Microsoft Opens Up Windows Live ID

randommsdev writes "Microsoft has announced the release of Windows Live ID Web Authentication. This means that WLID (formerly known as Passport) is now opened to third party websites to use as their authentication system. Any Windows Live user can potentially log in to a website that implements Web Authentication. Interestingly sample implementations are available in the Ruby, Python, Perl, and PHP open source languages amongst others — tested on openSUSE 10.2 but expected to work on any platform that supports these languages. More details are available in the SDK documentation."

ATTN: Top-posting whores

Put your comments below this one.
 

Re:ATTN: Top-posting whores

What is top posting?

Thanks!

Put your comments below this one.

w00t!

urls gone wlid!

How long

Until the first site with a fake passport login form shows up? I mean before semi-intelligent people weren't going to enter their passport ID into non-MS websites, but now... I bet a lot more corporate keys get exposed this way as passport is the keys to your Enterprise Licensing kingdom.

Re:How long

This has been done many times in the past, and I am sure it will continue to happen. Most common were the times that people would set-up false bank of america websites and people would type in their account information....perfect set-up. What was even better was that these sites sometimes were set to bankofamrica.com or some slight variation of the site, so the common user would have no idea they were at the wrong site.

Well there are safeguards for this now, and I am sure if it gets to be a problem like that was at one time, it will also get fixed.

Re:How long

Well there are safeguards for this now, and I am sure if it gets to be a problem like that was at one time, it will also get fixed.

The safeguards only work if the user is paying attention. It only takes a fraction of a percent of people to click a 'log in here with your bank of america credentials to see if you have won a prize' link and the scammers can make a profit, and will keep on scamming.

Still... if you've got a way around this that is truly idiot proof, I'd like to hear it! The best thing I can come up with is that the banks themselves initiate the scam, and then send 'the boys' around to break the thumbs of anyone who falls for it, or otherwise punish the scammee (that's strange... my spell check says scammee isn't a valid word...).

Re:How long

'log in here with your bank of america credentials to see if you have won a prize'. As a matter of fact this is the latest and probably the most successfull class of phishing sites. The ruse is a "survey" on behalf of "Bank of America" or someone else. It is surprising how many people fall for it. The website has nothing to do with the bank, the addresses are not the bank ones, but none the less the consumer enters their credentials. As a results of many years of brainwashing by direct marketeers they now consider all this to be "business as usual".

Re:How long

Whenever I've gone to a bank, they just wear suits and business clothes. Why is the wardrobe department involved with this? I'm confused.

Re:How long

Google and Yahoo have both been offering similar services for awhile now, I believe, and I don't remember hearing either of them having this problem. Not to say it couldn't happen, but I imagine they've thought about this situation and have accounted for it somehow.

Re:How long

I would love to have a 'single sign-on' and forever forget the hassle of remembering and entering passwords, but the flaw you mention and many others mean I don't think it will ever work. The value of pwning someone's 'single sign-on' code (whether it is Microsoft or some other solution) is just too high.

If a 'single sign-on' became everyone's only method of authenticating to anything, then it would make identity theft just too easy.

You can go to extreme lengths to protect all the sign-on pages in the world, but as long as there are people who will click on a 'your account will be deleted in 2 days unless you go to http://i.am.going.to.steal.your.identity.com/verif y.php [identity.com]' link in an email, none of it matters.

I can't think of any way of preventing that problem without there still being the possibility of a "man in the middle" attack...

Re:How long

You are right.
Just sign into http://paypalhardware.com/ [paypalhardware.com] with your credentials and they will send one out to you :)

Re:How long

There is nothing in a single sign on system to force you to use only one id. Using openid and the few sites that actually allow you to use it, I have already brought down my username password combos needed from about 10 to 2. So I can decrease the number of sign ons with systems like openid.

Secondly, as far as identity theft is concerned, my email accounts are already single points for attack. Once you have the email, the password recovery services will do your bidding. A single-identity-solution allows you to just shift this from email to some server which was created to keep and handle this data. Whats more you could be the one setting up that server... (not in the ms case but in the case of openid).

So, on the whole, single sign ons can work and openid hopefully will. I dont even want to rtfa. If I cant decide who keeps my username password for my single signon, I am just not interested.

Re:How long

[How long] Until the first site with a fake passport login form shows up? ...

It doesn't matter so much, it's not like MS WLID, formerly known as MS Passport can ever be made secure. It's fundamentally flawed from the design [avirubin.com].

