Slashdot Mirror
Ask Slashdot: What's Holding Up Single Sign-On?
An anonymous reader writes "Like most web users these days, I have enough accounts on enough websites – most of which have *inconsistent* password syntax restrictions — that when I need to log into a site I don't visit very often, I now basically just hit the "Forgot Password" button immediately. Microsoft's "Passport" gave us the promise of a single web sign-on. What happened to that idea? Why hasn't some bright spark (or ubiquitous web corporation) already made a fortune standardizing on one? I can now buy my coffee with my phone. Why do I have to still scratch my passwords on the underside of my desk?"
Single breach of security.
Who is worthy of yours? I see Facebook SSO everywhere, but I don't want to be any part of Facebook.
I'll give you a single sign-on! Send all your login information to me and I'll set something up...
Users don't want everything tied to a single identifier, particularly one controlled by Microsoft, Google, Facebook or some other company.
FB is becoming more and more of a single sign on.
The real reason holding it back is people that make the websites are either to lazy to include it. ie blogging sites. Or want increased security aka financial sites.
---In a time of Chimpanzees I was a Monkey.
Why not, they probably hold your mortgage and your car loan.
I often have trouble remembering which way is out of bed in the morning.
It's impossible to find someone everyone trusts.
Also what happens once the central repository is compromised?
I find being offended by me offensive.
Facebook, OpenID, Yahoo, AOL, Google, Microsoft - they all support SSO for websites that want to use it. It's just a matter of the individual websites implementing it.
If you notice, Slashdot has even implemented it.
I have Single Sign On. It's called keepass.
I simply use the same password for everything! Brilliant, I know!
There's Mozilla's Browser ID, which is uses nowhere....Google, Yahoo, et al seem to have been 'bundled' into the Disqus 'platform' across various sites. I think it's more that no one wants to give up 'control' of their user data and associated metrics to a single open standard. By forcing users to continue to sign up for their 'services' they get to collect whatever they want through the use of EULAs, ToS', etc. For their own ends, of course.
In the meantime, check out https://lastpass.com/ - you get to use a single password to protect all of your other passwords. You can generate random ones, store the passwords in the cloud, so are accessible by you, anywhere. I cannot do justice here to the security and features offered.
Essentially you visit a site, and LastPass fills in the username/password for you.
This space for rent.
The technology is already available - OpenID and several other standards are ready to go.
The trouble is that everyone wants to be the ID provider, but no one wants to accept other providers. Passport is a great example - Microsoft wants to be the central gatekeeper. Well thanks, but no, I'd rather run my own, but of course MS won't accept it.
So we're now in a standoff.
Ok the problem with Single Sign on, is the fact we are all going to choose a company for the SSO.
Do enough of us really trust Microsoft, who has been in the headlines for massive security breaches.
How about Facebook, you know those guys who take your data and sends it to everyone on the face of the earth.
Perhaps Google, You will get targeted adds based on every place you login too.
Open ID, how much do you really trust a bunch of harry toe programmers, who go to these black hat hacking events?
Some distributed architectural system where you can find many points of weaknesses from some armature setup.
That is the problem with Single Sign On. We just don't have any trust, in these sources. And to have one that you trust enough for the rest of the world?
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
The answer is easy: Too many eggs in one basket.
That could be one place that if it gets broken into everything is lost, or it could be one entity that knows all the dirty little secrets since they know all the sites that authenticate your identity. It could also just be one entity that must be up and available, which is a tall order.
The solution is simple: Public key cryptography.
Most of the people on /. are probably familiar with ssh. A key is generated on the client end. The public material is put on the server end. If the server is compromised nothing bad happens as the attacker now has a public key they can't use to log into any other service.
There is no technological reason the web can't work the same way. There is a lack of agreement on how to do it that is holding us back, and also a User Interface problem in browsers. However it's not hard to imagine a world where a browser generates a key pair, and during the sign up procedure for a web site it transmits the public material. It looks like single sign on to the user, but they didn't have to trust any third parties, and if the web site is broken into the attacker gets no useful data. It could be implemented with x.509 certificates which browsers already have support for, or it could be done as specific form types and key formatting a-la how ssh does it today. Users could create multiple keys if they wanted, and by syncing the private key material between their devices have passwordless access across all their devices.
A small amount of standards work and UI here could make passwords nearly obsolete. Sysadmins don't use telnet and passwords anymore; we need to upgrade users, and the user tools to achieve the same benefits. Single Sign On, and all of its drawbacks, disappear in the process, a win-win!
Go buy my mortgage (sorry no lien on my car), then ask if you can have the keys to my house, see how far that gets you. It will get you told off, shown the bird, and possibly even mooned at that point...what it isn't going to get you, is any keys from me.
More than that.... what do they need the information for? My employer signs my paychecks, few things hold more sway over my life. Do you think that means I emailed my boss my facebook password so he could poke around and see what I am up to in my personal life? No!
The more of such a relationship I have with them, the MORE I feel I want my personal data protected. What if I am gay and they hate homosexuals? What if I am straight and they hate straight people? Maybe they don't like something my wife had to say? Point is, if I have to worry that they might make discriminatory decisions against me, then its best that they don't have information that can be used to make such decisions. Better that they keep a racist on staff who doesn't know the race of the people whose accounts he deals with than find out the hard and long way that I am one of the people he hates.
Rememeber, anything can become illegal/considered imoral/irrationally disliked by any number of people at any time....and if you aren't ever saying or doing anything that couldn't be taken thr wrong way, or expose you to discrimination, then you just are not very interesting...and thats the last thing we should be encouraging as a society.
"I opened my eyes, and everything went dark again"
I manage my passwords with lastpass. The service that Steve Gibson from GRC has vetted to be safe and secure
Hahahaha.
Wait - the same Steve Gibson that insisted raw sockets are security threat, some 10 years ago?
That Steve Gibson?
Hahahahaha.
Your solution moves single-sign-on from a solution-provider to the individual, but it completely ignores the fact that some of us DO NOT WANT identities tied together.
True, I could have multiple, independent public keys just like I can have multiple independent sign-ons.
However, you and the world still need to realize that one of the things holding back single-sign-on in any form is that many people simply do not want it.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
But if you do that, then why not just use a different password for each such group? Passwords aren't that hard.
I believe the submitter touched on part of the reason. Inconsistent password policies for length, characters and expiry date.
To this day there is one PITA site that won't allow "!" as a password character and it throws my whole system off.
Also, if I want to change my password, with SSO there is one change. With multiple sites....
Passwords may not be hard... but SSO is easier.
The problem with Microsoft Passport was Microsoft.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."