Slashdot Mirror
Ask Slashdot: What's Holding Up Single Sign-On?
An anonymous reader writes "Like most web users these days, I have enough accounts on enough websites – most of which have *inconsistent* password syntax restrictions — that when I need to log into a site I don't visit very often, I now basically just hit the "Forgot Password" button immediately. Microsoft's "Passport" gave us the promise of a single web sign-on. What happened to that idea? Why hasn't some bright spark (or ubiquitous web corporation) already made a fortune standardizing on one? I can now buy my coffee with my phone. Why do I have to still scratch my passwords on the underside of my desk?"
Single breach of security.
Who is worthy of yours? I see Facebook SSO everywhere, but I don't want to be any part of Facebook.
I'll give you a single sign-on! Send all your login information to me and I'll set something up...
Users don't want everything tied to a single identifier, particularly one controlled by Microsoft, Google, Facebook or some other company.
FB is becoming more and more of a single sign on.
The real reason holding it back is people that make the websites are either to lazy to include it. ie blogging sites. Or want increased security aka financial sites.
---In a time of Chimpanzees I was a Monkey.
Why not, they probably hold your mortgage and your car loan.
I often have trouble remembering which way is out of bed in the morning.
It's impossible to find someone everyone trusts.
Also what happens once the central repository is compromised?
I find being offended by me offensive.
Facebook, OpenID, Yahoo, AOL, Google, Microsoft - they all support SSO for websites that want to use it. It's just a matter of the individual websites implementing it.
If you notice, Slashdot has even implemented it.
I have Single Sign On. It's called keepass.
I simply use the same password for everything! Brilliant, I know!
There's Mozilla's Browser ID, which is uses nowhere....Google, Yahoo, et al seem to have been 'bundled' into the Disqus 'platform' across various sites. I think it's more that no one wants to give up 'control' of their user data and associated metrics to a single open standard. By forcing users to continue to sign up for their 'services' they get to collect whatever they want through the use of EULAs, ToS', etc. For their own ends, of course.
In the meantime, check out https://lastpass.com/ - you get to use a single password to protect all of your other passwords. You can generate random ones, store the passwords in the cloud, so are accessible by you, anywhere. I cannot do justice here to the security and features offered.
Essentially you visit a site, and LastPass fills in the username/password for you.
This space for rent.
The technology is already available - OpenID and several other standards are ready to go.
The trouble is that everyone wants to be the ID provider, but no one wants to accept other providers. Passport is a great example - Microsoft wants to be the central gatekeeper. Well thanks, but no, I'd rather run my own, but of course MS won't accept it.
So we're now in a standoff.
Single sign-on means that if you're compromised once you're compromised everywhere.
I don't think there is a rule that you have to use a single account. I have multiple gmail accounts to separate hobby sites from work sites, etc.
If you use single sign on for slashdot, gizmodo, etc., I'm not really too concerned. It's not like someone is going to abuse my mod points more than I already do.
For important accounts I'll still use a separate identity/password.
I think there is confusion about SSO being forced for every account.
Ok the problem with Single Sign on, is the fact we are all going to choose a company for the SSO.
Do enough of us really trust Microsoft, who has been in the headlines for massive security breaches.
How about Facebook, you know those guys who take your data and sends it to everyone on the face of the earth.
Perhaps Google, You will get targeted adds based on every place you login too.
Open ID, how much do you really trust a bunch of harry toe programmers, who go to these black hat hacking events?
Some distributed architectural system where you can find many points of weaknesses from some armature setup.
That is the problem with Single Sign On. We just don't have any trust, in these sources. And to have one that you trust enough for the rest of the world?
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
The answer is easy: Too many eggs in one basket.
That could be one place that if it gets broken into everything is lost, or it could be one entity that knows all the dirty little secrets since they know all the sites that authenticate your identity. It could also just be one entity that must be up and available, which is a tall order.
The solution is simple: Public key cryptography.