However, all the bad press was about MS Passport, so a simple name change and, Voila, no bad press about the product. Palladium was sanitize the same way.

It's much easier than that

Go to Hotmail [hotmail.com]. You will see that Hotmail now requires you to login with Windows Live ID. Now, take a look at this page. It's a login page. They want you to enter your ID and your password. This is what gives you access to all the different services that are currently integrated with Windows Live ID, and will be integrated in the future. It's basically your "master password". Thing I'm trying to stress here: you shouldn't just give this out to anyone who asks. Ok, you get the idea.

So, first check you should do whenever you're logging into a page is what? That's right, check the url. "http://login.live.com/login.srf?wa=wsignin1.0&rps nv=10&c...." etc. Great, login.live.com, that's what I expect. Cool. Ok, so what's the second thing I should check? Anyone? Come on, it's web password security 101 here people. What do I need to check before I enter a login/password on a web site? That's right.. I need to check I'm on an SSL secured page. The url should start with what? https right? And I should look for the little lock in my browser window.. and if I'm feeling especially paranoid I should check the security certificate to see whether or not it is valid, not expired, and for the site that I am expecting.

This page has none of those things. Well done Microsoft.

Oh, but it gets better. There's this link that says "Use enhanced security". I would have thought that "enhanced" security was a sensible default, silly me. It's not underlined, so you don't know it is a link until you hover your mouse over it, but it will take you to a https:/// [https] page. Of course, the certificate it offers you is not for login.live.com, it's for graphics.hotmail.com. If you accept this certificate then you are basically saying that you're ok with trusting this data that didn't come from graphics.hotmail.com as if it did come from graphics.hotmail.com. Just for the hell of it, let's fire up this "enhanced security" page in IE and see what happens. Oh.. I see. We get no warnings. In fact, if we double click on the padlock we see that the certificate now IS for live.login.com. Hmm, what's going on here. Ahh, I see, half the content on this page didn't come from live.login.com, it came from graphics.hotmail.com.. so this isn't a secure site *at all*, it's a mixed domain site and IE's pitiful support for multiple certificates on a single page is happy to just ignore this (and doesn't even warn you).

XSS anyone?

Re:It's much easier than that

You forgot the part about keeping a sharply-peeled eye and making sure you are being served by live.com and not 1ive.com (with a numeral 1).

Re:It's much easier than that

You're a moron. How the hell did this idiot get modded up? Seriously?? The page you were served is http. The page you will post to for the login session https.

He's not saying that it doesn't use SSL to log in. He's saying that, as a user, he has no way to find it out until after he clicks "Submit" (and no, checking the HTML source code is not a serious option to consider). The convention for such things is that you use secure connection for the login form as well, so that the browser can indicate that it is secure (padlock icon, green or yellow address bar, etc - depends on the browser, but IE, Firefox and Opera all have such indicators).

Phishing?

What keeps anyone from creating a site (and/or spamming for it), saying it uses Windows Live authentication, then just farming a giant pile of logins they can sell or use for evil things?

No License?

Great... it's copyrighted and provides no license.

Re:No License?

Yup, grab the php package, you will see:

Copyright (c) 2007 Microsoft Corporation. All Rights Reserved.

and yeah, no license. So I guess implicitly you're not allowed to redistribute it at all.

just read the ToU

The ToU is on the downloads page: https://msm.live.com/app/tou.aspx [live.com]

Typical MS!

Solution looking for a problem.

With so many security and authentication issues inherent to MS products, this seems another case of marketing pushing faster/harder than the development teams can keep up with.

If it backfires for them, look for flying chairs...*ducks*.

Now we can all use Windows security - via the web!

There's no possible way anything could go wrong with this plan.

Article placement

Is it just me, or does placing this article directly above the Diebold rebranding article make you think of a theme common to both? Company loses credibility. Keeps trying to regain it, but still doesn't grok that you can't just make it *look* like you've changed your spots. You actually have to change your behavior, and regaining credibility takes a lot longer than destroying it does.

CardSpace?

Does this mean they've given up on CardSpace [wikipedia.org], which is built into Vista right now? I thought it was a much better solution to the need for single sign-on. Check out thechannel9 video [msdn.com].

Uh, what?

I thought Passport was outted years ago as being fundamentally broken. Why would I want to implement it on my site? Did they fix it? If not, why are they still using it at all?

-matthew

OpenID

I'd prefer to see the rise of OpenID [openid.net]. Now if Microsoft gave you an OpenID authentication point with your LiveID (preferably with something simple, like adding the OpenID <link> tags to login.live.com or even just live.com), that would be a feature worth using and supporting. And wouldn't require changing the sites that already support OpenID, including, AFAIK, the SixApart family of blogs.

