Microsoft Launches Passport 194
Microsoft today "launched" Passport. Passport is an on-line wallet service, meaning that all your billing and other information is stored centrally with Microsoft, so that you don't have to retype it every time. Passport was used by a few Microsoft sites before, but with today's announcement, an additional fifty or sixty sites have adopted the technology. While my initial concerns were about privacy, they were mostly (but not completely) covered by the aforelinked press release. A news.com article cites a research analyst as saying that one day, Microsoft may wish to take a percentage of the profits, and go for a monopoly on e-wallets. Certainly is a lot to speculate on here...
If you have to do this (Score:1)
How Microsoft will make E-Wallets stick (Score:1)
Sound familar?
(Looking at real wallet full of "Price Club" cards.)
Re:percentage of profits? (Score:1)
Re:Not particularly new. Not particularly exciting (Score:2)
But I don't trust Microsoft to take my credit card number and selectively make it available to others, in the mould of Microsoft Passport. That seems like a far riskier proposition than trusting them for a single order.
D
----
Re:A little reality check... (Score:1)
There's still _some_ private information going from your browser to the vendor telling them how to charge you for the product, whether it's a CC number or a Passport ID.
And, it's removing responsibility for care and caution from the user and putting with a large corporation. How long before the _capability_ of using care and caution is removed from most individuals? We're moving in the wrong direction. Instead of hiding things more and more from the user, we should be empowering the user, and teaching them. Making things easier and more understandable does not have to mean less empowering and flexible.
Which reminds me, I'd like to see a Linux distro whose main purpose was user-training. A distribution with help and training info built in as you go, so that the process of installion is necessarily also a process of learning the Linux system.
Re:scared? (was Re:Nothing new under the sun) (Score:1)
I *do* have *two* shiny plastic fish on the back of my car, but one says "Darwin", and has feet, while the other says "Linux" and sports a shark fin. (thanks to the gang at www.thinkgeek.com). I also have a pentagram sticker in the back window, next to the AOPA wings and rainbow triangle. :-)
Paranoid? No more paranoid than to want to have personal control of my personal information, and to want to hold the reins on my own use of strong crypto, when I think it's necessary.
So come up with something better. (Score:1)
Re:The Top 1 reason. (Score:1)
How it works. (Score:3)
Basically, it's to keep your credit card number from EVER crossing the ether using a public/private key challenge system to log a transaction. The site you visit bills Passport, Passport bills your credit card, and the number never goes anywhere. Since each transaction is logged seperately using a different ID, you can review your transactions online (theoretically) and make certain that they were all transactions that you ordered.
Me? I'll avoid it like the plague. This is MS, after all.
Oh, and I only tested software there. Don't blame me - they didn't listen to me when I found the bugs, so it ain't my fault. ^_^
Re:Tracking like cookies? (Score:1)
Microsoft has NO fear of free software. In their latest monopoly they go one step further. They can now give away (and even pay you to use) Windows 2000 because every purchase you make will line their pockets. Every single purchase adds more $$$$$$$'s to the coffers of Microsoft.
But only if you use Microsoft software. And everyone will.
...Except me. It's Y2K but yet worse. Even as I type this I am buying a shack in the middle of nowhere with no connections to the outside worlds so that I may not be scared by evil.
-Brent--
The Top 5 Reasons this is a Horrible Idea (Score:5)
4) Creates a massive SPOF. What happens if the passport servers are off-line? Can I still shop with my AmEx or are the stores basically out of business?
3) Okay, now instead of Visa charging 1% on all of my transactions, I'll have Visa charging the retailer 1% AND Microsoft charging the retailer 1%. Likely result? They'll pass the costs to me!
2) If a large amount of people start using this, then smaller on-line retailers will suffer. Yay, monopolistic control of another market!
1) Who will audit this? Who will ensure the security? Microsoft? This isn't a microsoft bash, I wouldn't trust ANY company to audit themselves properly.
I've seen this coming a mile away from the beginning of the browser wars and the rumbles about microsoft owned websites. The obvious hope is that by having control of the desktop operating system they have control of the browser. By having control of the browser they have control of the sites initially visited by the user (an exceedingly large percentage of people don't change their startup page). By having control of the sites initially visited, and leveraging this "e-wallet" they also make money from every purchase.
Ah well, such is life in corporate America.
Choose M$. Choose being a marketing statistic (Score:1)
It seems a major worry that the all powerful and o-so-trustworthy M$ will become the central cross-roads to a bulk to electronic trading on the net & be the holder of such important market research statistic... From where I'm standing it seems to be just a bit of a scam to help along M$'s marketing juggernaught. With each registered user, M$ is gaining a valuable and accurate segment of gigantic web-market shopping demographic. They will be able to track and analyse the spending patterns of all their registered users for next to nothing. Would you really want M$ to have the means to leach off information like that off you? TO me it's just another piece of the jigsaw that will just add to m$'s profit maximising schemes
AT the moment you can usually CHOOSE whether or not you become part of a particular company's marketing survey or not. By choosing M$ wallet you are essentialling signing yourself up to volunteer, perhaps unwittingly, to help out with M$ massive marketing research department. Doubtless, this will just lead to M$ finding more ways to rip off poorly-informed e-commerce users.
