]

The thing, is its not just global authentication systems like this that ask you to put in your login details on multiple websites. Facebook, Flixster and i imagine some other social networks actually ASK you for your email address (or login name) and password so they can mine the contents of your contact list from the competing site or email provider, and use it to populate the list of contacts on their site.

This is madness, security conscious websites and people (like me) are trying to educate the average user to never ever give out their login details to a third party. This is made much harder when popular sites like social networks are actually asking their users to hand over information that should never be disclosed under any circumstances.

All that needs to happen is for someone to get spam advertising a fake social network and during the sign up process they are asked if they want to copy their contacts from their web mail account (gmail, hotmail, whatever) or other social network. They wont think twice because they have already been through the process when they created a Facebook account.

I couldn't believe it when i was asked to hand over my Gmail email address and password so that my contacts could be added to the Flixster account i was creating a little while ago!

Re:How long

[LiquidCoooled]

You are right.
Just sign into http://paypalhardware.com/ with your credentials and they will send one out to you :)

Re:How long

[mgblst]

Oh, ok, I guess everything is alright then. They have probably thought of all the problems, and everything will be fine, thanks macbort. How foolish of us to question something like this! Moron.

Re:How long

[Blakey Rat]

Screw that.

I don't care if it's Microsoft, Google, Apple, or some nerd's basement server, but please, please SOMEBODY make a single sign-on that sites actually use, so I can use it for casual things. I'm goddamned sick of every goddamned forum on the entire Internet asking me to create an account and sign in before doing crap. You can't even read comments on IMDB now without registering and making some moronic account.

I have thousands of petty little accounts on blogs, on news sites, on wikipedia and IMDB-- all with the same username/password combination. Single sign-on, PLEASE!

Re:How long

[Anonymous Coward]

Hi, I am on the IT staff at First Bank of Nigeria and we are opening up a location near you in California. I have a prototype of our new one-time password generator right here and can show you that it is truly trusted and random. The passwords that it generates cannot be guessed! Just look at the first four numbers it gave me...
97E31P
8L133N
P97C15
97E31P

Just sign in here with all of your information including name, address, SSN, account numbers, etc: nigeriabank.com/409

Re:How long

[KiloByte]

In the lack of such a data set, you can make it up on the spot. Factorizing numbers for one.
In fact, any http://en.wikipedia.org/wiki/Hash_function will work. I named ASCII codes and Doom2 levels because they're something I know by heart; I suck at factorizing so it would take me longer. And I don't want to ever spend more than 10 seconds trying to remember a password I didn't use for a while. This is not an issue for ones you type in frequently as they'll be "cached" in your fingers' memory, though.

Producing the input for your hash function can be trickier, though. In some cases like ASCII codes it's trivial -- take 3rd and 5th letter of the hostname, turn them to their ASCII codes, mangle the numbers somewhat and you're done -- like: hostname="flame" => 97, 101 => "!97a101a". The final rule was: prepend with '!'s to get three digits, add "a" for odd codes, "b" for even ones.

This particular scheme isn't too secure; it resembles one of my early ones. The weakness here is that someone who intercepts one or two of these can guess what to brute force, needing only 16-18 bits of work; it's obvious how to close this hole.

Now, while my passwords are not the ones you get from "pwgen -s", at least I can actually "remember" all of them without being superhuman.

Re:How long

[Gazzonyx]

Or if your bank is stupid and has something insecure on it's secure website. Wachovia's Secure Site has had a broken SSL login for ages, and I've told them about it. I also told them that the problem was probably just some insecure javascript or something to that effect, and pleaded that they'd forward it to their tech. staff who would immediately know what the problem was and how to fix it. I got a canned response and no action has been taken. Not sure what to do besides check the cert. every time I login.

Re:How long

[Anonymous Coward]

The problem with the single sign on is that anyone could create a semi-legitimate site that appears to use the Live ID login form. However, instead of authenticating through the MS servers, the form just captures the users information and allows them to enter the site. The "semi-legitimate" site now has a database of Live ID's for whatever use they can think up.

- Jason
BusinessHut

Re:How long

[Anonymous Coward]

That reminds me.. I work at a major security company. I got an email a few weeks ago with a @companyname.com email address telling me that I have two weeks to do this training test. The training Web site wanted my employee ID and some other information, and wasn't on our intranet (or even on our external site.. it was on a totally different server). It looked and smelled of a phishing attack. After looking into it, it wasn't -- it was just a normal, stupid email.

Re:How long

[tehcyder]

I'm not sure I do have "something of this kind", not being a sufferer of OCD

Ouch!

Re:How long

[swillden]

The _only_ way I can think of for the second factor to completely solve all the problems is that if it is a device that you connect to the network, and it establishes a secure session between the end points

Another way is to use a cryptographic challenge-response authentication, with the relying site's URL hashed into the challenge.

Since the relying site never actually receives the secret key used to create the response, phishing sites gain nothing useful when they prompt the user for authentication. And since the site the user is authenticating to is hashed into the challenge (by an authentication tool on the user's machine, not by the relying site), a response give to a phishing page will not provide access to the legitimate site it's pretending to be.

A more flexible way is the approach taken by OpenID: The relying site redirects you to your real authentication site (the one that provides the OpenID service, which may be a personal site) to enter your authentication credentials. The OpenID auth site then redirects you back to the relying site. Assuming you know enough to check the URL in the location bar, you can be sure that you're not giving your credentials to a phishing site.

Since a real relying site will always contact the OpenID provider directly, and give it the correct URL for the second redirect, a phishing site may initiate the process but will get cut out of the loop when the OpenID site redirects the user to the real site. At present, most OpenID implementations provide fairly weak security, but that's not an inherent weakness of the protocol.

Both of these approaches ultimately rely on the integrity of DNS, unfortunately, so they can be subverted by spoofing DNS. Fortunately, that's a much harder thing to do than to put up a phishing site and send spam to get users to visit it, so either option is a net security gain.

Re:How long

[Anonymous Coward]

But Google and Yahoo have better programmers!

Re:How long

[jasen666]

Still... if you've got a way around this that is truly idiot proof, I'd like to hear it!

I've been thinking about it. My idea is that you would install an activeX control or java applet from MS. Websites that want to log you into your Live account would invoke this applet, which does all of the authentication client side, then returns only a token back to the website that called it. That token would contain only whatever information was deemed appropriate for them to have or need.

Of course nothing is fool proof. I'm sure the attack vector they'd use to try and break this scheme is to try to distribute fake applets, that don't really authenticate you, just report back your login info.

Re:How long

[cpu88]

Now, with banks like HSBC use 2 ways authentication. In addition to original web password, customers are given a key generator and they are required to enter the key shown in that generator each time when they login. They need to have computer expert and robbing expert now.

Re:How long

[dmpyron]

Yes. In fact, most sites are still stuck in the mid 90s

What do you propose they do, send out SecureID tokens to all of their users? Here's a neat trick. Set up a phishing site for a bank that does use SecureID. Ask for the code, then hang for two minutes and come back with "there was an error processing your request, please re-enter your data". So I put in my code a second time, this time it's a new number. You now have two numbers and two time stamps. From this, the future numbers can be calculated. There are several calculators out there that will do this for you. It's one of the security world's dirty little secrets.

Re:How long

[SgtChaireBourne]

Nice strawman. WLID (formerly known as MS Passport) is not just any random piece of shit. It's a piece of shit being marketed as a core security component -- authentication. So, no, in answer to your question. Sure some things were "fixed" but the fundamental design flaws remain.

