Slashdot Mirror
Microsoft: We're Developing Blockchain ID System Starting With Our Authenticator App (zdnet.com)
Microsoft has revealed its plans to use blockchain distributed-ledger technologies to securely store and manage digital identities, starting with an experiment using the Microsoft Authenticator app. From a report: Microsoft reckons the technology holds promise as a superior alternative to people granting consent to dozens of apps and services and having their identity data spread across multiple providers. It highlights that with the existing model people don't have control over their identity data and are left exposed to data breaches and identity theft. Instead, people could store, control and access their identity in an encrypted digital hub, Microsoft explained. To achieve this goal, Microsoft has for the past year been incubating ideas for using blockchain and other distributed ledger technologies to create new types of decentralized digital identities.
Cloud cloud cloud!!!
Blockchain blockchain blockchain!!!
Marketing departments are working overtime these days.
Your account processes are the WORST. Tried to login to my old Skype account, after being unable to answer the vast majority of your questions and failing to recover my account I vowed never to use any of your shitty services again. Sorry, there's no way I can remember the subjects of emails I sent years ago.
Either when mainstream media starts reporting about it or when MS starts to develop for it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Blockchains are relevant for ledgers and logs (basically a secure utmp/wtmp). However, for authentication, it really doesn't help much.
Instead, MS would be better off designing an open protocol like RFC 6238 or RFC 4226, except using public/private keys as opposed to shared secrets, and having an open authenticator app for this.
If you have an authentication server why do you need or even want block chain. Furthermore if you want to distribute the authentication to many servers how do you control the authentication list if there's no proof of work. and if there's proof of work, then it gets expensive because that's why its called work
Some drink at the fountain of knowledge. Others just gargle.
So instead of safeguarding our own digital identities, we'll put them in "The Digital Hub" where everyone in the world will have access to them. And instead of storing them in a single file, they'll be attached to a chain with everyone else's, where the entire chain has to be accessed with every transaction, and will also grow by one link with every transaction, until it's a massive unwieldy monster that needs a city's worth of electricity just to process.
What a joke. This is what happens when middle managers get hold of buzzwords like "blockchain".
Thanks, Nadella, but no, thanks.
... because it's a new word.
Every MBA seems to have wet dreams about blockchains, but the actual innovation isn't the blockchain. That existed long ago. The new thing about Bitcoin is how it made a distributed ledger based on a blockchain. "Mining", the so-called work-proof, is the actual innovation behind Bitcoin that enables a tamper-proof distributed ledger without trust and central authority.
They're just going to have a master key or series of rotating side-channel attacks so nothing Microsoft-based can be trusted, this has been demonstrated without fail on a monthly basis for over 2 decades.
These lying sacks are not out to help you, you are their product, cattle. The idea they would work in anyones best interest except their own is laughable.
My guess? They will talk a big game, but if you look under the hook which they will conveniently make impossible, you'd see a whole lot of smoke and mirror and bullshit.
Microsoft are Liars(tm)
Same organization has repeatedly been sued by multiple world governments and tracks and collects data in a way that puts facebook to shame. I wouldn't trust them with a ball of yarn.
Literally my first thought regarding this, followed by one of the other threads above about using public private keys and just using the blockchain as a utmp/wtmp/authentication logging solution (where it WOULD be good in a corporate environment if you needed all access attempts verifiably logged, and assuming the majority of the network wasn't compromised/compromisable.
I wonder if Microsoft is trying to get around a scaling problem. If every company on Earth switches to Office 365, and they're basically forcing everyone this way, then they will control at least a portion of identity/login for most of the world. They're doing this with Azure AD right now, with every company either in a cloud-based or federated trust with their own tenant. I'm sure Azure AD is designed in a way that there's no single point of attack that could leak all users' credentials, but maybe the point of decentralizing it is actually to get the storage part off their hands while still controlling the process.
UGH!
Identity and access management is the proverbial elephant being described by blind men. What we need is an article with a motivating scenario that their new service supposedly addresses, with technical detail. Not just a lot of buzzwords and happy talk.
Using *which* blockchain? The original blockchain refers to Bitcoin. Are Microsoft credentials now stored on the Bitcoin blockchain? Do they mean "using a blockchain-like distributed ledger" ?
They keep saying "blockchain" like there's only one. Do they intend to push marketing of the phrase "blockchain" until people have no idea whether it refers to Bitcoin or their stupid Microsoft account? Does microsoft intend to 'steal' the notion and apply to something that doesn't even make sense - like "dot Net" ? Remember their appropriation of ".NET" for their stupid, post Active-X/COM shitware that destroyed a whole TLD?
Blockchain is the new cloud.
Not in what it does, just in the marketing sense, of course.
You know eventually technologies are going to be like medicines and domain names: all the good ones will have been taken and/or copyrighted, and we'll be left with nonsense terms created by marketing droids.
Microsoft Word 2^11, now with Incivek and Adcetris.
To ensure perfect aim, shoot first and call whatever you hit the target
I can see how putting my info on a blockchain provides verification that I put my info on the blockchain. I can see how you could use encryption techniques to allow me to encode on the blockchain who can access my info. But I don't see how this causes those accessing my info to use appropriate security protocols to protect my info. At some point, they'll want access to my actual information, and once they have that, what prevents them from storing a copy for their convenient, or simply forwarding it to some third party that's paying them for information? Also, how does this help at all with apps asking for access to personal information that they have no need for?
People who write apps could already ask for minimal information, and they could already encrypt the info with something only I can provide to minimize their contact surface, they already could use best practices like salting their hashed password storage. For the most part, the problem isn't that they are trying really hard to do these things, and failing for technical reasons, the problem is that they aren't bothering to even try.
You have got to be fucking kidding me. They restrict maximum password length way below sensible limits, can't seem to get their various assets to log me in correctly, first time. I've recently been bounced between various login screens, been literally typing in my user name and before I can press tab to move focus, the page is redirecting and some of what I wrote is lost or entered as entry into the password field. (None of this was a problem with my end - I tried various methods to see if I was going wrong somewhere). At the moment you have to try to understand what they're talking about when they ask "what sort of login you have, a workplace/organisation or your own?" I click the relevant option and find out it's the wrong one, but I was logged in anyway. Microsoft don't seem to have offered a functioning, reliable, consistent authentication interface for at least ten years.
How about you get the basics working first, before you start with dabbling with fads just to rise your share price?
"It highlights that with the existing model people don't have control over their identity data and are left exposed to data breaches and identity theft. "
That's why sensible people use all different fake indentities. Only my bank has my real name.
Amazon, etc all deliver their stuff to my cat.
That Microsoft controls.
Fuck that, I'm not letting MS be the central authentication mechanism on the web, they can kiss my ass.
what was the one with all the eggs in one basket?
Seems like it would make for a really juicy target for some foreign government agency to try and compromise.
Did a major publication (ZDNet) really say "Microsoft reckons"? Are they roundin up the wagons and herdin the cattle too? I know journalism is pretty much a dead idea, but that is just completely lacking any attempt at professional writing.
Sent from my TARDIS
Here's how blockchains works: I can't falsify a transaction in the bitcoin blockchain without outprocessing the entire rest of the network. Think about why that might be a problem for Microsoft if they start their own blockchain. Hmmmm.
Should have known! When Microsoft wakes with morning glory msmash is there to beat it.
Hey Microshat,
How about you start to support 2 factor authentication on windows and servers first before you start worrying about collecting all PII data?
Seriously, why do I need a 3rd party authenticator like RSA and and GINA replacement when 2 factor should be standard by now.