Most of the people on /. are probably familiar with ssh. A key is generated on the client end. The public material is put on the server end. If the server is compromised nothing bad happens as the attacker now has a public key they can't use to log into any other service.
There is no technological reason the web can't work the same way. There is a lack of agreement on how to do it that is holding us back, and also a User Interface problem in browsers. However it's not hard to imagine a world where a browser generates a key pair, and during the sign up procedure for a web site it transmits the public material. It looks like single sign on to the user, but they didn't have to trust any third parties, and if the web site is broken into the attacker gets no useful data. It could be implemented with x.509 certificates which browsers already have support for, or it could be done as specific form types and key formatting a-la how ssh does it today. Users could create multiple keys if they wanted, and by syncing the private key material between their devices have passwordless access across all their devices.
A small amount of standards work and UI here could make passwords nearly obsolete. Sysadmins don't use telnet and passwords anymore; we need to upgrade users, and the user tools to achieve the same benefits. Single Sign On, and all of its drawbacks, disappear in the process, a win-win!
Why don't people just tell their browser to remember their login/pwd information? That's what I do for Slashdot, BoingBoing, fb, lj, gmail, etc.
Bank websites and credit card websites, I still store the passwords in my noggin, but social media? I don't care if someone who's stolen my laptop suddenly can make twitter posts in my name.
It may look like I'm doing nothing, but I'm actively waiting for my problems to go away.
--Scott Adams
Go buy my mortgage (sorry no lien on my car), then ask if you can have the keys to my house, see how far that gets you. It will get you told off, shown the bird, and possibly even mooned at that point...what it isn't going to get you, is any keys from me.
More than that.... what do they need the information for? My employer signs my paychecks, few things hold more sway over my life. Do you think that means I emailed my boss my facebook password so he could poke around and see what I am up to in my personal life? No!
The more of such a relationship I have with them, the MORE I feel I want my personal data protected. What if I am gay and they hate homosexuals? What if I am straight and they hate straight people? Maybe they don't like something my wife had to say? Point is, if I have to worry that they might make discriminatory decisions against me, then its best that they don't have information that can be used to make such decisions. Better that they keep a racist on staff who doesn't know the race of the people whose accounts he deals with than find out the hard and long way that I am one of the people he hates.
Rememeber, anything can become illegal/considered imoral/irrationally disliked by any number of people at any time....and if you aren't ever saying or doing anything that couldn't be taken thr wrong way, or expose you to discrimination, then you just are not very interesting...and thats the last thing we should be encouraging as a society.
"I opened my eyes, and everything went dark again"
I manage my passwords with lastpass. The service that Steve Gibson from GRC has vetted to be safe and secure
Hahahaha.
Wait - the same Steve Gibson that insisted raw sockets are security threat, some 10 years ago?
That Steve Gibson?
Hahahahaha.
There is. Password managers.
Kwallet for example can do this automatically. I don't have to "remember" anything but the single password I encrypted it with. It remembers everything else. All the convenience of single-sign-on, without the problems of a single compromised site leaking all your sign on data to everything, and the problems of tracking.
* I want to keep my identities separate.
* I don't want _SINGLE_SIGNON_PROVIDER_ to have keys to my entire online life.
* I'd rather "spread the risk" of having my login information compromised.
I don't have a common key for my house, office, and car either. Nor do I want one.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
What do I do when I want to log in to do a bank transfer when I'm at my mom's? Log in to read some email when at my friend's house? Post to /. from work?
Your solution moves single-sign-on from a solution-provider to the individual, but it completely ignores the fact that some of us DO NOT WANT identities tied together.
True, I could have multiple, independent public keys just like I can have multiple independent sign-ons.
However, you and the world still need to realize that one of the things holding back single-sign-on in any form is that many people simply do not want it.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
But if you do that, then why not just use a different password for each such group? Passwords aren't that hard.
I believe the submitter touched on part of the reason. Inconsistent password policies for length, characters and expiry date.