With modern technology, diverse applications are a good thing (healthier market and better apps from consumer selection). Information, however, is more useful the more widely it can be read and used. Unless you are specifically trying to hide something.

Unfortunately, like Live ID, there seems to be more OpenID providers than servers that use them for authentication.

My old single sign-on method

I use 3 passwords for all sites I access mapping to 3 levels of trust. I try to use the same user id when possible :

Level 1 : risky

Level 2 : less risky

Level 3 : almost trustable

For sites that I really trust (banking, etc...) I use dedicated passwords. I, also, can forecast problems with a single sign-on scheme that would be more or less like giving away your social security number if hacked.

I have been working on this problematic before for big organizations and one conclusion we came up with was that we needed to re-use the old assembly language "indirection" principle, called pointers in higher level languages.

So basically, one has to be able to authenticate with multiples set of usernames/passwords combinations. Once the unique user is authenticated, the central authentication authority limits its role to just that, authenticating the user.

All authorization is managed by the local system that interacts with the user.

Do a search for MBUN on Google. In Canada, a user can have multiple MBUNs to deal with the government. This solution was implemented to cope with privacy concerns and still allow the citizen to deal with the government with the same level of privacy that was previously achieved with paper forms. Basically, what has been done is creating a mapping between the MBUN and the real userid and the choice has been given the citizen to have as many MBUN as he wishes to deal with the government.

Serious concerns should apply to too simplistic solutions ;-) Now for all /. MS bashers to enjoy : Although a qualified partner in the project, none of MS products where used to implement the solution. Given the money and the visibility at stakes, this caused a commotion in Canada with MS canadian VP putting pressure on everybody to reverse the decision.

Hey Sam, your products are just too simplistic and too proprietary. Phone us next year please ;-) That was really funny, the guy just couldn't understand that Macdonald's like marketing techniques did not work in this case. I mean, they even flew us for a week to Redmond at the campus to try to brainwash us, but still no go for MS.

-ls

OpenID

and how this compare to OpenID [wikipedia.org] ? (See also OpenID Enabled [openidenabled.com] for those interested in using it)

There is something I'm not understanding

What makes LiveID different from Passport or other auth systems? I'd like a way to sign in to multiple sites without having to remember and type a username and login for each one, but so far every solution for the problem has been widely rejected. What are the limitations with these single sign-ons that cause sites to prefer rolling their own logins?

System Requirements

From: http://www.microsoft.com/downloads/details.aspx?Fa milyId=8BA187E5-3630-437D-AFDF-59AB699A483D&displa ylang=en [microsoft.com]

Supported Operating Systems: Linux; Windows Vista; Windows XP

How's the wheather in hell these days?

Love that Ruby.

Looks pretty.

Why am I not convinced?

Well, it will inherit Microsoft's stellar security and perfect programming. Besides which, its a closed network unlike OpenID so it will be about as popular as Google's Account Authentication [google.com] which does the same thing but with Google Accounts. Even OpenID isn't that widely used, and it's an open system.

MS changing tactics

Putting the discussion on whether this is a good idea or not aside (you guys have already discussed that quite a bit), it's interesting to see how they are going about deploying this. I'm sure if they were doing this a few years back they would have provided sample code for MS sites and left the others to come up with their own implementations. It's interesting to see that more and more they are leaving their MS lock in tactics behind.

This is bad news

The worst possible things that could happen for widespread adoption of a universal login system are:

1. Competition between different standards.
2. Companies with profit motives pushing their own solutions.

It's like the whole HD-DVD vs BluRay issue. End users don't want to deal with choosing one or the other. It would be better for everyone if we could all just come together around one completely open standard.

The standard with the most momentum seems to be OpenID. I hope that a few years from now, I'll be using it for most of my web logins.

Why?

Why on earth would I want to, of all things, authenticate using a 3rd party propriety system from a vendor with proven business practices like MS? That seems like the very last thing I want to do. And I haven't even mentioned the outages, so your uptime depends on MS. What are you gonna do when that happens, call them? I have a much better idea, Bill. Why don't you use my unified login system. I've made a version in Visual Basic especially for you.

Terms of Use

Ever intending to compete against a Microsoft product?

you may not: use the service in a way that harms us or our affiliates, resellers, distributors, and/or vendors (collectively, the "Microsoft parties"), or any customer of a Microsoft party ...

Care about money?