Furthermore, since M$ still maintains a monopoly on desktop systems and has been found on many occasions to have been illegally leveraging that monopoly to break into a new market, the risk of WLID spreading is actually rather high. If the stats at NetCraft are anything close to reliable, then M$ would be able to leverage the IIS install base.

Re:How long

[swillden]

Sorry to reply to myself, but I just noticed that I described OpenID inaccurately. The relying site does not give the redirect_to URL to the OpenID site directly, the user's browser does. However, the data block passed back to the relying site by the OpenID site contains the redirect_to URL, signed by that shared secret. So a phishing site can't play man-in-the-middle with your bank and your OpenID provider, because the phishing site can't alter the redirect_to URL without invalidating the signature and the bank won't accept the authentication with an invalid signature.

Re:How long

[Anonymous Coward]

informative? hahahahaha
jackass mod!

Re:How long

[pe1chl]

Interesting to see that it works that way in your country.
Over here, the banks are a little more security-aware, and they also want to keep up the image that the security is good, so when bad things happen they cover the cost for the customer.

Recent example: a few hundred shop customers got ripped because someone modified a PIN terminal to copy all magstripe data and used a security camera to capture the entered pincodes. This is an example where multifactor authentication is not yet used, and a weak security system is in place. The customers got reimbursed.

Banks don't want a publicity story that tells that security is weak and the customer will be the victim. It would cause a loss of confidence in the system that they make their money from.

Re:How long

[_anomaly_]

Yeah, really. Informative?
Someone REALLY missed your joke. It's a shame, too; it was a good one.

Re:How long

[ady1]

Can't find the username and password fields on the web page. Should I email it to you instead?

Re:How long

[Adhemar82]

All banks in the Netherlands (as far as I know) use some form of strong user authentication for doing online banking. My bank currently uses Vasco's Digipass 810.

After coming to the US, I was surprised (and a little worried) to find out, upon opening an account at Wells Fargo, that all I need to log in is a plain old username/password combination. Are there no banks in the US that use some kind of more advanced authentication system?

Re:How long

[AnyoneEB]

Single sign-on is possible, you just have to stop with the bad idea that logging in gives the server enough information to impersonate you. Some sort of public key auth like SSH uses makes much more sense. It has the minor privacy downside that if you use the same key everywhere, then your identities could be linked together for data mining, but that can be trivially worked around by having multiple keys, just like people use multiple usernames to avoid that now.

Man-in-the-middle attacks are a serious concern. Of course, HTTPS handles them, so we are only talking about unencrypted HTTP. As far as I can tell, any HTTP-only auth mechanism existing can be trivially attacked with a man-in-the-middle attack. SSH handles them by showing the user the server fingerprint and leaving it up to the user to confirm it. Realistically for web auth, server keys would have to either be validated the way they are now, by CAs + auth over HTTPS, or via web of trust which could be used for a more flexible auth mechanism.

Two separate projects exist for making OpenPGP based HTTP auth systems: enigform (and mod_auth_openpgp) and gpgAuth.

OpenID is also a good idea because it moves the authentication process away from the server being logged into. Eliminating the entire problem, although likely adding others.

Re:How long

[pabs]

It's a pity that OpenID somehow doesn't take off as many expected and I don't think a Microsoft solution will either. Google comes to mind as one company that could probably do it successfully.

There are plenty of OpenID providers at this point; it's just a matter of getting more OpenID consumers now. Firefox is planning on adding native OpenID support real soon now, and I wouldn't be the least bit surprised if Google picks up on it as well. Yahoo is promoting their own account instead, although you can use your Yahoo! ID as an OpenID identity via idproxy.net.

Of course, none of this means that OpenID is guaranteed to become the ubiquitous identity standard, but it's not exactly dead in the water either.

Re:How long

[rtb61]

The other case is people who are sick of the privacy invasive of search engine cookies block them, in terms of M$ Live, that means all M$ sites are then blocked, who will break first the user or M$ or in this case anybody silly enough to sign up with M$ Live.

Not to pick on any company in particular, but the whole corporate privacy invasion, targeted marketing, we know who you are, we know what you eat, we know how many times a day your scratch your arse, thing has just gotten out of control.

Respecting the customers wishes, will be the big focus, not delusions about the B$ effectiveness of targeted marketing, all that targeted marketing is doing is pissing customers off and targeting their anger at those who would target their marketing at them.

Re:How long

[PopeRatzo]

I was just playing, tehcyder. Of course, you don't have to OCD to know all the ASCII codes and DOOM levels by heart.

But it helps.

I don't want to hurt the feelings of OCD sufferers. They keep the world running. By touching the door frame three times before passing through and washing their hands every 21 minutes.

Pope Ratzo posting anonymously

Re:How long

[Ungrounded Lightning]

The website has nothing to do with the bank, the addresses are not the bank ones, but none the less the consumer enters their credentials. As a results of many years of brainwashing by direct marketeers they now consider all this to be "business as usual".

Also as a result of years of outsourcing, where banks, hospitals, and others would hire third-parties to handle portions of their genuine business.

For instance: My company's medical insurance company hired a third-party to administer inquiring whether certain medical treatments - such as hernia and joint operations - were the result of work-related injuries for which they could recover from the workspace-injury insurance company. The inquiry form came in an envelope with the insurance company's logo on the return address but with size, color, size of envelope, and quality of paper slightly off, etc.

Phishing?

[FliesLikeABrick]

What keeps anyone from creating a site (and/or spamming for it), saying it uses Windows Live authentication, then just farming a giant pile of logins they can sell or use for evil things?

Re:Phishing?

[Anonymous Coward]

Whats to prevent them from doing it right now, without the release of the system by Microsoft? I can already create a fake Google account, Live, or numerous other login systems on any website I own, it is ultimately up to the user to beware.

Re:Phishing?

[FliesLikeABrick]

Yeah but then you'll only get morons. Now people have a reason to believe that it is real

Re:Phishing?

[Anonymous Coward]

Do you honestly believe that the majority of people who actually use LiveID will actually know, or care that this is being opened up by Microsoft? Come on, the 95% of Joe Public who don't read /. won't know either way, so the chances of them being duped by a fake site before and after is exactly the same.

Re:Phishing?

[blowdart]

That's one of the major criticisms against OpenID as well of course. Consider how you login to Open ID, you give the provider details away, it's up to the web site you're trying to log into to bounce you to your OpenID site, and it can just as easily bounce you to a phishing site. That's one reason why some OpenID providers are starting to use Information Cards for logins, side by side with the username and password boxes.

Re:Phishing?

[Anonymous Coward]

What about a 2-part authentication?

You enter your username and press a button...
The site/server replies with a "secret" phrase or image that you set up in your account.
If the phrase/image matches what you expect to see, you enter your password knowing all is well.

Just an idea.

- Jason
BusinessHut

Re:Phishing?

[jamiet]

The sites leveraging Live ID Auth never get to know the email address of the people logging in. They get a single (meaningless) identifier that uniquely identifies that person on that site and nothing else. Does that answer the Q? or have I stupidly misunderstood?

Re:Phishing?

[Anonymous Coward]

One of my credit card companies does this, and I don't understand what the purpose is. Why couldn't the phisher just MITM the special phrase or graphic?

1. I enter my username at the phisher site.
2. The phisher site sends the username to the real site, and reads the special phrase/graphic
3. The phisher site presents the special phrase/graphic to me.
4. I think all is well, and enter my password.

Re:Phishing?

[vawarayer]

We have IE7 anti-phising bar to the rescue!

Re:So what?

[pembo13]

They changed the name

No License?

[originalhack]

Great... it's copyrighted and provides no license.

Re:No License?

