Slashdot Mirror
Microsoft: We're Developing Blockchain ID System Starting With Our Authenticator App (zdnet.com)
Microsoft has revealed its plans to use blockchain distributed-ledger technologies to securely store and manage digital identities, starting with an experiment using the Microsoft Authenticator app. From a report: Microsoft reckons the technology holds promise as a superior alternative to people granting consent to dozens of apps and services and having their identity data spread across multiple providers. It highlights that with the existing model people don't have control over their identity data and are left exposed to data breaches and identity theft. Instead, people could store, control and access their identity in an encrypted digital hub, Microsoft explained. To achieve this goal, Microsoft has for the past year been incubating ideas for using blockchain and other distributed ledger technologies to create new types of decentralized digital identities.
Either when mainstream media starts reporting about it or when MS starts to develop for it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Blockchains are relevant for ledgers and logs (basically a secure utmp/wtmp). However, for authentication, it really doesn't help much.
Instead, MS would be better off designing an open protocol like RFC 6238 or RFC 4226, except using public/private keys as opposed to shared secrets, and having an open authenticator app for this.
If you have an authentication server why do you need or even want block chain. Furthermore if you want to distribute the authentication to many servers how do you control the authentication list if there's no proof of work. and if there's proof of work, then it gets expensive because that's why its called work
Some drink at the fountain of knowledge. Others just gargle.
They're just going to have a master key or series of rotating side-channel attacks so nothing Microsoft-based can be trusted, this has been demonstrated without fail on a monthly basis for over 2 decades.
I wonder if Microsoft is trying to get around a scaling problem. If every company on Earth switches to Office 365, and they're basically forcing everyone this way, then they will control at least a portion of identity/login for most of the world. They're doing this with Azure AD right now, with every company either in a cloud-based or federated trust with their own tenant. I'm sure Azure AD is designed in a way that there's no single point of attack that could leak all users' credentials, but maybe the point of decentralizing it is actually to get the storage part off their hands while still controlling the process.
Cloud cloud cloud!!!
Blockchain blockchain blockchain!!!
Marketing departments are working overtime these days.
Just wait until they get to Cloudchain and Blockcloud !
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
Blockchain is the new cloud.
Not in what it does, just in the marketing sense, of course.
You know eventually technologies are going to be like medicines and domain names: all the good ones will have been taken and/or copyrighted, and we'll be left with nonsense terms created by marketing droids.
Microsoft Word 2^11, now with Incivek and Adcetris.
To ensure perfect aim, shoot first and call whatever you hit the target
Translation:
"I am a retardo who disconsidered security questions back in the day and now I got the shaft. It's YOUR FAULT!!!111oneone"
You're welcome.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
I can see how putting my info on a blockchain provides verification that I put my info on the blockchain. I can see how you could use encryption techniques to allow me to encode on the blockchain who can access my info. But I don't see how this causes those accessing my info to use appropriate security protocols to protect my info. At some point, they'll want access to my actual information, and once they have that, what prevents them from storing a copy for their convenient, or simply forwarding it to some third party that's paying them for information? Also, how does this help at all with apps asking for access to personal information that they have no need for?
People who write apps could already ask for minimal information, and they could already encrypt the info with something only I can provide to minimize their contact surface, they already could use best practices like salting their hashed password storage. For the most part, the problem isn't that they are trying really hard to do these things, and failing for technical reasons, the problem is that they aren't bothering to even try.
You have got to be fucking kidding me. They restrict maximum password length way below sensible limits, can't seem to get their various assets to log me in correctly, first time. I've recently been bounced between various login screens, been literally typing in my user name and before I can press tab to move focus, the page is redirecting and some of what I wrote is lost or entered as entry into the password field. (None of this was a problem with my end - I tried various methods to see if I was going wrong somewhere). At the moment you have to try to understand what they're talking about when they ask "what sort of login you have, a workplace/organisation or your own?" I click the relevant option and find out it's the wrong one, but I was logged in anyway. Microsoft don't seem to have offered a functioning, reliable, consistent authentication interface for at least ten years.
How about you get the basics working first, before you start with dabbling with fads just to rise your share price?
"It highlights that with the existing model people don't have control over their identity data and are left exposed to data breaches and identity theft. "
That's why sensible people use all different fake indentities. Only my bank has my real name.
Amazon, etc all deliver their stuff to my cat.
Cloud cloud cloud!!!
Blockchain blockchain blockchain!!!
Marketing departments are working overtime these days.
Just wait until they get to Cloudchain and Blockcloud !
Wake me when they get to BlockCloud!
Did a major publication (ZDNet) really say "Microsoft reckons"? Are they roundin up the wagons and herdin the cattle too? I know journalism is pretty much a dead idea, but that is just completely lacking any attempt at professional writing.
Sent from my TARDIS
Here's how blockchains works: I can't falsify a transaction in the bitcoin blockchain without outprocessing the entire rest of the network. Think about why that might be a problem for Microsoft if they start their own blockchain. Hmmmm.
Hey Microshat,
How about you start to support 2 factor authentication on windows and servers first before you start worrying about collecting all PII data?
Seriously, why do I need a 3rd party authenticator like RSA and and GINA replacement when 2 factor should be standard by now.
But, there IS trust. Implicit trust in that the miners donâ(TM)t have an agenda (or at least one that includes your transaction). And worse, you donâ(TM)t know who you are trusting and the âtargetâ of that trust changes with each transaction. To me this seems a bit naive, hoping that a crowd will balance out the egoism of the individuals but also knowing that power and control tend to centralise and corrupt.