Re:Yeah, ok, sign me right up (Score:1)
Who's making stuff up? (Score:1)
Microsoft's not the first (Score:2)
Novell's also talking about freely releasing some of the digitalme tools--of course, you'll need Novell stuff to do it, but it's a start...
Durrrr.... :) (Score:2)
Solution already in done: EDI (Score:1)
I'm sure EDI has a transaction type for this sort of thing already.
I'm wondering about your spam prevention. (Score:1)
I don't trust Microsoft... (Score:1)
Ridiculous. I don't trust M$ one bit on this.
emufreak
www.kontek.net/pp
Tracking like cookies? (Score:1)
Will microsoft care?
I think Ill be staying away for a bit...
"Only" Microsoft? (Score:1)
if you really want protection: (Score:1)
Correct. The battle was lost when the credit card was invented. If you're really that worried, use cash/checks. Cash only, if you want to be that paranoid. Taking it a step further (and a rather ridiculous step to me) keep your money in your mattress (figuratively; i.e., don't have a bank account if you're that worried) and then you'll know where your money is and all that jazz.
Re:Nice try... (Score:1)
-WW
Re:Nice try... (Score:1)
"Freedom is the distance between Church and State."
-WW
Yeah, ok, sign me right up (Score:1)
Not to mention, I get a bit paranoid when M$ is involved in anything regarding personal finances.
Re:Um... (Score:1)
We ARE talking about M$....
Another article. (Score:1)
This article mentions that AOL and IBM also offer an e-wallet service, although the data is stored on your local computer and NOT on some corporations marketing database.
Someone have exeperiece with the M$ e-wallet? I'm wondering what the increase percentage in junk mail is (e-mail, snail mail, AND phone).
~afniv
"Man könnte froh sein, wenn die Luft so rein wäre wie das Bier"
Re:Not particularly new. Not particularly exciting (Score:2)
Perhaps the misunderstanding comes here:
In actuality, the card authorizers, accounting departments, etc. all require audit trails for everything, including card numbers. The last retailer I worked for kept this information for at least a month in the "live" system and essentially forever in their backups. They weren't unusual.
They have to save this data for the simple reason that if you contest the purchase, they have to be able to show what actually occurred. Not to mention the plethora of systems problems that might require the retailer to go to original data simply to get paid.
(Of course, the marketting department often gets its greedy little mitts on the data, but that is a different story.)
It is actually much easier to intercept a phone conversation then to install a packet sniffer. It takes only a few dollars worth of equipment from radio shack. (And lest you think that this is rare, the people two houses from me down got a $900 phone bill last month caused by two kids who did exactly that.) Also, in a phone conversation, you are essentially giving your card number to someone who likely makes around $6/hr.
One of the advantages of e-Commerce is that fewer people see your card number. In fact, if all goes correctly, no human being will actually see it. Contrast that to real world purchases, where we often hand our cards to low-paid teenagers without thought. (Most of whom are honest, but it only takes one with a head for numbers...)
Oh, great. (Score:5)
But hey, I'm sure Truste will assure us that everything is A-OK. And if we do get robbed, they'll be quick to assure is that it won't happen again.
p.s. -- I wouldn't even sign up for this if someone other than Micorsoft were doing it. So you can imagine how I feel about having someone so security unconscious as them managing it.
--
It's October 6th. Where's W2K? Over the horizon again, eh?
ewallet (Score:1)
Re:How it works. (Score:1)
That sounds exactly like what First Virtual was doing... First Virtual doesn't do this anymore, I don't know why they quit. Anyway, this isn't very new, so what I'd like to know is: are there any other companies providing such a service at the moment?
Re:Megaservice... (Score:1)
Please be careful with such suggestions, we don't want to give them ideas
--
Kind of makes you wonder... (Score:1)
How many hotmail-esque security holes are in the newly rolled out passport service. I ditched my hotmail account after that little snafu (you know, the one where any hotmail account was open by just a simple little script, glad I don't have many enemies...) that M$ didn't even address until like 48 hours after it was exposed. All these poor morons months later when a similar exploit is revealed on the passport security system. Glad I won't be one of those morons...
Deitheres - Master of... er... something.
-- .sig files go when they die?
Child: Mommy, where do
Mother: HELL! Straight to hell!
I've never been the same since.
Hey... (Score:1)
I wouldn't touch that shit with a 10 foot pole...
Here's What You Do (Score:1)
I think I'll wait until smart card technology becomes more prevalent so that I can swipe my card when I want to make a purchase. There is no way in hell that I will relinquish purchasing power to Microsoft. Sheese, I don't even want to touch any of their crappy products.
Alternate Press Release - N in a series of M (Score:5)
Yeah, you there, the guy using the mouse as a foot
pedal!
Do you hate having to type in a shipping address
every time you order on the Internet? Or worse,
are you having trouble remembering your own
address?