[QuantumG]

Yup, grab the php package, you will see:

Copyright (c) 2007 Microsoft Corporation. All Rights Reserved.

and yeah, no license. So I guess implicitly you're not allowed to redistribute it at all.

Typical MS!

[rts008]

Solution looking for a problem.

With so many security and authentication issues inherent to MS products, this seems another case of marketing pushing faster/harder than the development teams can keep up with.

If it backfires for them, look for flying chairs...*ducks*.

Re:Typical MS!

[Anonymous Coward]

hate to throw water on your hate filled fire. But this most definitely is a problem that needs a good solution, whether live ID will do the job is another question. MS security record also for the last 3 or 4 years has actually been pretty good, but that is another topic.

Re:Typical MS!

[a.d.trick]

Actually, single sign-on can be pretty cool. This is more a bad case of NIH than a solution for a non-problem. OpenID is already out there, it's supported by many sites/software, it works, and it as a second killer feature: it's decentralized. Forcing lame copies of existing standards is pretty typical MS too (see OpenDocument vs OOXML).

Re:So what?

[kimvette]

Like the diebold voting booths? ;)

It's much easier than that

[QuantumG]

Go to Hotmail. You will see that Hotmail now requires you to login with Windows Live ID. Now, take a look at this page. It's a login page. They want you to enter your ID and your password. This is what gives you access to all the different services that are currently integrated with Windows Live ID, and will be integrated in the future. It's basically your "master password". Thing I'm trying to stress here: you shouldn't just give this out to anyone who asks. Ok, you get the idea.

So, first check you should do whenever you're logging into a page is what? That's right, check the url. "http://login.live.com/login.srf?wa=wsignin1.0&rps nv=10&c...." etc. Great, login.live.com, that's what I expect. Cool. Ok, so what's the second thing I should check? Anyone? Come on, it's web password security 101 here people. What do I need to check before I enter a login/password on a web site? That's right.. I need to check I'm on an SSL secured page. The url should start with what? https right? And I should look for the little lock in my browser window.. and if I'm feeling especially paranoid I should check the security certificate to see whether or not it is valid, not expired, and for the site that I am expecting.

This page has none of those things. Well done Microsoft.

Oh, but it gets better. There's this link that says "Use enhanced security". I would have thought that "enhanced" security was a sensible default, silly me. It's not underlined, so you don't know it is a link until you hover your mouse over it, but it will take you to a https:/// page. Of course, the certificate it offers you is not for login.live.com, it's for graphics.hotmail.com. If you accept this certificate then you are basically saying that you're ok with trusting this data that didn't come from graphics.hotmail.com as if it did come from graphics.hotmail.com. Just for the hell of it, let's fire up this "enhanced security" page in IE and see what happens. Oh.. I see. We get no warnings. In fact, if we double click on the padlock we see that the certificate now IS for live.login.com. Hmm, what's going on here. Ahh, I see, half the content on this page didn't come from live.login.com, it came from graphics.hotmail.com.. so this isn't a secure site *at all*, it's a mixed domain site and IE's pitiful support for multiple certificates on a single page is happy to just ignore this (and doesn't even warn you).

XSS anyone?

Re:It's much easier than that

[Anonymous Coward]

So, first check you should do whenever you're logging into a page is what? That's right, check the url. "http://login.live.com/login.srf?wa=wsignin1.0&rps nv=10&c...."

No, checking the URL is not enough, that's how how those paypal scams work. ENTERING the url is what you should do. The URL-bar can be faked, as can the padlock (or you could just by a certificate from one of those companies that can't be trusted, like Verisign).

Re:It's much easier than that

[discHead]

You forgot the part about keeping a sharply-peeled eye and making sure you are being served by live.com and not 1ive.com (with a numeral 1).

Re:It's much easier than that

[atamyrat]

I would have thought that "enhanced" security was a sensible default, silly me. It's not underlined, so you don't know it is a link until you hover your mouse over it, but it will take you to a https:/// [https] page. I clicked that link, it sends to http://mail.live.com/default.aspx&id=64855&bk=2752 0536 and guess what? 404 - The page cannot be found. lol

Re:It's much easier than that

[AndrewNeo]

Unfortunately going to hotmail.com moves you to login.live.com and then back.

Re:It's much easier than that

[shutdown -p now]

You're a moron. How the hell did this idiot get modded up? Seriously?? The page you were served is http. The page you will post to for the login session https.

He's not saying that it doesn't use SSL to log in. He's saying that, as a user, he has no way to find it out until after he clicks "Submit" (and no, checking the HTML source code is not a serious option to consider). The convention for such things is that you use secure connection for the login form as well, so that the browser can indicate that it is secure (padlock icon, green or yellow address bar, etc - depends on the browser, but IE, Firefox and Opera all have such indicators).

Re:It's much easier than that

[toetagger1]

Who cares about how it is implemented, if the end user has no way of telling if it is secure or not? You can't require the user to check the source code to verify the implementation of how the information is posted.

Re:It's much easier than that

[Delirium Tremens]

Actually, login.live.com is a very bad name.
It is full of L, I and O letters which can be easily replaced by ones and zeroes to create look-a-like URLs.

Re:It's much easier than that

[can.i.have.free.beer]

So you are suggesting that anyone who wants to authenticate a username and password should invest in a certificate? And everyone who wants to support authentication should serve any page with a login box over https?

Funny... Slashdot doesn't even work that way...

I get modded down for presenting the facts. Parent gets modded up because he makes a hyperbole laced rant that bashes Microsoft and is completely wrong and utterly nonsensical. Man... I love this place.

Re:It's much easier than that

[Anonymous Coward]

Don't forget javascript. If the login page is on someone else's domain, they could load a JS file that can read your login as you type it and send it (via XMLHTTPRequest or otherwise) back to them.

Re:It's much easier than that

[vawarayer]

Ok. Smart. But you forget about the zillions of users that are not that computer-savvy. Thousands of customer on facebook.com - what do they ask to register? You got it! Your hotmail/yahoo/etc user and password. (yes, i know you can register without it, but I bet most don't)

Re:It's much easier than that

[QuantumG]

In this case, it is Microsoft who isn't security-savvy, and they're asking people to trust them with logins.

Got it backwards.

[twitter]

before semi-intelligent people weren't going to enter their passport ID into non-MS websites, but now... I bet a lot more corporate keys get exposed this way as passport is the keys to your Enterprise Licensing kingdom.

Hmmm, massive FUD has much inertia. First, intelligent people have known for a long time not to trust M$ with anything. This has harmed the online economy, but that's a different story. If the 25% prevalence of keyloggers is not enough, a rogue site has been able to harvest Passport IDs forever, because IE can be resized, reshaped and made to look like whatever the rogue site wants it to. Firefox puts a stop to menu hiding and resizes, but Mozilla.org can't save you from a key logger.

Re:Got it backwards.

[Anonymous Coward]

First, intelligent people have known for a long time not to trust M$ with anything. But intelligent people - or at least the non-aspergers ones that can hold a grown-up conversation - don't write 'M$'.

Now we can all use Windows security - via the web!

[greenguy]

There's no possible way anything could go wrong with this plan.

just read the ToU

[Karma Sucks]

The ToU is on the downloads page: https://msm.live.com/app/tou.aspx

Re:just read the ToU

[QuantumG]

The terms of use don't say anything about the copyright on the sample code. In fact, they don't say anything about the sample code at all.

Re:just read the ToU

[Karma Sucks]

Probably the intent is to be liberal. As long as you are not breaking the law or have malicious intent, you are free to use it as you wish. If you raise the issue perhaps they can make this clearer, there seem to be a lot of venues for feedback including a dedicated forum. *shrugs*

Re:just read the ToU

[QuantumG]

The point (which I think was obvious to everyone) is that Microsoft, a multi-billion dollar corporation, should know what they're doing and not need "feedback" to tell them that they should provide license terms with sample code.

