Slashdot Mirror
Microsoft Opens Up Windows Live ID
randommsdev writes "Microsoft has announced the release of Windows Live ID Web Authentication. This means that WLID (formerly known as Passport) is now opened to third party websites to use as their authentication system. Any Windows Live user can potentially log in to a website that implements Web Authentication. Interestingly sample implementations are available in the Ruby, Python, Perl, and PHP open source languages amongst others — tested on openSUSE 10.2 but expected to work on any platform that supports these languages. More details are available in the SDK documentation."
Put your comments below this one.
urls gone wlid!
sigfault. core dumped.
Until the first site with a fake passport login form shows up? I mean before semi-intelligent people weren't going to enter their passport ID into non-MS websites, but now... I bet a lot more corporate keys get exposed this way as passport is the keys to your Enterprise Licensing kingdom.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
They changed the name
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
Great... it's copyrighted and provides no license.
Whats to prevent them from doing it right now, without the release of the system by Microsoft? I can already create a fake Google account, Live, or numerous other login systems on any website I own, it is ultimately up to the user to beware.
Like the diebold voting booths? ;)
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
Go to Hotmail. You will see that Hotmail now requires you to login with Windows Live ID. Now, take a look at this page. It's a login page. They want you to enter your ID and your password. This is what gives you access to all the different services that are currently integrated with Windows Live ID, and will be integrated in the future. It's basically your "master password". Thing I'm trying to stress here: you shouldn't just give this out to anyone who asks. Ok, you get the idea.
s nv=10&c...." etc. Great, login.live.com, that's what I expect. Cool. Ok, so what's the second thing I should check? Anyone? Come on, it's web password security 101 here people. What do I need to check before I enter a login/password on a web site? That's right.. I need to check I'm on an SSL secured page. The url should start with what? https right? And I should look for the little lock in my browser window.. and if I'm feeling especially paranoid I should check the security certificate to see whether or not it is valid, not expired, and for the site that I am expecting.
So, first check you should do whenever you're logging into a page is what? That's right, check the url. "http://login.live.com/login.srf?wa=wsignin1.0&rp
This page has none of those things. Well done Microsoft.
Oh, but it gets better. There's this link that says "Use enhanced security". I would have thought that "enhanced" security was a sensible default, silly me. It's not underlined, so you don't know it is a link until you hover your mouse over it, but it will take you to a https:/// page. Of course, the certificate it offers you is not for login.live.com, it's for graphics.hotmail.com. If you accept this certificate then you are basically saying that you're ok with trusting this data that didn't come from graphics.hotmail.com as if it did come from graphics.hotmail.com. Just for the hell of it, let's fire up this "enhanced security" page in IE and see what happens. Oh.. I see. We get no warnings. In fact, if we double click on the padlock we see that the certificate now IS for live.login.com. Hmm, what's going on here. Ahh, I see, half the content on this page didn't come from live.login.com, it came from graphics.hotmail.com.. so this isn't a secure site *at all*, it's a mixed domain site and IE's pitiful support for multiple certificates on a single page is happy to just ignore this (and doesn't even warn you).
XSS anyone?
How we know is more important than what we know.
before semi-intelligent people weren't going to enter their passport ID into non-MS websites, but now... I bet a lot more corporate keys get exposed this way as passport is the keys to your Enterprise Licensing kingdom.
Hmmm, massive FUD has much inertia. First, intelligent people have known for a long time not to trust M$ with anything. This has harmed the online economy, but that's a different story. If the 25% prevalence of keyloggers is not enough, a rogue site has been able to harvest Passport IDs forever, because IE can be resized, reshaped and made to look like whatever the rogue site wants it to. Firefox puts a stop to menu hiding and resizes, but Mozilla.org can't save you from a key logger.
Friends don't help friends install M$ junk.
There's no possible way anything could go wrong with this plan.
What if I do the same thing, and I do get different results?
The ToU is on the downloads page: https://msm.live.com/app/tou.aspx
(Please browse at -1 to read this comment.)
Is it just me, or does placing this article directly above the Diebold rebranding article make you think of a theme common to both? Company loses credibility. Keeps trying to regain it, but still doesn't grok that you can't just make it *look* like you've changed your spots. You actually have to change your behavior, and regaining credibility takes a lot longer than destroying it does.
Read the EFF's Fair Use FAQ
Does this mean they've given up on CardSpace, which is built into Vista right now? I thought it was a much better solution to the need for single sign-on. Check out thechannel9 video.
"God deliver us from our friends, we can handle the enemy." -Patton
I thought Passport was outted years ago as being fundamentally broken. Why would I want to implement it on my site? Did they fix it? If not, why are they still using it at all?
-matthew
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
I'd prefer to see the rise of OpenID. Now if Microsoft gave you an OpenID authentication point with your LiveID (preferably with something simple, like adding the OpenID <link> tags to login.live.com or even just live.com), that would be a feature worth using and supporting. And wouldn't require changing the sites that already support OpenID, including, AFAIK, the SixApart family of blogs.