NO PROBLEM! Microsoft is here to help! We'll take
care of all those pesky details for you. Our new
Passport software is your ticket to a stress-free
junk-filled life. The next version will even wax
and declaw your cat for you!
How much would you pay for this amazing piece
of ultra-modern technology? $50? $100? $1000?
Well, hold on to your hat! Microsoft are giving
away Passport for absolutely nothing!
That's right! In exchange for a complete personal
profile, including address information, and credit
history, which as we all know is worth absolutely
nothing to anybody, Microsoft will give you
Passport, a passport, if you will, to a future
of black velvet elvis paintings at knockdown
prices.
Worried about security? Don't be. Your most
private personal details will be stored in
the most secure form known to science, a
"hard disk". This revolutionary device encodes
information using the science of magneticism
in a form far too small for the human eye to
read. If a hacker were to gain access to this
"hard disk", he or she would never be able
to read the information it contained, even with
a high-powered magnifying glass!
Just remember, Big Brother is watching you, and
he cares!
[Insert standard EULA and disclaimers here, in
really small writing so the suckers won't bother
reading it, haha! - BG3]
K.
-
With crypto it's all possible... (Score:1)
Microsoft is smart enough to get the basic protocol right. I have no doubt that they've thought this part through. What worries me is that hordes of script kiddies will scrutinize this newly created gold mine and eventually find something to exploit (as with Hotmail).
Re:Preaching to the choir (Score:1)
I think you mean "/."
"\." means "whackdot"
The crypto prevents fake transactions. (Score:1)
Why not a client app? (Score:1)
No central database, you have total control over your own data.
Perhaps this app could keep track of what you buy and if you want you could sell this info to mass marketers...
Oh my GAWD!!!! (Score:1)
--
grappler
Re:Oh, great. (Score:1)
Preaching to the choir (Score:2)
The issue is, how to get the word out to all those happily blind folks who think the 'integration' MS offers is the best thing since cheese coming in indivually wrapped slices. Most every MS supporter out there likes the MS products cause they're easy to use and everyone else uses them- and they support such with the same vehemence the anti-MS crowd voices.
So, do we pray that an Open Source model of such a thing is quickly offered as an alternative? I doubt that would work as speed is not a common OS trait, and more people would be less likely to trust such a thing in today's mindset.
So who will be the alternative? Would a banking coalition be a better alternative? At least they've historically protected accounts, mostly.
Or perhaps the issue is to point out to people that simply putting your CC#'s in a pswd protected tect file on your HD, then open it, copy it, paste it, into an order site is just as quick as 'assport.
I mean, sheesh, I'm all for saving time, but it takes, what?, 3 minutes to fill out an order form online?
I would NEVER use such a service provided by ANY company which has shown such blatant disregard for the consumer as MS. Of course, 75% of the population is unaware of these tactics. So 'assport will be the default until someone cracks it and folks loose big money.
Perhaps they can apply for FDIC?
Credit Card companies do it already... (Score:1)
If a start-up retailer has the choice of a percentage of sales or a huge one off investment in order to get up and running with such a system I'd say the percentage is preferable.
Ideally there would be a buy out option, but no doubt if youre big enough (Dell?) you can negotiate the percentage to something tiny or just pay a lump sum.
how long until it breaks... (Score:1)
Its a good idea, but I personally don't like it as it gives MS too much data and thier security concerns are usually about 10th on the list after making money. Although the data isn't stored remotely the transport and the demographics could be recorded and used elsewhere.
I'll avoid sites that force me to use this, at least for a year or two so that I can see what weaknesses occur and what microsofts long term plans are.
It sounds like the usual MS cycle - 1) introduce new technology 2) lock up the market 3) slowly start squeezing every cent out of the users that is possible...
It's all marketing.... (Score:5)
Microsoft teams up with some of the bigger e-Commerce sites, Amazon.com, eBay, Reel.com, whomever, and says, "We'll give you a bunch of co-marketing dollars to start using Microsoft Passport." Of course, the sites go for it because they just want to make money.
"Everyone" is already using Microsoft Internet Explorer because it's part of Windows and "everyone uses Windows." Next time an MSIE user goes to one of those sites, a new AciveX component will download and they'll get a little message, "Try Microsoft Passport - we'll handle your billing for you! You'll never have to enter your billing information again!"
The average user isn't going to have any idea what's going on - they only know that they like Amazon.com's "One-Click Shopping" option and if they can get ALL websites to act like that, even better! Clickety-click and their data goes straight to Microsoft.
It's not about the security or technology -- it's all about how well you can market and making it easier for the sheep to follow the rest of the flock. Hence Microsoft's dominance.
-=-=-=-=-
This is scary stuff (Score:3)
What irks me is that management just doesn't see Microsoft as a competitor. We shouldn't be buying any of our competitor's products, because we are funding Microsoft to move into our own markets.
I'm afraid they won't see it until it is too late.