Re:just read the ToU

[Karma Sucks]

That's what happen when you try to do open source... *lol*

Seems like even the lawyers get confused by the whole copyright/license thing when it comes to open source.

Re:just read the ToU

[QuantumG]

Lawyers get confused by copyright. period.

Copyright is intentionally designed that way.

Re:just read the ToU

[Anonymous Coward]

Probably the intent is to be liberal. As long as you are not breaking the law or have malicious intent, you are free to use it as you wish.

As long as I'm not breaking the law, I'm free to give cracked copies of Windows Vista Ultimate to all my friends, and all their friends.

Unfortunately, doing so IS breaking the law. Copyright law.

In most places, copyright law forbids not only distribution, but also modification. Like, modifying the example code to be usable in a real world situation, and integrating it in ones web application. The license is what allows this. But in this case there is no such license.

Re:just read the ToU

[wvmarle]

In most places, copyright law forbids not only distribution, but also modification. Like, modifying the example code to be usable in a real world situation, and integrating it in ones web application. The license is what allows this. But in this case there is no such license.

Copyright as such does not forbid modification. Does not forbid anything other than (re)publishing or distributing the work in question. That the USA and some other countries have laws like the DMCA has nothing to do with basic copyright.

If you buy a book, no-one will forbid you to tear it to pieces, use the letters to create another book, etc. But you're not allowed to copy it. However you can sell it, in whole or in pieces (if anyone would like to buy it as such).

Re-using part of the code in a web application is a grey area: as long as the code runs on your server only, you do not redistribute it. But you do make use of other people's code. And whether that is allowed or not, will depend on the exact interpretation of copyright in your neck of the woods.

Re:just read the ToU

[killjoe]

Wow MS lawyers don't understand software licensing. How cool is that!

Re:just read the ToU

[Anonymous Coward]

Well at least there's no room for confusion...

"3. How You May Use the Service.

In using the service, you will:

        * obey the law; "

Which laws? US laws? Canadian laws (I'm in Canada)? ... MS laws?!

Article placement

[Infonaut]

Is it just me, or does placing this article directly above the Diebold rebranding article make you think of a theme common to both? Company loses credibility. Keeps trying to regain it, but still doesn't grok that you can't just make it *look* like you've changed your spots. You actually have to change your behavior, and regaining credibility takes a lot longer than destroying it does.

Re:Article placement

[Anonymous Coward]

Is it just me, or does placing this article directly above the Diebold rebranding article make you think of a theme common to both? It's just you. Slashdot editors aren't nearly clever enough to send an anti-MS message through article placement. Besides, why would they need to be devious about it? You won't find anything resembling a neutral MS opinion on this site. They dont try to hide their bias.

Re:Article placement

[violet16]

you can't just make it *look* like you've changed your spots. You actually have to change your behavior, and regaining credibility takes a lot longer than destroying it does.

Only to people who pay attention.

You noticed this because it's tech. You don't notice most of the thousands of times it happens elsewhere.

CardSpace?

[ZSO]

Does this mean they've given up on CardSpace, which is built into Vista right now? I thought it was a much better solution to the need for single sign-on. Check out thechannel9 video.

Re:CardSpace?

[Shados]

Different purposes. CardSpace, part of .NET 3.0 and up, is made as a way to authenticate and share data on a site by site basis, as opposed to the central system of Live ID. One could say Cardspace is a "mini-LifeID" thing, so to speak. Still quite useful if implemented right.

Re:CardSpace?

[blowdart]

No. Especially as you're now able to associate an unmanaged card with your Live Login, and use that instead of the password. But it's a different solution, CardSpace is not single sign-on, LiveID is.

Re:CardSpace?

[RupW]

Does this mean they've given up on CardSpace, which is built into Vista right now? I thought it was a much better solution to the need for single sign-on. Check out thechannel9 video. If you try the login link in the sample - which redirects you back to 'localhost' when you've signed in - it says:

Windows Live is not affiliated with localhost and will share with it only an anonymous ID. Learn more. For additional protection, you may use an Information Card.

(a.k.a. Cardspace)

AFAICT from the docs and the code they've just released, there's no way for a third party to get any information about you from Live (e.g. email, name) even if you want to give it to them to speed up sign-up for example. Cardspace does allow that, configurable by the user, and so is the better solution for both you and the third party sites anyway. In fact the login page doesn't look very professional to me - the sort of thing you'd use on your blog maybe but not on your ecommerce site.

Uh, what?

[misleb]

I thought Passport was outted years ago as being fundamentally broken. Why would I want to implement it on my site? Did they fix it? If not, why are they still using it at all?

-matthew

Re:Uh, what?

[QuantumG]

They forced all the hotmail users and all the xbox users and all the other users of Microsoft services to sign up, so they figure they've got a nice big market share now.

Re:Uh, what?

[Blakey Rat]

It's simply impossible that Microsoft has recognized and fixed the problems it had years ago, eh?

Of course, since you didn't provide a source, and I have no idea what problem you believe needs fixing, I have no way of checking.

Re:Uh, what?

[Anonymous Coward]

World Domination 2.0?

OpenID

[jediknil]

I'd prefer to see the rise of OpenID. Now if Microsoft gave you an OpenID authentication point with your LiveID (preferably with something simple, like adding the OpenID <link> tags to login.live.com or even just live.com), that would be a feature worth using and supporting. And wouldn't require changing the sites that already support OpenID, including, AFAIK, the SixApart family of blogs.

With modern technology, diverse applications are a good thing (healthier market and better apps from consumer selection). Information, however, is more useful the more widely it can be read and used. Unless you are specifically trying to hide something.

Unfortunately, like Live ID, there seems to be more OpenID providers than servers that use them for authentication.

Re:OpenID

[Twigmon]

Agree completely! OpenID really is a very nice system. I use it for my client's web sites.

For those who do not think that there is much of a market for this sort of thing: there is.

I develop sites that require authentication frequently. If web surfers have to remember a username/password combo for too many sites, they will have to just use the same user/password, write them down, or just give up on accessing the resource. Once a user/pass is compromised - they then have to go and change it for every single site that they have registered with. Pain in the butt..

With openid authentication you just have to change it once. The chance of the user/pass being compromised is reduced because it is only stored in the one place. The password request field is on a page that you *know* and often - can customise. Phishing is not going to be anywhere near as easy with a distributed authentication system - each openid provider has a different looking authentication page.

Re:OpenID

[SolitaryMan]

It is worth noting, that OpenID is a decentralized system, so you don't have to depend on single ID provider.

Re:OpenID

[aichpvee]

Wouldn't it be just as easy to phish if the page could look like anything as if the page always looked the same?

Re:OpenID

[shish]

From a brief look, it seems considerably easier to implement and run; for clients, servers, and end users. I've had OpenID support on my webapp to-do list for months, and I'm considering implementing this in an afternoon. However, the fundemental design is worse :-/

OpenID could really do with a for-dummies API...

Re:OpenID

[4thAce]

I hope that it could be one of the supported URL-based identity protocols under Yadis too.

Rich

Re:OpenID

[ttnb]

Wouldn't it be just as easy to phish if the page could look like anything as if the page always looked the same?

No. When the login page looks different for different people, the likelihood of any given phishing attack succeeding becomes much smaller whenever the attacker guesses wrong about how a user's login page is supposed to look like. Mass-phishing attacks therefore become much more difficult to execute because the attacker would need a way to not only contact a large number of people with a message containing a link, but in addition the attacker would need to determine for all these potential victims what their login pages are supposed to look like.

