Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Sun Microsystems

Sun Announces Passport Competitor 189

Posted by michael from the papers-please dept.
mjankows writes: "Sun, and other people today announced the Liberty Alliance Project. Definitely an answer to passport/hailstorm. Maybe Mono/DotGNU can benefit/assist/use/help this..." Yay, yet another way to be tracked on the Internet.
This discussion has been archived. No new comments can be posted.

Sun Announces Passport Competitor More

Sun Announces Passport Competitor

Comments Filter:
  • We have to trust Ellison OR Gates?
    Wow, what a choice.
    • ...Scott Mcneally is the CEO of Sun.

    • Re:That means (Score:5, Insightful)

      by Captain_Frisk ( 248297 ) <captain_frisk@@@bootless...org> on Wednesday September 26, 2001 @02:19PM (#2353762) Homepage
      Ellison is Oracle. They are pushing a national ID card. Thats evil too, but not mentioned in the scope of this article.

      As for this hailstorm stuff... i really think you guys are overreacting. Right now there are lots of people who have your user information. This is only one more, and hopefully only has one fail point.

      Right now, you have all of your information replicated all over the place, meaning that you trust that many people with your data. All you need is one of them not patching an exploit, and bam, your data is gone. Why have multiple points of potential failure when you can just have one?

      Since you can control how much info you give them, (MS Passport only requires email address) and now they are saying that there will be many different people who store it, so you don't even have to give it to MS.

      Sun is just a poor MS wannabee. They see that MS has got something that will make the AVERAGE (don't forget how important this is) users experience more convienient, and thus pleasurable, and they want in on it.

      Captain_Frisk

      • Single Point of Failure gives you EVERYTHING (Score:4, Insightful)

        by valmont ( 3573 ) on Wednesday September 26, 2001 @02:32PM (#2353839) Homepage Journal

        I agree that the passpord paradigm gives you a single point of failure. But whereas you may have smaller subsets of your personal information spread out on other sites, i.e., user name and password, maybe first name and last name, but maybe not *all* of your information, like personal banking, stocks trading account informations, home address, work address, phone, fax, cell phone addresses.


        Say someone breaks into a site on which you only stored basic username/password and first/last name information, it's OK, it's not that a big deal, inconvenient, but not the end of the world.


        NOW, say someone DOES break into that *single* point of failure you are mentioning, chances are they'll have access to users' *ENTIRE LIFE*. And looking at microsoft's track record of keeping systems secure with their close-source, I wouldn't trust them the least bit. CodeRed. Nimda.


        Now Sun's approach may be slightly more secure, and if the open-source community does get involved, it could mature far faster than microsoft's product.


        As far as *I* am concerned, though the idea of only having to maintain your information at a single location seems very appealing, I think I still want to go thru the discomfort of having to enter personal information at every site I shop at.

      • Re:That means (Score:4, Informative)

        by jiheison ( 468171 ) on Wednesday September 26, 2001 @02:33PM (#2353846) Homepage
        Why have multiple points of potential failure when you can just have one?

        Because putting your eggs in one basket is a bad idea. Sure, this is convenient for users: all your data is in one place, easy to change and maintain. Now, look at it from the point of view of an identity theif. One stop shopping. Now look at it from the point of view of law enforcement. One place to go to scrutinze every transaction that you make.

        Personally, I prefer to have several accounts attached to different usernames, e-mail accounts etc. It doesn't prevent abuse, but it makes you a harder target to hit.

      • Re:That means (Score:2, Interesting)

        by befletch ( 42204 )

        Right now, you have all of your information replicated all over the place, meaning that you trust that many people with your data. All you need is one of them not patching an exploit, and bam, your data is gone. Why have multiple points of potential failure when you can just have one?

        Nice theory. They can't seem to keep Hotmail accounts secure, and they can't even keep their own IIS installations patched. With a track record like that, do you want Microsoft to be the single point of failure?

        It isn't like they would consider using someone else's [apache.org] software even if it had a better security history.

        • It isn't like they would consider using someone else's [apache.org] software even if it had a better security history.

          I agree. Microsoft passport is only powered by IIS because it's "in the family". Based on it's track record with passport so far, IIS is clearly not the most logical choice for their system.

          If a universal internet indentity system is ever going to work it will have to be (as the 'Liberty Alliance' is) a cooperative effort between many companies. I hope that the variety of interests involved make this project put user's needs in front of corporate interests (since there is no ONE corporate agenda, there are many).

          PayPal is a good example of a successfull consumer-friendly corporate joint-venture [paypal.com]. Frankly, I'm surprised PayPal's name isn't on the list of ProjectLiberty charter members [projectliberty.org].
        • An un-split Microsoft has no choice but to use IIS. How much faith would you have in the Apache Project if their Jakarta team [apache.org], for instance, switched their home page over to IIS or AOLserver [aolserver.com]?