Look out for "free" computers... (Score:1)
"Intel P266, 4 gig HD, 4x CD-ROM, 15" monitor, color inkjet printer, and 1 year of FREE internet access via MSN with $1000 credited to your Microsoft Passport account!"
Waiting for the first spotting...
Mmm Cheese... (Score:1)
Mmm swiss-cheese code. Yummy.
Re:Amex Blue (Score:1)
I just went through the Passport [passport.com] setup process to see what they require. You do have to supply a password which "
"But you also give them a question to ask in case you forget your password and there are no requirements for the complexity of the response, (in fact this process almost ensures that a dictionary word will be used by the typical user, though they do warn [passport.com] against this.)
Also, this whole process apears to be done unencrypted (at least it doesn't use SSL) except your password is masked out. (The answer to your question aparently isn't).
Since MS is trying to establish a standard for ecommerce, you would think that at a minimum it would require something more secure than an 8 character password (ie 36^8 possible solutions roughly equivalent to 40bit encryption). Also note that when you sign-in to passport, it isn't over an SSL connection either. Also, hotmail users are being encouraged to use their hotmail username/password for their passport account.
Actually it's even better than that... (Score:1)
According to this comment [slashdot.org], which should really be moderated UP...
The credit card numbers stay on Microsoft's server. Store gets a charge authorization from Passport via secure challenge/response and BILLS MICROSOFT. Microsoft then bills you, having never given your credit card number to ANYBODY, even encrypted.
It's a great idea. But I'll never use it - as I've said before, I trust the protocol entirely, I just don't trust Microsoft to keep a server full of credit card numbers away from the script kiddies.
Re:It's all marketing.... (Score:1)
Consciousness is not what it thinks it is
Thought exists only as an abstraction
to buy or sell you shall need the mark o the beast (Score:1)
Warning! A secret timebomb written into windows has noticed that this is not the original installation of windows on this machine. According to the extremely small print hidden on the microdot of your Windows liscence, this is considered piracy. Deducting $400 penalty from your MicroSoft Wallet account.
Error! Your Microsoft Wallet account contains only $235. Initiating automated legal action. You should recieve a summons in 5-10 business days.
Destroying this computer via the secret motherboard bios and Intel chip AntiPiracy features.
Warning! This PC does not have the Intel chip AntiPiracy features. This PC appears to have been built from components, rather than purchased from a liscenced OEM dealer. This is considered probable cause in your state, thanks to our legal department, second only in power and trechery to the Scientologists. Sherrif's deputies are on their way to the address listed in your Microsoft Wallet account.
Alert! The microphone on this system heard you chuckle at the Scientology joke above. The Church of Scientology has been alerted and should be starting legal proceedings in 8-10 business days.
In the future, you can check your PC for priacy violations with MS Piracy Check, for only $699 at your local software store. It allows for automated hardware and software piracy checking, as well as on-line plea bargaining.
The application page IS secure... (Score:1)
Look at the source. The form submits to an https address. Which means the data you enter is encrypted via SSL when it is sent.
I'm not sure why so many people use forms that submit securely but are not retrieved securely. If it can confuse slashdotters (as it has more than once) it's bound to confuse the average moron...
Of course, you're right about the password. The problem is that if they did it correctly (using actual keypairs and certificates) it would take too long and your keys wouldn't automatically be usable from any browser as they are now. As is you can use your Passport account from anywhere - set top box, Palm VII, cafe terminal, whatever.
Consumers don't want security. They want convenience and the ILLUSION of security.
Re:Crazy Idea (Score:1)
But it's not really buggy, open-source, and horribly behind schedule. So I don't think Slashdot readers want to hear about it.
A little reality check... (Score:5)
I'm no m$ "believer", but I do use their stuff (as well as Solaris/Sybase/perl/java etc etc), and I guess I differ from some people here in that I don't automatically assume everything Bill touches is useless.
So what's with the Wallet? Well first off it clearly states that the wallet itself (and by extrapolation M$ and their retail partners) will not actually have anything to do with cash, credit or clearing. So the posts about getting Fed Res clearance are really a bit lost. All Wallet does is store your CC number(s) and delivery details in a central db. This info is supplied as required to the vendors, to enable them to perform a transaction. The transaction itself is still between the vendor and the CC company. (This is what I get from reading the press release - if anyone has any more practical info on how it works please let us know!).
Now lets evaluate
In theroy this is a great idea. The major security risks in online commerce are twofold - (a) Someone intercepts your details in transmission to the vendor, or, (b) the vendor acts dishonestly/carelessly. If the link from MS->Vendor was secured beyond the level usually used in a browser, then the risk from (a) is lowered dramatically. Also, as the novice user will be encouraged to only shop at "certified" stores, the risks from (b) will be reduced.
But of course we don't know what M$ plan implementation wise, and there are huge doubt's about their ability to secure a large system properly. To be fair, I think that in several cases (notably Hotmail) their security is no worse than anyone elses, they just get targetted more. This is not an excuse for not being proactive though! The questions I would ask are:
* How is the link from MS->Vendor secured?
And I want details!!
* Who will be liable in the event of dispute?