Re:OpenID

[Anonymous Coward]

I've had OpenID support on my webapp to-do list for months, and I'm considering implementing this in an afternoon.

OpenID is incredibly simple as a consumer. I implemented it in an hour or two despite having no prior knowledge of OpenID. I don't know what's scared you off, but why don't you actually try to implement it before telling everybody how difficult it is?

Re:OpenID

[RupW]

However, the fundemental design is worse :-/ What's wrong with the design? It's very paranoid - *only* hands out a unique ID, and they're unique per site logged into.

The only real problems I see are that the user experience doesn't look professional ("Windows Live is not affiliated with FooBarCorp and will share with it only an anonymous ID. Learn more. For additional protection, you may use an Information Card.") and, OK, it's a centralised target for phishing. (But so's any SSO.) Was that what you meant, or did you have other concerns?

Re:OpenID

[Blakey Rat]

People might actually recognize and use this, and nobody uses OpenID?

Just a guess.

Re:OpenID

[shish]

What's wrong with the design? It's a centralised system -- if microsoft were ever to stop running the service, or it were to go down, or be hacked, or were to require some form of payment / non-free licencing to use it, we'd all be screwed.

Re:OpenID

[a.d.trick]

Last time I checked, SixApart hadn't quite got the OpenID thing going; however there are many other people involved, some of who are much larger than them. AOL is the classic example (they openid.aol.com/username). There are gads of smaller independent websites and providers.

Oddly enough, Microsoft even promised to support OpenID, we'll see how that one panes out, but don't hold you breath, you might asphyxiate.

Re:OpenID

[swillden]

I've had OpenID support on my webapp to-do list for months

Why? The consumer side of OpenID is very simple to implement. Not only that, if your webapp is built in PHP, Perl, C++, Java, Python, Ruby, C# or ColdFusion, there are libraries available that you can just drop in to handle it for you. Also, if you happen to use Plone or Drupal, OpenID support has already been added to your framework.

Re:OpenID

[aichpvee]

Phishing is not going to be anywhere near as easy with a distributed authentication system - each openid provider has a different looking authentication page.

Yes, having the authentication pages doesn't make it any harder to run a phishing scam. The customization part is completely different from whether or not their authentication pages looking different, and might be of some use. Though then you have to remember what pictures or phrases or whatever you picked for each site.

In my experience with this kind of thing there are a limited selection of pictures that if picked at random by a malicious site would still get them right for enough people that it would be a problem, and when they have phrases or something I tend to ignore it just like I do all the other text that isn't/doesn't appear important. I assume (and I'm sure there are studies to back this up) that most people also ignore similar unformation (like information, but not informing of anything). The usefulness of these tactics in stopping people who are susceptible to this kind of scam from getting caught in it are fairly low and for everyone else it'll just range from being an annoyance (setting these things up can be really annoying the way some site implement them) to just being something that they ignore.

The real problem is that everyone is looking for some kind of a magic bullet to save us from idiots, but no one is willing to say that what we really need is to educate those who can be educated and stop those who can't from getting near anything if it could affect anyone else.

I had to get Passport for my job

[MichaelCrawford]

I was working for a Windows shop a while back, and there was a Microsoft road show coming to town showing off Visual Studio 2005 and the new SQL Server. The boss wanted us all to go, but to attend we had to register at some Microsoft web page.

Part of the registration process was that I was required to get a Passport ID. I felt like I'd just sold my soul to The Devil just to get a paycheck.

Re:I had to get Passport for my job

[Anonymous Coward]

I felt like I'd just sold my soul to The Devil just to get a paycheck.

You only felt like you'd sold your soul?

Re:I had to get Passport for my job

[misleb]

Part of the registration process was that I was required to get a Passport ID. I felt like I'd just sold my soul to The Devil just to get a paycheck.

Well, you WERE working for a Windows shop, so I think you had that much covered before you even got the Passport ID. :-P

-matthew

My old single sign-on method

[ls671]

I use 3 passwords for all sites I access mapping to 3 levels of trust. I try to use the same user id when possible :

Level 1 : risky

Level 2 : less risky

Level 3 : almost trustable

For sites that I really trust (banking, etc...) I use dedicated passwords. I, also, can forecast problems with a single sign-on scheme that would be more or less like giving away your social security number if hacked.

I have been working on this problematic before for big organizations and one conclusion we came up with was that we needed to re-use the old assembly language "indirection" principle, called pointers in higher level languages.

So basically, one has to be able to authenticate with multiples set of usernames/passwords combinations. Once the unique user is authenticated, the central authentication authority limits its role to just that, authenticating the user.

All authorization is managed by the local system that interacts with the user.

Do a search for MBUN on Google. In Canada, a user can have multiple MBUNs to deal with the government. This solution was implemented to cope with privacy concerns and still allow the citizen to deal with the government with the same level of privacy that was previously achieved with paper forms. Basically, what has been done is creating a mapping between the MBUN and the real userid and the choice has been given the citizen to have as many MBUN as he wishes to deal with the government.

Serious concerns should apply to too simplistic solutions ;-) Now for all /. MS bashers to enjoy : Although a qualified partner in the project, none of MS products where used to implement the solution. Given the money and the visibility at stakes, this caused a commotion in Canada with MS canadian VP putting pressure on everybody to reverse the decision.

Hey Sam, your products are just too simplistic and too proprietary. Phone us next year please ;-) That was really funny, the guy just couldn't understand that Macdonald's like marketing techniques did not work in this case. I mean, they even flew us for a week to Redmond at the campus to try to brainwash us, but still no go for MS.

-ls

Re:My old single sign-on method

[Anonymous Coward]

Unfortunately, this can be trivially broken as described in the following presentation about OpenID security

Re:My old single sign-on method

[ls671]

Unfortunately, this can be trivially broken as described in the following presentation about OpenID security

I had a quick look, interesting. So if I understand, trivially means that slashdot would just have to refuse my login to cause me to enter my bank userid/password on slashdot in desperation to login into slashdot ?

Maybe I am missing the point.

As a rule of thumb, nothing is 100% hack proof and secure. I posted another follow-up where I mention client-cert (or at least a pair of private/public keys) is the closest thing to reliable single-signon. I mean, isn't it already used to authenticate reliably the sender of an email ?? It will work just as fine authenticating web users.

Here is how it would work :

1 ) Web site sends you a random phrase or a random series of chars.

2 ) You sign that phrase with your private key ( kept only on your computer or on some usb key and generated locally by yourself) then, you send it back to the web server.

3 ) Web server authenticate you by verifying the signature with the help of your public key.

4 ) Note that you don't even need encryption.

So why isn't this implemented yet for mister Joe Citizen ? I don't know for sure but I guess certificate and key management could be a factor. Note that this method of authentication is already widely used in big organizations that really need serious authentication. Unfortunately, PKI compagnies charge way to much for that. Maybe that is why things don't change, they just want to keep on charging the big $ for certificates. Making the technology widely available to citizen at reasonable prices might make it harder for them to justify charging the big $ to corporation. As I said, I don't know for sure ;-(

The beauty of this is that each machine/user has its own private key generated LOCALLY. If a given machine/user private key is compromised. It doesn't affect other machines/users. PKI has been around for a while you know ;-)

-ls

OpenID

[AceJohnny]

and how this compare to OpenID ? (See also OpenID Enabled for those interested in using it)

There is something I'm not understanding

[bob8766]

What makes LiveID different from Passport or other auth systems? I'd like a way to sign in to multiple sites without having to remember and type a username and login for each one, but so far every solution for the problem has been widely rejected. What are the limitations with these single sign-ons that cause sites to prefer rolling their own logins?