With modern technology, diverse applications are a good thing (healthier market and better apps from consumer selection). Information, however, is more useful the more widely it can be read and used. Unless you are specifically trying to hide something.
Unfortunately, like Live ID, there seems to be more OpenID providers than servers that use them for authentication.
I use 3 passwords for all sites I access mapping to 3 levels of trust. I try to use the same user id when possible :
Level 1 : risky
Level 2 : less risky
Level 3 : almost trustable
For sites that I really trust (banking, etc...) I use dedicated passwords. I, also, can forecast problems with a single sign-on scheme that would be more or less like giving away your social security number if hacked.
I have been working on this problematic before for big organizations and one conclusion we came up with was that we needed to re-use the old assembly language "indirection" principle, called pointers in higher level languages.
So basically, one has to be able to authenticate with multiples set of usernames/passwords combinations. Once the unique user is authenticated, the central authentication authority limits its role to just that, authenticating the user.
All authorization is managed by the local system that interacts with the user.
Do a search for MBUN on Google. In Canada, a user can have multiple MBUNs to deal with the government. This solution was implemented to cope with privacy concerns and still allow the citizen to deal with the government with the same level of privacy that was previously achieved with paper forms. Basically, what has been done is creating a mapping between the MBUN and the real userid and the choice has been given the citizen to have as many MBUN as he wishes to deal with the government.
Serious concerns should apply to too simplistic solutions ;-)
Now for all /. MS bashers to enjoy : Although a qualified partner in the project, none of MS products where used to implement the solution. Given the money and the visibility at stakes, this caused a commotion in Canada with MS canadian VP putting pressure on everybody to reverse the decision.
Hey Sam, your products are just too simplistic and too proprietary. Phone us next year please ;-) That was really funny, the guy just couldn't understand that Macdonald's like marketing techniques did not work in this case. I mean, they even flew us for a week to Redmond at the campus to try to brainwash us, but still no go for MS.
-ls
Everything I write is lies, read between the lines.
and how this compare to OpenID ? (See also OpenID Enabled for those interested in using it)
Misleading titles? Inflammatory blurbs? Keep in mind that Slashdot is a tabloid.
Supported Operating Systems: Linux; Windows Vista; Windows XP
How's the wheather in hell these days?
http://recordmydesktop.iovar.org
Well, it will inherit Microsoft's stellar security and perfect programming. Besides which, its a closed network unlike OpenID so it will be about as popular as Google's Account Authentication which does the same thing but with Google Accounts. Even OpenID isn't that widely used, and it's an open system.
Why on earth would I want to, of all things, authenticate using a 3rd party propriety system from a vendor with proven business practices like MS? That seems like the very last thing I want to do. And I haven't even mentioned the outages, so your uptime depends on MS. What are you gonna do when that happens, call them? I have a much better idea, Bill. Why don't you use my unified login system. I've made a version in Visual Basic especially for you.
Reduce, reuse, cycle
The 'one password for everything' concept is fundamentally broken. It is like having one key for everything you own- your house, your car. During a vacation, I *want* to be able to give the housekeeper access to my house, but I also want to *prevent* her from going for a joyride in my brand new expensive car. The fact that I have neither a housekeeper nor a brand new expensive car is a minor detail.
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
It is just sad to read the Python implementation of this functionality. Almost nothing is written according to the Python Style Guide. Weird "__foo"-variables can be found, then it's not Python2.3 compliant because of ONE silly "staticmethod", many "getters" and "setters" which are just useless in this script. If MS wants to show their code to the scripting community, they should at least make it pretty and according to the language's coding standards. But maybe that is their understanding of "pretty". Who knows.
At least with OpenID anyone can use their own server, so a phisher wouldn't know what to make the phishing page look like. They could spoof a few known providers, but the one I use (myopenid.com) has an option to not let you log in from a different site. It gives you a page telling you to manually open a new window and log into that and then click the link to continue. That takes care of phishing...
Send email from the afterlife! Write your e-will at Dead Man's Switch.
You should look into OpenID. It's a simple but very powerful concept, and well worth your time.
OpenID is open both with respect to the choice of authentication server (you can pick any one you want, including running your own if you prefer), and with respect to the choice of authentication technology. In a nutshell, the way it works is that if site A wants to authenticate you, you enter your OpenID, which looks like "username.hostname", where hostname is the name of the OpenID provider server. Call that site B. First A contacts B directly and establishes a shared secret. Next, A redirects your browser to B, where you authenticate yourself. The mechanism you use for authentication is between you and B. Generally it's a password, but it could be any authentication mechanism you want, with as many factors as you want. After you've authenticated yourself and indicated that you trust A (the URL is displayed, which is a mild anti-phishing protection), B redirects you back to A, with the user identity and the shared secret embedded in the URL so that A can verify that you were authenticated.
There's quite a bit more to it than that, and it even includes mechanisms for delegating OpenID service, using XRIs to protect against OpenID services whose domain names are taken over, etc., but that's the basic idea.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.