This is an important one, usually (here in the UK anyway) if you have a dispute with a vendor then legally the CC company is equally liable to pay you back. If they cannot prove you authorised the txn, then you cannot legally be billed for it. SO assuming the CC companies are on board with this one, they will have to sort out a good way that disputes can be settled quickly and in most cases in the favour of the client. I personally don't care that much if fraudulent txn's go against my card, provided I don't end up paying!!
* Are the CC companies 100% on board with this? Will we get them trying to wriggle out later saying they never approved this for payments and so denying liability?
* Can we have some kind of external audit of how the data is used. I'm not really worried about some kind of big brother m$ collecting info about which pr0n sites I subscribe to, rather that I would prefer they didn't send my home address to their marketing dept. In the UK there is law regarding this, which they would have to comply with, not sure about the legal situation elsewhere.
So assuming all these questions were answered to my satisfaction, I'd probably be fairly happy using the system. Implemented well it would be a positive boost to online security and convenience.
Adam.
Bill Gates to Get Half (Score:1)
(An old'un but a good'un.)
Regards, Ralph.
Re:The Top 5 Reasons this is a Horrible Idea (Score:1)
But, what if you disabled electronic transfers between them - no bank could xfer funds to another. In very short order you would have pure chaos! Especially after everybody realized their money wasn't instantly available and rushed to get it out "before everybody else does".
Yeesh... I can see the headlines now - "Microsoft's Crashing OS Crashes Global Economy - film at 11".
--
Passport and Hotmail (Score:1)
Re:The Top 1 reason. (Score:1)
Someone goes to the passport server facility. Has bug guns. Takes systems.. or even just BACKUPS. I can guarantee your trusty financial institution will be GLUTTED once it hit CNNfn.
Come on people... it happened to Cyrix.
Roger
Re:percentage of profits? (Score:1)
Re:Here's What You Do (Score:1)
Yes. Smart cards I can swipe at home. Is https locked-down enough to ensure that privacy? Can the bad guys crack such a 'secure' transmission?
I need to read about Amex's Blue thing, but yeah, why not have all banks do this? I wanna buy sumptin, I swipe my credit card, the website directs it to the issuer, they bill...
Why does MS have to be involved at all?
Why is this so bad...? (Score:1)
I'm sure people said the same things about credit cards when they were first introduced. "Oh my, if someone gets my number, they could buy things with my money!" This indeed turned out to be a problem with credit cards, which is exactly why it was addressed, and now you are protected. You can dispute charges on your card with any reputable credit card company.
If this privacy/cracking issue is such a big deal (and it is to consumers) then it will be addressed or people simply will not use it.
Don't give too much credit to microsoft and not enough to the average consumer.
LL
Re:A little reality check... (Score:2)
Well, at least this time, we don't need to assume.
Good god, man! Do you have any idea how evil this sounds? It looks like a) An excuse for keeping decent crypto out of the hands of end users. b) A way to restrain trade.
If the link from vendor->MS is secured beyond what is typical for a browser, then don't you think it would be better to improve the browsers? And do you really think this will offer more consumer protection than credit cards already do? There are already enough barriers to starting a business, we don't need another one.
---
Re:The Top 5 Reasons this is a Horrible Idea (Score:4)
Too late for that. If you buy from catalogs, or buy on the internet, or shop at the grocery store with those "club" cards, the battle is lost. The data is being collected, and most likely exchanged.
The only real way to prevent that is to only use cash.
4) Creates a massive SPOF. What happens if the passport servers are off-line? Can I still shop with my AmEx or are the stores basically out of business?
It would obviously be in the store's best interest to keep a backup system that works buy taking your number directly. Stores would have to have this anyway for customers who aren't in this program. No retailer is going to turn you away because you don't use this system.
3) Okay, now instead of Visa charging 1% on all of my transactions, I'll have Visa charging the retailer 1% AND Microsoft charging the retailer 1%. Likely result? They'll pass the costs to me!
Perhaps not. This will likely lower their liability as the chance of some two-bit small retailer absconding with the card will go down. Remember that if someone charges $5000 on your card, it costs you $50 max and the retailer's involved $4950.
2) If a large amount of people start using this, then smaller on-line retailers will suffer. Yay, monopolistic control of another market!
It should have the opposite effect. It should make people less fearful of spending at a site they know little about. They are more likely to push "submit" at "Paul's Pleasure Palace" if they know that they aren't actually sending their card number to Paul.
1) Who will audit this? Who will ensure the security? Microsoft? This isn't a microsoft bash, I wouldn't trust ANY company to audit themselves properly.
Then you better not be spending online. If you've bought anything for Microsoft online, then you've already given them exactly the same info that they'd have here. Same goes for any other company you've got from.
The concerns about "corporations having my information" are very valid, but unfortunately, this battle is pretty much over. The battle was basically lost before there even was "e-Commerce".
Working at the headquarters of a major retailler, I used to see huge, hundred page printouts of charge numbers just laying on a table outside of an unsecured room. Those charge numbers were given to the company by customers at their brick and morter stores. Those numbers were also used for "marketting purposes".