Re:There is something I'm not understanding

[Paradigm_Complex]

Microsoft has announced the release of Windows Live ID Web Authentication. This means that WLID (formerly known as Passport) is now opened to third party websites to use as their authentication system I know reading the article is cheating, but at least read the first two sentences of the summery. It isn't different from Passport at all. OpenID (http://en.wikipedia.org/wiki/OpenID), on the other hand, is a different story.

Re:There is something I'm not understanding

[bob8766]

Ok, so I'm not smoking crack. I was thinking that they may have done something different in this version of passport to somehow make it better, but it appears to be just a renamed version of the same thing.

Oh no, not again!

[Anonymous Coward]

Isn't this the same system that got cracked a few years back, when someone called a high-level M$ executive and said, "Mr. So-and-so, your home address is X, your social security number is y," and so on?

Microsoft is a cancer...and FOSS is the cure.

Re:Oh no, not again!

[Anonymous Coward]

No it's not. Because Passport/Live has never had your SSIN. But hey, way to make something up there.

Re:So what?

[Warbothong]

Because MSN Messenger comes with most desktop computers, masses of people use the MSN thus making its closed system attractive for other people to join, new computers usually come with an "MSN Browser" on the desktop, most desktops come with Hotmail and other MSN bookmarks filling their bundled browser, MSN is often the homepage of these bundled browsers, the bundled media player has MSN built into it, etc. People might not like it, but it is forced down their throats anyway, and once that's been done most people won't go through the hasle of using an alternative.

100% offtopic

[arnott]

According to wikinews, Richard Stallman is missing after the earthquake in Peru, anyone know anything ?

System Requirements

[iovar]

From: http://www.microsoft.com/downloads/details.aspx?Fa milyId=8BA187E5-3630-437D-AFDF-59AB699A483D&displa ylang=en

Supported Operating Systems: Linux; Windows Vista; Windows XP
How's the wheather in hell these days?

Re:System Requirements

[skeeto]

Supported Operating Systems: Linux; Windows Vista; Windows XP

Start wearing a helmet when going outside. I imagine pig droppings are pretty heavy.

Re:System Requirements

[rupert0]

frozen....

Re:System Requirements

[RAMMS EIN]

``Supported Operating Systems: Linux; Windows Vista; Windows XP'' ...and that's it. No BSD, no OS X, ...

They still don't Get It.

Re:System Requirements

[RAMMS EIN]

``Supported Operating Systems: Linux; Windows Vista; Windows XP''

A Microsoft spokesperson was quoted as saying:

Linux has always been our ally.
We have always been at war with the Mac.

Love that Ruby.

[kwabbles]

Looks pretty.

Re:Love that Ruby.

[August Lilleaas]

We have a lot to learn from Microsoft about they enterprisey-ness. They do, for instance, use XML instead of yaml. And they violate DRY, that's important too! Look at User#baseurl and User#secureurl. And also the way they do User#getLoginUrl and User#getAppVerifier. No way they'll create a method to make get parameters for urls, we do that by hand every time. This:

def niceCamelCasedUrlMethod(options = {})
options.map {|key, value| "#{key}=#{value}" }.join("&")
end

Would have been way to clean.

Re:Love that Ruby.

[Karma Sucks]

What's with the nitpicking, that Ruby is sweet!

Why am I not convinced?

[mporcheron]

Well, it will inherit Microsoft's stellar security and perfect programming. Besides which, its a closed network unlike OpenID so it will be about as popular as Google's Account Authentication which does the same thing but with Google Accounts. Even OpenID isn't that widely used, and it's an open system.

Re:Why am I not convinced?

[RegularFry]

You're forgetting that, unlike OpenID, Passport already has a huge number of users. It stands a good chance of winning by default.

MS changing tactics

[high_rolla]

Putting the discussion on whether this is a good idea or not aside (you guys have already discussed that quite a bit), it's interesting to see how they are going about deploying this. I'm sure if they were doing this a few years back they would have provided sample code for MS sites and left the others to come up with their own implementations. It's interesting to see that more and more they are leaving their MS lock in tactics behind.

This is bad news

[CopaceticOpus]

The worst possible things that could happen for widespread adoption of a universal login system are:

1. Competition between different standards.
2. Companies with profit motives pushing their own solutions.

It's like the whole HD-DVD vs BluRay issue. End users don't want to deal with choosing one or the other. It would be better for everyone if we could all just come together around one completely open standard.

The standard with the most momentum seems to be OpenID. I hope that a few years from now, I'll be using it for most of my web logins.

Re:This is bad news

[RupW]

The standard with the most momentum seems to be OpenID. I hope that a few years from now, I'll be using it for most of my web logins. This is solving a different problem, though - it's a lightweight SSO.

Microsoft are collaborating with OpenID on support for Information Cards (a.k.a. Cardspace).

Intentions & assumptions don't count in court.

[cheros]

Given the nature of the Beast it would not extravagant not to make assumptions other than expecting worst case..

Why?

[PietjeJantje]

Why on earth would I want to, of all things, authenticate using a 3rd party propriety system from a vendor with proven business practices like MS? That seems like the very last thing I want to do. And I haven't even mentioned the outages, so your uptime depends on MS. What are you gonna do when that happens, call them? I have a much better idea, Bill. Why don't you use my unified login system. I've made a version in Visual Basic especially for you.

all these (non-)answers and

[Joseph_Daniel_Zukige]

I'm having trouble believing you got so many responses defending single-sign-on.

The safest way to do single-sign-on is like Apple does it. (And I think there is a similar GNU tool with gpg?) You have a password that unlocks your keychain, and the keychain software negotiates with the sites you visit. Theoretically, the keychain software doesn't miss red flags, such as sites requesting keys/passwords that don't belong to them.

The problem with keychains is that they fall when your login account falls. Well, the tokens may be stored encrypted, and the user may be smart enough to have a separate password on the keychain, but all it takes is a well-hidden keylogger. I'm pretty sure no one is handling the issues that allow hidden keyloggers to be left lying around as long as we are browsing the web with the same effective user that we logged in as.

Single-sign-on is just plain wrong for any information that could hurt you if the wrong people get it.

Even a separate hardware token keychain which connects "directly" to the internet (instead of through your general-purpose PC) has to somehow deal with the man-in-the-middle. General purpose keys are a bad idea.

Can't believe I missed the most important part

[Joseph_Daniel_Zukige]

Apple's keychain is managed on your local machine, as opposed to being managed by a large corporation that wants to sell people on the idea that they can handle all the "hard" problems to day-to-day living.

Was Gore party to Clinton and Gates suggestion that the internet could lead to "frictionless money" (or whatever they called it)?

erf

[Joseph_Daniel_Zukige]

No, your e-mail account_s_ (plural) are not single points of attack, unless you use _all_ your e-mail accounts to sign up for everything you sign up for.

Your idea that your own server should be manager your keys is as close as you have come to a reasonable solution, but it is still subject to all sorts of man-in-the-middle.

Don't understand how your final comment about controlling your password for single-sign-on at all. Does some would-be single-sign-on vendor want to take even the final password away? Or do you misunderstand the concept of keys instead of passwords? Or what?

Re:erf

[baboonlogic]

No, your e-mail account_s_ (plural) are not single points of attack, unless you use _all_ your e-mail accounts to sign up for everything you sign up for. If I use my primary email address for signing to 15 web services, compromising my email is enough to get access to those 15 services because of the way password recovery is implemented these days. It is thus a single point of attack. A single sign-on doesn't change that.