          Many pundits and observers believed that Microsoft would be more profitable split than whole. Why? Because the two (or three) BabySofts would not need to promote each others' products, and they would still not be in competition with each other. Currently the IIS offering hurts the Hailstorm group because they are not free to choose the best, most secure product(s) to run their system. Bad for billg, good for the Hailstorm detractors.

          -sting3r
    • Gore OR Bush?

  • Great! (Score:5, Funny)

    by jiheison ( 468171 ) on Wednesday September 26, 2001 @02:10PM (#2353687) Homepage
    Two versions of software that no one wants to use! Thank god for competition!
    • I will happily use a single sign-on service.

      I'd rather it was distributed in some way, and my favourite method would be to do it through the governments (my government is more answerable than pretty much any company), but if its a large company offering it to me, I'll take it, and hope that public pressure and oversight will force it to play half-reasonable.
  • get over it!

  • The question no one is asking: (Score:3, Flamebait)

    by The Gline ( 173269 ) on Wednesday September 26, 2001 @02:10PM (#2353689) Homepage
    When does the obsession with privacy stop becoming an adjunct to civilized living and start becoming an excuse to do as you damn well please and not be held accountable for it?
    • Ahh.. the old "if you haven't done anything wrong then you don't have anything to hide" arguement.

      Nice in theory, pants in practice. If it was that simple then there would be no need for *any* civil liberty protections since only the "bad" people would be prosicuted.

      SARCASM&GT
      As we know, the authorities have NEVER wrongly prosicuted anyone, they've never made mistakes, they've never abused power. Nah. Not in America.
      /SARCASM
  • Even if I do appreciate Sun's resistance to Microsoft's monopoly, I just can't stand when people consider them as our saviours.
    They're just another company and I am not sure their interest in this solution is not also leaded by rentability's sake.
  • Good lord, will they be running this out of the Office of Free Thought over at the Ministry of Truth?

    This is not to say that this will be terrible, since I guess any sort of aggregation of information will have problems...but cmon...

  • Not only Sun... (Score:3, Interesting)

    by corky6921 ( 240602 ) on Wednesday September 26, 2001 @02:11PM (#2353697) Homepage

    It looks like Microsoft wants to join [yahoo.com] as well, so it might not actually be a Passport "competitor".

    From the article: "Microsoft Corp., which said last week it would expand its own Passport Net identification system to other enterprises, is in talks to join the alliance."

    • Maybe so, but they aren't listed as one of the charter members. From their FAQ [projectliberty.org]:

      Charter members include ActivCard, American Airlines, the Apache Software Foundation, Bank of America, Bell Canada Enterprises, Cingular Wireless, Cisco Systems, CollabNet, Dun and Bradstreet, eBay, Entrust, Fidelity Investments, Gemplus, GM, Global Crossing, i2, Intuit, Liberate Technologies, Nokia, NTT DoCoMo, OpenWave, O'Reilly and Associates, RealNetworks, RSA Security, Sabre, Schlumberger, Sony Corporation, Sprint, Sun Microsystems, Travelocity, United Airlines, Verisign, Vodafone and More.

      Of course I'm not sure that I would want to mention any association with Microsoft, for as long as I could avoid it. I do like that they say "open standard", "open solution" a lot in their FAQ. Hopefully they really will let people inspect for themselves what is going on.
  • Just one big corporation competing with another VERY big one.

    No matter what they tend to make us believe, I am not inclined to agree that this would make net a safer place.

    And with MS allowing third parties to provide similar passport services to hook up with theirs, this could only be construed as another effort from Sun to hide the fact that they were late in realising the advantages of passport and webservices, and also to put a veil over the open source community making them blindly believe that we should support these guys instead of M$ because this is more "OPEN".

    I am not flaming.. I just dont see the point.
  • One of the major points for passport to even think that it will be successful is that it works on hotmail.

    Will any other system, which does not have such a mass base, ever be successful ?

  • The more the merrier (Score:2, Insightful)

    by ez76 ( 322080 )
    Microsoft recently announced [yahoo.com] that they plan to open up Hailstorm to the web at large, and allow different authentication "cells" to share Kerberos keys.

    This tells me that they've decided that owning the authentication database (and associated user profile information) is not as valuable a proposition as having an open authentication network and getting a micro-cut of every monetary transaction that passes through it.

    No doubt if Hailstorm takes hold, every third-party authentication is practically going to need to interoperate with it, and will just become an involuntary revenue generation service for Microsoft.

    To this end, look for Microsoft's purchase of PayPal [paypal.com] or some "leading" micropayment shop (perhaps from x.25 land if not .com land) in the next couple quarters.