Solution already in progress: ECML (Score:1)
Soon MicroSoft will be joined by real competition here. See: RFC2706 [faqs.org] (ECML v1: Field Names for E-Commerce)
No doubt they're checking into it (Score:1)
Guess someone could just ask them. I think I'll e-mail mudge.
J.
Can somone Explain why I need this service ? (Score:1)
Re:We are supposed to trust M$?!? (Score:1)
Consigning your credit information to an online bank is problematic at best, but to use M$ with their demonstrable inability to understand system security sems like, well, the act of a total sucker.
So if I was a crazed marketeer (M$ as we all know is not a software company but a marketing arganisation), I'd love to test my client base's trust in my 'brand' like this.
No, surely not...
Novell DigitalMe (Score:1)
Passport Primer (Score:2)
The slapped a "Passport ID" inside the "dat" (user login file) file for every user already on hotmail.
Then, they made changes to the Hotmail DB lookup system so that it could be used in other implementations.
On all of these sites, they query the hotmail db's, they check the passport ID's, and boom, you're logged in.
Basicly this was a fairly good attempt, regardless of the implementor or who's pocket it came from, to start a centralized password database.
Believe it or not, the only thing that really needs to be feared from hotmail employees is when you piss them off. There are 45+ million different accounts. It's alot of effort to get into those machines to see such text. There's about 15 people who have access to it.
Microsoft may own Hotmail, but they have no direct footage to "look at the information" for their own needs.
Hell, the FBI had a hard enough time.
Anyways..
-An ex hotmail internal veteran...
Railroad Crossing Cell Phone (Score:1)
A bank analogy (Score:1)
Yahoo. (Score:1)
Let's see now..
"many consumers simply give up, leaving a full shopping cart."
"Ok, I'll have that, and that and ok now to purchase... what? I have to fill out my name address and CC number? nah, forget it."
People who give up when confronted with a request for 3 pieces of information must lazy in the extreme.
Besides, I like to do things like misspell my address (a little bit!) and then see how much junk mail arrives with that address
"The sites must also post a link to their policy from their front page, so that consumers have an easy time finding the policy if they want to review it. "
And how many people who can't be bothered filling in thos pesky online forms are going to follow some (no doubt tiny) link and read through 15 pages of a vendors privacy statement? Not too many.
Oh well.. same ol' "yadda-yadda-yadda-embrace-extend-assimilate-yadd
I'll keep my demographics and CC details with me
Hey, kicking!! (Score:1)
Maybe Taco and Hemos could post their credit card details in a "secret" file on
***scan***scan***scan
jsm
An open source wallet that actually works, now. (Score:2)
'net currency that not only works but has worked for three years+, whether or not I've
been able to get much media coverage of that fact.
http://www.systemics.com/docs/ricardo/ has information on the underlying source, etc.
http://www.cryptix.org/ has information on strong java crypto (also open-source).
http://www.digigold.net/ (under construction) has more information on the currency.
http://www.e-gold.com a 100% metal-backed (gold, silver, platinum, or palladium)
currency.
http://www.FlyingRat.org a spam blocking service using small (or not so small) e-gold
payments.
Yes, I wish this stuff would get more notice than it has gotten. Yes, I'm sure some of
you will say this is "spam." (Get over it.)
JMR
Re:Another article. (Score:1)
The only benefit for the server model is that you could buy stuff from any computer, just by (somehow) accessing the Passport information. Of course, there better be some fairly sophisticated [read, cumbersome and inconvenient] password protection on Passport, then. And then, wouldn't this add to the inconvenience of the shopper?
The client-side models require you to input the information (only once, of course) on each of the computers you want to spend money from. Now, this doesn't seem like a huge inconvenience, really; certainly contrasted with the potential inconvenience of having somebody with evil intent [not naming any names] getting a copy of the server database.
I was disappointed, but not particularly surprised, that there was virtually no reference to security in the PressPass "Q/A" report. There were absolutely no assurances about what protection Microsoft would employ to keep your data private, no assurances whatsoever that Microsoft wouldn't abuse the information. I found the example of storing the address of your parents, say, with Microsoft particularly chilling. What a remarkable web of consumer information could be woven if everybody input their personal relationships into the Microsoft monster.
The page on passport security and privacy [passport.com] also, remarkably, passes up any opportunity to reassure users that Microsoft won't misuse the information that you give it. They do say that they won't share your personal information with others, but it will get to the point (if this is successful) that the rest of the world could be ignored, to a first approximation. There's nobody that I'd be less happy to have this information than Microsoft, themselves.
I predict, sadly, that this will be a spectacularly successful product.
thad
Not on my computer... (Score:1)
This idea doesn't sound like they are really interested in helping the public for online shopping so much as it is another way to increase Microsoft's revenue stream. Here's a thought...Microsoft knows they can't keep the prices of their products artificially inflated forever...this is just another stab at replacing the cash cow, perhaps. I'm not one given to conspiracy theories and all, but it sounds like a strong possibility to me.