Your idea that your own server should be manager your keys is as close as you have come to a reasonable solution, but it is still subject to all sorts of man-in-the-middle. What has man in the middle got to do with this?

Don't understand how your final comment about controlling your password for single-sign-on at all. Does some would-be single-sign-on vendor want to take even the final password away? Or do you misunderstand the concept of keys instead of passwords? Or what? No. Suppose vendor A is managing my single sign on today. Tomorrow I stop liking vendor A for whatever reason. I should be able to switch to vendor B without losing anything worthwhile. OpenID delegation allows me to do just that.

Only three passwords?

[Joseph_Daniel_Zukige]

what if someone you trust happens to accidentally (virus in a critical MSWindows server or something) reveal your high-trust password? And some guy who sees it decides to add your password to his brute-force dictionary?

Re:Only three passwords?

[ls671]

I wrote I use only dedicated passwords for the ones I really trust. Still for the ones I do not really trust, 3 passwords is better than live ID unique password ;-) For the one I do really have to trust, I assume (I sure hope), they don't keep the password in plain text in their systems and that they use something similar to /etc/passwd hash (long version, not the old short one ;-)

If you want a challenge, crack my /. password, find my Google mail user name and login to Google to read my mail and post to /. under my name. I use the same password. I have nothing critical on either Google or /. so that won't keep me from sleeping at night. Good luck ;-)

I sure wouldn't use my main "master password" (Live ID style / equivalent to your private passphrase or private key) to login to /. or Google.

If you really want secure single-sign on, you need a client certificate or at least a pair of private/public keys. As soon as somebody else (anybody) knows your private key, you need to change your cert/private key. That's an another conclusion we came up with back then.

Unfortunately, marketing people though that it would be too difficult for Mr. Joe Citizen to install a client cert in its browser ;-))

So we went with a solution that all security specialists were against. Still, it is much less simplistic than MS live ID. Client certs are still used but (hold your breath), they are kept centrally ;-))) One concern was that if the cert was kept locally on the citizen computer, compromised citizen machines would reveal the citizen cert without the citizen knowledge. Security specialists replied that the hacker would still need the private key passphrase in order to be able to use it but that did not fly. So the implemented solution isn't that bad; certs are kept centrally and downloaded to the client machine when needed. Client needs to enter its passphrase to use it and only the client knows the passphrase. Weak point is that the certificate request is made centrally so at some point the central system is aware of the passphrase for a given amount of time. Security purists will tell you that certificate request has to be made locally so that your passphrase is never transmitted to ANY other computer. But what if the machine is already compromised when you make the certificate request locally ? etc.

As you can see, the holy Grail of single-on has not been found yet, but client certs with an encrypted private key that requires a passphare is the closest thing in my humble opinion.

-ls

Terms of Use

[giafly]

Ever intending to compete against a Microsoft product?

you may not: use the service in a way that harms us or our affiliates, resellers, distributors, and/or vendors (collectively, the "Microsoft parties"), or any customer of a Microsoft party ...

Care about money?

We may choose in the future to charge for use of the service. If we choose to establish fees and payment terms for such use, Microsoft will provide at least one (1) month advance notice of such terms as provided in section 18 below, and you may elect to stop using the service rather than incurring fees.

https://msm.live.com/app/tou.aspx

Hair of the dog

[Joseph_Daniel_Zukige]

The solution to your headache -- a little more of the hair of the dog that bit you.

General purpose security? That's an oxymoron, mathematically speaking.

What we need to be doing is moving to dedicated browsers for financial and other high-security sites. But, no, Microsoft, in their wisdom, decides to tape single-sign-on on top of M$IE.

(Does anyone besides me read "MS Internet Explorer" as "Mi$iEry"?)

Dedicated browsers are only a stop-gap, but they could at least help getting the general crowds moving away from M$IE.

erf revisited

[Joseph_Daniel_Zukige]

Truth be told, I missed that you said openid instead of that thing MS is offering.

However, concerning the e-mail being a single point of failure, that's your fault.

I don't do that. I have at least three e-mail accounts, and I spread registrations around as appropriate. ssl login helps tighten up at least one of my e-mail accounts. The single point of failure is the user account I log into them all with. (Not on M$Windows.) (There's a reason I'm being vague on numbers.)

I haven't looked at openid, but if it allows you to trust someone else with your keys, it's just plain missing on the most important concept. Your own server is the correct direction to be headed, and even that has its limits. Yes, I'm talking about man-in-the-middle, among other things, if, for instance, you plan on accessing your keychain equivalent on it from outside your local LAN.

I have to go to work in two hours, and I have to exercise first, so I don't have time to explain, but you can consider that some unknown interlocuter on /. encourages you to think twice about any solution that uses a general purpose browser, and encourages you to keep your financial stuff off-line as much as you can. (Good luck with that, these days, 'though.)

Re:erf revisited

[swillden]

I haven't looked at openid, but if it allows you to trust someone else with your keys, it's just plain missing on the most important concept.

You should look into OpenID. It's a simple but very powerful concept, and well worth your time.

OpenID is open both with respect to the choice of authentication server (you can pick any one you want, including running your own if you prefer), and with respect to the choice of authentication technology. In a nutshell, the way it works is that if site A wants to authenticate you, you enter your OpenID, which looks like "username.hostname", where hostname is the name of the OpenID provider server. Call that site B. First A contacts B directly and establishes a shared secret. Next, A redirects your browser to B, where you authenticate yourself. The mechanism you use for authentication is between you and B. Generally it's a password, but it could be any authentication mechanism you want, with as many factors as you want. After you've authenticated yourself and indicated that you trust A (the URL is displayed, which is a mild anti-phishing protection), B redirects you back to A, with the user identity and the shared secret embedded in the URL so that A can verify that you were authenticated.

There's quite a bit more to it than that, and it even includes mechanisms for delegating OpenID service, using XRIs to protect against OpenID services whose domain names are taken over, etc., but that's the basic idea.

The concept never convinced me

[mrjb]

The 'one password for everything' concept is fundamentally broken. It is like having one key for everything you own- your house, your car. During a vacation, I *want* to be able to give the housekeeper access to my house, but I also want to *prevent* her from going for a joyride in my brand new expensive car. The fact that I have neither a housekeeper nor a brand new expensive car is a minor detail.

MS ignores Python style guide

[abecede]

It is just sad to read the Python implementation of this functionality. Almost nothing is written according to the Python Style Guide. Weird "__foo"-variables can be found, then it's not Python2.3 compliant because of ONE silly "staticmethod", many "getters" and "setters" which are just useless in this script. If MS wants to show their code to the scripting community, they should at least make it pretty and according to the language's coding standards. But maybe that is their understanding of "pretty". Who knows.

Re:MS ignores Python style guide

[RupW]

If MS wants to show their code to the scripting community, they should at least make it pretty and according to the language's coding standards. But maybe that is their understanding of "pretty". Who knows. To be fair, the ASP.NET samples's style is reasonable. The others are more likely just proof-of-concepts.

I think...

[Chouonsoku]

I think I would prefer Windows Dead.

Did ya see what I did thar?

Re:I think...

[Vegeta99]

You made uh funni!!

Bring it on! Not!

[crivens]

Oh yeah I'd love to use an authentication system on multiple sites that forces me to re-enter my password in Firefox every time I visit hotmail.com!

OpenID got this right.

[Poromenos1]

At least with OpenID anyone can use their own server, so a phisher wouldn't know what to make the phishing page look like. They could spoof a few known providers, but the one I use (myopenid.com) has an option to not let you log in from a different site. It gives you a page telling you to manually open a new window and log into that and then click the link to continue. That takes care of phishing...