To this day there is one PITA site that won't allow "!" as a password character and it throws my whole system off.
Also, if I want to change my password, with SSO there is one change. With multiple sites....
Passwords may not be hard... but SSO is easier.
The problem with Microsoft Passport was Microsoft.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Seems like most of the replies here suggest that users don't really want it. Maybe Slashdot users dont want it, but seems to me another reason is that sites don't want it If the purpose of a login was to confirm my identity, more sites would make this easier. The purpose of a login is to shackle you to a site. This is why even if you see a "Login with Twitter" "Login with Facebook" button and try to use it, you're immediately required to "link" your Twitter or FB account to the "app" of that site. They don't give a damn what your identity is, they need more than just a confirmation of that, they need your permission to make you part of their social media reach. Now, there are ways to make this all happen with a good SSO, of course, but that's technically harder to implement, and there will often be some "business requirement" for some crucial piece of valuable personal info that happens to not provided in whatever SSO, and so the managers will push for a custom sign-on. Facebook is getting close though. For better or for worse.
nonsig. unsig. desig.
Except that he was right 10 years ago. Now, it's irrelevant as ISPs have finally implemented proper egress filtering.
Having a bootable linux flash drive is an option.
Yeah, if you like questions like:
What is that thing?
Why do you have to reboot my computer?
What the heck did you just do?
That's not Windows!
Did you break my computer?
Of course the next time they get a drive-by download while looking for porn (on their already virus-laden computer), it'll be: "My internet has been broken ever since that computer hacker guy screwed around with my computer."
> Inconsistent password policies for length, characters and expiry date.
We _really_ need standards for passwords & passphrases: minimum LENGTH and SYMBOLS included.
If you site can't handles passwords / passphrases around ~ 96 characters long with the characters (space) 0x20 - 0x7E, your site is *broken*.
The same crap with usernames. Stop limiting me to a max username length of 12 characters A-Z,a-z because your shitty architect / programmer / DB guy doesn't have a clue about security.
I propose a multi-tiered system with a schema like:
NAME#@%
PASS#@%
Where :-@ (0x3A-0x40)
# is the max length allowed * 16
@ represents which glyphs are allowed to be. Higher is better, which each level including the characters from the previous set
A = A-Z (0x41-0x5A)
B = a-z (0x61-0x7A)
C = 0-9 (0x30-0x39)
D = space,!-/ (0x20-0x2F)
E =
F = [-` (0x5B-0x60)
G = {-~ (0x7B-0x7E)
% is the number of months the password is valid for.
Examples: .. 0x7E, expires in 3 months
NAME1C0 is 16 characters, in range: A-Z,a-z,0-9, 0 = never expires
PASS6G3 is 6*16 = 96 characters, in range 0x20
Then we flame & shame the idiots, er sites, that use crappy username and password polices.
Maybe time for RFC ?
Invoking Betteridge.
Have gnu, will travel.
Many financial sites limit passwords to letters and numbers because they have a phone service (that you'd likely never use) that uses the same password. It's really quite annoying.
Socialism: a lie told by totalitarians and believed by fools.
That's still short of an SSO. If I'm 100km from home, and my laptop crashed and burns, I can get a new one; how would I get the data for the plug-in there? What if it's a loaned laptop? What if I want to log in from my tablet somewhere? There's dozens of scenarios where PH won't work, and a good SSO would.
This question has many parallels to "Why do all the browsers suck?" circa 2002. Similar answer: end users' interests are not aligned with commercial ventures, thus commercial entities fail to address the need. Governments, for similar reasons, are not welcome as solution providers.
Mozilla has a potentially gamechanging solution in alpha. It is inherently user controlled and FLOSS. It's also intended to be very easy to use by building user-controlled personas into the browser, allowing single sign in without revealing sign-in habits to a third party. Developers and testers welcome.
https://login.persona.org/
http://identity.mozilla.com/