Passport is more evil than previously thought (Score:1)
Where is the Passport profile and wallet data stored?
All Passport profile and wallet information is stored on secure Microsoft servers. Passport is subject to its own privacy commitment to its members, which prohibits Microsoft from sharing or selling members' information without their consent. Participating sites will also be able to store core profile and wallet data on their own servers. [my emphasis]
WTF is this? not only do we get the world-recognized insecurity of MS, but they have the option of whoring out Passport users' CC numbers to other parties?
*sigh*
Money-Hungry-Microsoft (Score:1)
Re:Preaching to the choir (Score:2)
One hopes the FDIC has better sense than to insure this arrangement.
--
It's October 6th. Where's W2K? Over the horizon again, eh?
Where's the RFC??? (Score:1)
The first problem here is how in hell's name does anybody verify the security and privacy of it? MS do not have an inspring track record when it comes to security, and although it may be unethical to sell on info and stats gathered, who considers MS to be above doing that?
Another consideration is the infrastructure of the Passport database server system. Scary thought: Passport (tm) becomes the standard for online shopping, vendors worldwide rely on this system, and MS use a single NT server... Can anyone spell downtime...?
Seriously though, the passport idea is required by today's online community. And unless better alternatives are presented to the general public, Passport could well become essential in any online transactions. Are there any other real alternatives?
But most importantly of all... Where's the damn RFC??? :^)
Re:percentage of profits? (Score:1)
I'm sorry if this seems like Microsoft bashing, but it is a ridiculous that a single corporation can "invent" currency on the internet and then lobally tax all expenditure on it, which is what this amounts to.
And this is diferent than Visa, Microsoft, and AMEX how?? Its ECON 101 - if MS can establish their "currency" as the dominant form for Internet transactions they have every right to charge as much as they want for the product. Its not a tax - its the free market. If the 99% of the Internet population that is obviously not as bright as the average
Am I going to trust me private data to MS? No way - I'll happily manually type in my credit card number every time. What we really need is an anonymous payment system so we can buy stuff online without the trail of personally identitfying credit card numbers...
Re:How it works. (Score:1)
If this is true, why aren't they publicizing it? I assume it would be obvious from your credit-card statements.
Is there any documentation that you could point to that would verify this astonishing claim?
thad
Re:Yahoo. (Score:1)
Re:Yeah, ok, sign me right up (Score:1)
Uh-huh... (Score:2)
Next week, I'm gonna let Bill Gates and Steve Balmer perform open-heart surgery on me, too.
- A.P.
--
"One World, one Web, one Program" - Microsoft promotional ad
Re:How it works. (Score:1)
I'm sure this is an oversimplified view, but the net effect to me it's just another number that someone could exploit. I don't think that the small amount of added convenience is worth it given Microsoft's security track record.
Is it possible to keep this database open ? (Score:1)
Unfortunately, it might mean seeing Microsoft getting a critical mass of the market where it can afford to dictate any terms it wants.
Do you think there is any way that an open project can compete with Microsoft's wallet service ? Or are we at the mercy of the evil empire ?
Oh. Really now, thanks but no thanks. (Score:2)
amex seems to be doing this with the "blue" card in some ways.
Sounds cool. But i want some real company about privacy that gets nastily audited for this, not microsoft.
I don't get it. (Score:4)
I can understand why someone would want to avoid having to type in their card #, address, etc over and over again, but -- call me clueless -- why would I want this info on a central server rather than my own machine?
The "obvious" approach seems to me, to have a standard format for querying billing info, similar to how cookies work, and then have the user's machine pop up a "Supply/Deny" question. Why aren't they doing this?
---
Um... (Score:2)
My current credit card company has very good anti-fraud policies. What's the point of adding a second layer of cost and complexity?
--
Re:Passport security hole (Score:4)
When passport was first announced more than a year ago looking for early implementers, the serious hackers targetted it with an intensity unseen in recent years. Imagine a service with all the quality of a M$ product, the track record of M$ for lax security, holding thousands or millions of credit card numbers.
This is an infocriminals dream, because just one copy of this database could be exploited for billions of $$$ of bogus charges. There are organized crime groups around the world already set up to rip off the credit card companies with thousands of electronic scams. All they need is a valid credit card number, expiration date, and the holders name.
So when the hotmail hack was discovered, it was by a group probing every aspect of the passport service, and all the connections MICROS~1.OFT was making into other web sites.
Now there are hundreds of sites with an end point leading into passport. What do you want to bet that one of them has some other security problems because they run IIS, and some crackers will be able to get thru the encrypted tunnel back into the passport service. Not likely they will get more than a handful of CC numbers before the hole gets closed. Crackers tend to be immature kiddies looking for some attention, so they will blab about their exploits. The serious infocriminals will milk any hole for all it is worth, and not make any announcements to HNN [hackernews.com] or attrition [attrition.org].
Microsloth's only publicly acknowledged security aspect of passport is they are going to seed the database with 'tripwire' records, which will trigger anti-fraud measures when someone tries to use them with the CC companies (oh, and they use encryption [slashdot.org]).