  • Yet another way to be tracked... (Score:4, Insightful)

    by hillct ( 230132 ) on Wednesday September 26, 2001 @02:18PM (#2353756) Homepage Journal
    Michael sarcastically noted:
    Yay, yet another way to be tracked on the Internet.
    But I submit it's better to be tracked by a system to which you know the inner workings, and if you wish, based on that knowlege, you may avoid being tracked by it (is so far as it tracks things, which of course is not it's primary purpose).

    --CTH
    • Better the devil you know than the one you don't, eh? I supose life could be worse, but I'd prefer to people did not do these kinds of things at all.

      No big deal really. We know how this story ends, with a mark on the head and hand without wich you may buy or sell. Kind of silly to think of paperless currency and universal ID's isn't it? Bill Gates is not the Beast, as the only language he ever mastered besides English was Basic.

  • Sun, and other people today announced the Liberty Alliance Project

    In related news:

    Sun has renamed their project 'Enduring Tracking Project'.

    The change was made after the initial name -- ``Liberty Alliance Project'' -- last week ran into objections from some Linux scholars on grounds that only Open Source, or GNU, could mete out Liberty in their view.

    (this is a joke. And it shows no respect to those of the FreeBSD or other open source licenses ;)
  • From what I understand (and admittedly that is very little) the whole Passport/Hailstorm/Liberty stuff has to do with Authentication and Authorization. Kerbros is an open implementation of the first; is there open implementation of the second? If so, how hard would it be to "package" it into something similar? Am I missing something here? What does MS and Sun's implementations add above and beyone Kerbros + Other Thing (Tm)?
    • Simply the flag in the cookie that indicates whether or not they have sucked your demographic information into their marketing database.

      (BTW - I'm a 14 yro female into overclocking and free beer)

  • It's still not the answer (Score:3, Interesting)

    by scott1853 ( 194884 ) on Wednesday September 26, 2001 @02:24PM (#2353791)
    Ok, MS is going to implement Hailstorm, which nobody asked for, nor do they want, and they're going to shove it down our throats along with Passport and take away our privacy and security. So Sun's reasoning is if we have a choice of being screwed by Sun or MS, we'll choose Sun.

    Well, I guess I probably would prefer getting screwed by somebody different now and then. Although I think I'd rather have a choice of "none of the above".

    Hmmm, which service that I don't want will I choose...
    • Ok, MS is going to implement Hailstorm, which nobody asked for, nor do they want, and they're going to shove it down our throats along with Passport and take away our privacy and security. So Sun's reasoning is if we have a choice of being screwed by Sun or MS, we'll choose Sun.

      But what they miss is that I'd just as soon be screwed by my girlfriend. Who says I have to buy anything on the internet anyhow?

  • What's with the name? (Score:4, Interesting)

    by Zwack ( 27039 ) on Wednesday September 26, 2001 @02:26PM (#2353802) Homepage Journal
    The name "liberty alliance" and the domain "projectliberty" both imply that the goal is somehow connected with freedom.

    The only freedom that I can see from this is the freedom of having yet another repository of my personal information. I can't imagine websites giving us the choice between "passport", "project liberty" or "anonymous consumer".

    I read the FAQ and it doesn't mention anything much about how they are planning on divulging the contents of this "consumer database" to people. I can't imagine that they are all doing this for altruistic reasons, so I guess I'd rather avoid using it.

    Z.
    • I think / hope the idea is that site X will grant you anonymous access, but either won't give you all the neat features, or may even charge you. But if you identify yourself to them (hopefully to a level of your choosing) then they may grant you access for free (the information that you granted them having value to them). The key will be where all your information is stored and the amount of control over it. And clearly choice in where it is stored (MS or SUN, or hopefully other places) is a good idea.

      It is likely that you will be able to remain anonymous some times. This will put and end to the process of lying about who you are, which is not really useful in the greater scheme of things.

      Think like slashdot. I could be AC now, but I choose to be warnerpr, and I can change settings to display or not display my email address. Hailstorm and project liberty just make it interoperate betweeen sites and devices.

  • Someone might look at the page before posting (Score:5, Informative)

    by PCM2 ( 4486 ) on Wednesday September 26, 2001 @02:27PM (#2353809) Homepage

    This, from the Libery Alliance FAQ:


    Q: What are the objectives of the Liberty Alliance Project?
    A: The Alliance has three main objectives. 1) To enable consumers and businesses to maintain personal information securely. 2) To provide a universal, open standard for single sign-on with decentralized authentication and open authorization from multiple providers. 3) To provide an open standard for network identity spanning all network-connected devices.


    Q: Who are the members of the Liberty Alliance Project? A: Charter members include ActivCard, American Airlines, the Apache Software Foundation, Bank of America, Bell Canada Enterprises, Cingular Wireless, Cisco Systems, CollabNet, Dun and Bradstreet, eBay, Entrust, Fidelity Investments, Gemplus, GM, Global Crossing, i2, Intuit, Liberate Technologies, Nokia, NTT DoCoMo, OpenWave, O'Reilly and Associates, RealNetworks, RSA Security, Sabre, Schlumberger, Sony Corporation, Sprint, Sun Microsystems, Travelocity, United Airlines, Verisign, Vodafone and More.