Tears to my eye.

[Espectr0]

From the download page:

System Requirements

• 
     
• Supported Operating Systems: Linux;[...]

How far have we come?

Re:Tears to my eye.

[DragonWriter]

Supported Operating Systems: Linux;[...]

How far have we come?

Not very far, I'd say. After all, "Embrace" is the first step in the traditional Microsoft strategy. Or, perhaps, the description of the EEE strategy needs extended with a preamble to something like "Discount, Denounce, Embrace, Extend, Extinguish", in which case we have come a little ways...

Passport used to be open

[siyavash]

This is not really news, passport used to be open a couple of years ago when the bubble burst. No one really used it much so they closed it again. The idéa is not too bad but I don't see this happen any time soon. They probably will close this too when the next bubble burst.

Re:Passport used to be open

[RupW]

This is not really news, passport used to be open a couple of years ago when the bubble burst. No one really used it much so they closed it again. Yes and no - the API was open, yes, but the problem with casual adoption of passport was that there was a large fee to get it into production ($10,000 I think, might even have been $10,000/year).

This is essentially no-cost but (as I've posted above) it doesn't look very professional to me - I think it's more suited to blogs login than corporate app login.

Wait, wait!

[Anonymous Coward]

It's a cookbook!

MS adapts to market

[athloi]

New market: either proprietary web-based services (quasi-thin client) or a standards-based, PC-based market. Microsoft wants the latter, Google wants the former. Consequently, Microsoft is opening up to open source, as it will help it gain its goals.

The important thing to remember about corporations is that they're not evil. They're realpolitik. Their only goal is to make their stock price rise, so their stockholders go home happy. Stockholders are people like you and me who've bought Microsoft stock and want to make money off of it.

F/OSS is people power, which should come out and admit that it is opposed to this system. It's not anti-capitalism, but it is anti-capitalism, in its own way. I don't think it means bad by this. I compare it more to the volunteers who spend more time than most people do at day jobs to help their communities. But even that is insane from a capitalist perspective, since they could be getting $$$ for that time.

Why should anyone give a fsck?

[Ant P.]

Seriously. What reason could anyone possibly want to use WLID for when OpenID already exists?

Re:Why should anyone give a fsck?

[RAMMS EIN]

``What reason could anyone possibly want to use WLID for when OpenID already exists?''

WLID is backed by a large and well-known organization that most people already trust.

OpenID is unknown and unloved.

Uh... OpenID?

[Schraegstrichpunkt]

How is this different from OpenID, other than that MS displays a massive not-invented-here syndrome?

Re:Uh... OpenID?

[Eravnrekaree]

I think they are similar in their single login goal, but Open ID is far more decentralised, which means you do not rely upon a single provider for your identity, who may vanish along with your identity. I dont see why I or anyone here would want to use a proprietary MS thing that makes people dependant on MS, when we have an open source, open protocol, decentralised system such as Open ID.

Re:Uh... OpenID?

[DragonWriter]

I dont see why I or anyone here would want to use a proprietary MS thing that makes people dependant on MS, when we have an open source, open protocol, decentralised system such as Open ID.

The same reason people make software that runs on Windows rather than Linux, or even that relies on MS Office applications: they want to target the people already using the Microsoft platform in question. Given that Microsoft has been and will continue using its popular (whether it deserves to be or not) software and other offerings to push Live, there will probably be lots of people that already have Live IDs.

Re:Now we can all use Windows security - via the w

[Anonymous Coward]

The major difference between a thing that might go wrong and a thing that cannot possibly go wrong is that when a thing that cannot possibly go wrong goes wrong it usually turns out to be impossible to get at or repair.

Good Ol' Name Juggling...

[walter_f]

Redmond Rule #92

"Whenever a thing coming out of our premises has caused a certain degree of skepticism, even mistrust, we'll just call it by another name and be done with it, for some time."

Not so fast, Microsoft. Passport, passport, passport.

There are people who will remember.

Re:Good Ol' Name Juggling...

[Anonymous Coward]

Not so fast, Microsoft. Passport, passport, passport.

There are people who will remember. But this is entirely different to the Passport SDK! For a start, the end site only gets an anonymous cookie.

yeah...no thanks

[xgr3gx]

I don't know why we need a central authentication system for websites. It's just a bad idea.
Even worse when a company like MS is pushing it. I think it's a trap.
They want people to develop opensource apps, and popular websites, like myspace, around this 3rd party auth system.
Before you know it, MS will be sending out their goons to shake down all of these developers who are using it. Either pay up for a license, or rewrite you whole auth backend.

Live ID Announcement

[EddyPearson]

All your users are belong to us!

Already been done, but with an open standard

[Anonymous Coward]

OpenID proxy for Google, MSN, Hotmail, etc.

http://openid.nabber.org/

thats a basic flaw in the web's architecture

[Mr 44]

I've never understood why more people don't complain about this discrepancy.

The HTML containing a form and the URL the form is submitted to, can have completely different levels of security. The "yellow padlock" means the form itself was served with https, when whats important is that the form data is going to be submitted via https. Nothing to do with live or microsoft, why is this considered acceptable in general?

Re:thats a basic flaw in the web's architecture

[SanityInAnarchy]

the form itself was served with https, when whats important is that the form data is going to be submitted via https.

Because if the form was served with https, and you trust the site at all, then they'll have you submit the data with https.

Anyway, what really bothers me is that if you serve a login page via http, you're now vulnerable to a man-in-the-middle attack. It's now possible for someone to redirect live.microsoft.com (or is it live.msn.com?) to their own page, which would look exactly the same, except that it would submit the data to the attacker.

Besides...

[msimm]

You should have the housekeeper going with you (that is, assuming she's hot).

Python 2.3 compliant?

[Anonymous Coward]

Way to get yourself modded up interesting, when Python 2.3 is basically obsolete and __foo variables are standard fare in the community.

Does your Windows Live ID contain a 666 ?

[Anonymous Coward]

It has long been my suspicion that a certain alleged "person" whose initials are W!ll!am G@tes III was in reality a plastic mask being worn by the devil. And that using this assumed persona, the evil one was employing the resources of sMegmasoft to create the infrastructure to be used by the "beast" to rule the world.
Y'know - as in Revelations chapter 13-
"16He also forced everyone, small and great, rich and poor, free and slave, to receive a mark on his right hand or on his forehead, 17so that no one could buy or sell unless he had the mark, which is the name of the beast or the number of his name.

  18This calls for wisdom. If anyone has insight, let him calculate the number of the beast, for it is man's number. His number is 666."

Even for those not given to seeing the boogey man behind every curtain, the prospect of any significant portion of the economy becoming dependent upon one authentication method controlled by a company of dubious reputation should raise the hackles on the back of one's neck, eh?

what we really need

[ttnb]

what we really need is to educate those who can be educated and stop those who can't from getting near anything if it could affect anyone else

Agreed.

Do you have any suggestions for how to get going with respect to the second part of this?

Re:what we really need

[aichpvee]

Cages. Lots and lots of cages.

Slashdot goes WLID!

[maskedau]

Cool I can't wait till I can sign into Slashdot hosted on SuSE with my Windows LiveID! Seriously though... When .NET doesn't work, go open source and compete? Just another way to prolong a failing product.

What is top posting?

[aqk]

I was told I could get better 'placement' if I replied here.
I admit it was 'Anonymous Coward' posting - (Alas, I am not sure who he is) but- Is this true?

Thank you, Shushdot-
I remain, your most truthfully affectionate soviet servant.