There are rumours it will be built into the desktop of millenium, so it will always be a click away, with annoying warnings to those lusers who are not using it. I doubt this service will become widespread, since it is bound to get abused at some point. Public confidence will go down when the press has a field day when the system is cracked once, even if it doesn't lead to the loss of any CC records.
the AC
Re:How it works. (Score:2)
Thank you for explaining that. Geez, I wish the press release had been as informative.
Well... here's my Paranoid Conspiracy Theory Of The Day: the US government is behind this. (No, I actually don't believe this, but I'm going to make a case for it anyway, just for fun. :-)
It's in the Feds' interest to do this for two reasons:
---
Not particularly new. Not particularly exciting. (Score:4)
Basically, Amazon saves your card number the first time you buy, so that when you come back, they can say "Charge card XXXX XXXX XXXX 1234?". The fact that you don't have to key the number is only a trivial advantage. The real advantage is that you don't have to send the number over the wire. Amazon knows what it is already, so they can simply charge the number they have, avoiding the need for sending the number where it could potentially be seen by evil criminal types.
(An overblown danger, but that's another story...)
This is all a good thing. It is not even a matter of "trusting" Amazon more than you otherwise would, because simply to buy things, you've got to trust them with your number. They will have it, and they will be saving it for financial purposes for at least a month, regardless. If you don't trust them with this, you shouldn't buy from them. (Note that the same goes for any retailer, internet or physical!)
Now most people probably trust a company like Amazon at least in terms of finances. Amazon is not likely to go charging your card up randomally. Most people assume they will be fairly careful with your number. (They probably won't be as careful as you think, but that's another story.) They are a big, known company. Where the trouble comes in is with tiny little companies that no one has ever heard of. Do you trust them with your number? That officially looking site could just be one guy in a basement. Give him your number, and you give him the ability to charge thousands of dollars in your name.
So what to do? An obvious solution is to do what is being done above. You give your charge number to some large company that you know will not abscond with it, charging it to the limit. Then you tell the little podunk companies to charge the big company. Your liability goes down. Your charge number doesn't fly across the wire every time you make a purchase from a new company. These are good things. This is more secure then sending your card number directly to everyone you buy from.
The only question is whether or not you trust Microsoft to secure your data. This is the same question you should be asking were you to make a purchase from Microsoft over the wire (or over the phone), as the data is the same.
First of all, It's a great idea, but... (Score:2)
BUT, I am MORE than a little leary of Microsoft being in the position of providing a solution to this problem. I simply do not trust them with this type of information, and I don't trust them to provide a fail-safe mission critical service that MUST be up 24/7.
I think most of us would agree that in principle this is a good idea, just that this particular implementation might give the clueful user pause.
But, how hard is this to do? Could the OSS community develop a distributed, secure, web-based single-logon facility?
The components of such a system could be as follows.
1. A standard for user information. Another post already mention just such an open standard.
2. A 'logon server' which provides user information to client web sites at a user's request.
3. A standard, open, secure protocol with which a client web site interacts with a logon-server.
4. A user who registers with a 'logon server' and specifies the information they are willing to provide other client web-sites. The user also specifies a backup logon server which will mirror their information.
5. Client web sites which modify their logon procedure to gather user information from a user specified 'logon server'. No registration would be required on the part of the client web site.
Each 'logon server' could actually be many servers. It would be relatively easy to distribute the load as most of the activity would be of a read-only nature, making the replication of user data across servers fairly simple. User updates to their data are another issue, but they would be relatively infrequent.
How would anyone make money? Banner adds on the logon server's logon page perhaps. Re-selling consumer buying patterns would most likely be the biggest source of revenue. There is nothing wrong with this as long as nothing which could indentify you uniquely is revealed. I don't care if someone wants to know what the buying patterns of a 28yo white male in such and such an income bracket are.
It is important to note that the user would chose their single logon service, and could change/cancel at any time.
It would be an open standard, with all the code required to start a logon server available freely on the web. This would hopefully prohibit any one service from gaining a monopoly stranglehold on the market.
I have seen the future... (Score:4)
CrACkRZ WheEL oF fORtUne! v0.99.14.151
[Win2000 4.00.004 SP7]
[Click here to start]
Checking e-wallet status... Done.
Checking bank account status... Done.
Checking permissions...
One moment please...
How much money would you like to add to your e-wallet? NOTE: if sum > US$ 1,000,000 you could be in TROUBLE!
Enter sum and press [Enter]:99999
US$ 99,999 added to e-wallet account!
Thank you for using CrACkRZ WheEL oF fORtUne!
Bill "Hotmail God" Gates: would you like this man to take care of your money? Thanks, but no thanks.
Has there been any security evaluation? (Score:2)
I found no matches searching in SecurityPortal
or SecurityFocus, so far. Nor in Google.
nor Altavista.
Is this the sort of thing I have to forbid
my mother from trying?
Passport humor (Score:2)
"This is where you will go today."
--
Amex Blue (Score:2)