We may choose in the future to charge for use of the service. If we choose to establish fees and payment terms for such use, Microsoft will provide at least one (1) month advance notice of such terms as provided in section 18 below, and you may elect to stop using the service rather than incurring fees.

https://msm.live.com/app/tou.aspx [live.com]

Hair of the dog

The solution to your headache -- a little more of the hair of the dog that bit you.

General purpose security? That's an oxymoron, mathematically speaking.

What we need to be doing is moving to dedicated browsers for financial and other high-security sites. But, no, Microsoft, in their wisdom, decides to tape single-sign-on on top of M$IE.

(Does anyone besides me read "MS Internet Explorer" as "Mi$iEry"?)

Dedicated browsers are only a stop-gap, but they could at least help getting the general crowds moving away from M$IE.

The concept never convinced me

The 'one password for everything' concept is fundamentally broken. It is like having one key for everything you own- your house, your car. During a vacation, I *want* to be able to give the housekeeper access to my house, but I also want to *prevent* her from going for a joyride in my brand new expensive car. The fact that I have neither a housekeeper nor a brand new expensive car is a minor detail.

MS ignores Python style guide

It is just sad to read the Python implementation of this functionality. Almost nothing is written according to the Python Style Guide [python.org]. Weird "__foo"-variables can be found, then it's not Python2.3 compliant because of ONE silly "staticmethod", many "getters" and "setters" which are just useless in this script. If MS wants to show their code to the scripting community, they should at least make it pretty and according to the language's coding standards. But maybe that is their understanding of "pretty". Who knows.

I think...

I think I would prefer Windows Dead.

Did ya see what I did thar?

Bring it on! Not!

Oh yeah I'd love to use an authentication system on multiple sites that forces me to re-enter my password in Firefox every time I visit hotmail.com!

Tears to my eye.

From the download page:

System Requirements

• 
     
• Supported Operating Systems: Linux;[...]

How far have we come?

MS adapts to market

New market: either proprietary web-based services (quasi-thin client) or a standards-based, PC-based market. Microsoft wants the latter, Google wants the former. Consequently, Microsoft is opening up to open source, as it will help it gain its goals.

The important thing to remember about corporations is that they're not evil. They're realpolitik. Their only goal is to make their stock price rise, so their stockholders go home happy. Stockholders are people like you and me who've bought Microsoft stock and want to make money off of it.

F/OSS is people power, which should come out and admit that it is opposed to this system. It's not anti-capitalism, but it is anti-capitalism, in its own way. I don't think it means bad by this. I compare it more to the volunteers who spend more time than most people do at day jobs to help their communities. But even that is insane from a capitalist perspective, since they could be getting $$$ for that time.

Uh... OpenID?

How is this different from OpenID [openid.net], other than that MS displays a massive not-invented-here syndrome?

Good Ol' Name Juggling...

Redmond Rule #92

"Whenever a thing coming out of our premises has caused a certain degree of skepticism, even mistrust, we'll just call it by another name and be done with it, for some time."

Not so fast, Microsoft. Passport, passport, passport.

There are people who will remember.

Live ID Announcement

All your users are belong to us!

Slashdot goes WLID!

Cool I can't wait till I can sign into Slashdot hosted on SuSE with my Windows LiveID! Seriously though... When .NET doesn't work, go open source and compete? Just another way to prolong a failing product.

What is top posting?

I was told I could get better 'placement' if I replied here.
I admit it was 'Anonymous Coward' posting - (Alas, I am not sure who he is) but- Is this true?

Thank you, Shushdot-
I remain, your most truthfully affectionate soviet servant.

Re:So what?

They changed the name

Re:So what?

Like the diebold voting booths? ;)

Re:So what?

Because MSN Messenger comes with most desktop computers, masses of people use the MSN thus making its closed system attractive for other people to join, new computers usually come with an "MSN Browser" on the desktop, most desktops come with Hotmail and other MSN bookmarks filling their bundled browser, MSN is often the homepage of these bundled browsers, the bundled media player has MSN built into it, etc. People might not like it, but it is forced down their throats anyway, and once that's been done most people won't go through the hasle of using an alternative.

Re:Passport used to be open

This is not really news, passport used to be open a couple of years ago when the bubble burst. No one really used it much so they closed it again.

Yes and no - the API was open, yes, but the problem with casual adoption of passport was that there was a large fee to get it into production ($10,000 I think, might even have been $10,000/year).

This is essentially no-cost but (as I've posted above) it doesn't look very professional to me - I think it's more suited to blogs login than corporate app login.