    ...

    So it seems it's more than just a Sun effort, and they claim it's not about another company holding onto everyone's personal info. The goal appears to be a method for single sign-on where each individual company maintains customer data relevant to its own business. They describe it as a decentralized, federated system built on an open standard.

    • Yeah, that's great. Sun and RealNetworks are the most trustworthy companies around. They'd never use the system for [wired.com] evil [junkbusters.com].
    • So it seems it's more than just a Sun effort, and they claim it's not about another company holding onto everyone's personal info. The goal appears to be a method for single sign-on where each individual company maintains customer data relevant to its own business. They describe it as a decentralized, federated system built on an open standard

      Its yet another classic case of Sun 'rescuing' folks from microsoft's grip :) I don't see any other agenda to it. Only difference is, Microsoft will openly acknowledge it is a business effort, while Sun will say it is Open and beneficial for the users and still try to do the same!

    • Re:Someone might look at the page before posting (Score:4, Interesting)

      by Jayde Stargunner ( 207280 ) on Wednesday September 26, 2001 @02:55PM (#2353967)
      "Charter members include ActivCard, American Airlines, the Apache Software Foundation, Bank of America, Bell Canada Enterprises, Cingular Wireless, Cisco Systems, CollabNet, Dun and Bradstreet, eBay, Entrust, Fidelity Investments, Gemplus, GM, Global Crossing, i2, Intuit, Liberate Technologies, Nokia, NTT DoCoMo, OpenWave, O'Reilly and Associates, RealNetworks, RSA Security, Sabre, Schlumberger, Sony Corporation, Sprint, Sun Microsystems, Travelocity, United Airlines, Verisign, Vodafone and More."

      Yay... So, sintead of Microsoft having my information... Sun, a bunch of media companies, a bunch of companies that want to sell me crap, and a few financial institutions can all pour over my info. Yippe.

      Does anyone but me see the danger of allowing such a wide range on companies with many, many goal to all be involved in a project that is basically used to track people and collect personal information?

      Seems like yet another excuse to have ads, "targeted marketing", and undue pressure put on my by big business. At least Microsoft is singular, and they aren't in the position to sell me a car, book plane tickets, give me a loan, or offer me a long-distance plan.
      • 1) The real problem with MS is that it's a monopoly. If it weren't, then I generally wouldn't care. But it is, and it plans to extend it's monopoly into additional areas. So I'm in favor of nearly any competition to it.

        2) Monopolies are evil, so the question becomes: what license do these multiple entities plan to offer the software under? I couldn't find the answer to this when I went to the listed site, though there were links that I didn't follow. I'm not sure what "becoming a member" entails. Perhaps you have rights to the code. Perhaps you don't. Perhaps you have only the right to join the network, and no rights to the code. My feelings towards them would be substantially different depending on who had the code under what license. But no matter what, better them than MS extending it's monopoly into a new area.
        Still, both Apache and O'Reilly are on the list of members. Both names give cause for hope, though neither name is any guarantee. Perhaps the code will be BSD license? (I don't notice any real GPL names, so that doesn't seem probably. Not even GPL Lite.)

        P.S.: An interesting possible line of books for O'Reilly: Special order bound code listings. These would be expensive, as they would all be printed to order, but they could be printed from the original source code without editing, so the costs shouldn't be excessive. And O'Reilly already has the needed equipment, so there wouldn't be any investment there. You, too, could order you own complete listing of gcc-2.95.1 (or whatever).
        These would certainly be small order jobs. But the difficult part is not the printing, but rather the binding.
    • As a community developer, participating in different projects where we in each single one of them are facing login&account management in order to help our users so they can customize each community to their preferences, a unified identity system is very fortunate.

      We have refused the microsoft hailstorm/passport project from day one due to the one company dominates all issues. Yet we are open to the idea of a unified identity system.

      It is still too early to say whether the Liberty Alliance project will be a viable solution. Our most important concerns are:

      The unified identity system must be 'open', not controlled by one entity that one way or the other can be concidered a competitor to our products. (Microsoft is - they are so dominant that they are in one way or the other a competitor to nearly every IT organisation I can think of, and that is the same reason why passport/hailstorm can not evolve).

      The unified identity system must be developed according to users needs and not beyond. It must not be abused for mass marketing. So a major task is to develop the system avoiding any of the participating or non-participating interests to be able to abuse it. How to do that? I do not have the solution, but I don't want the system without one. What I can conclude is that the system must be developed in open. Where everyone can assist in the 'code' review in assuring nothing is being overlooked in the best possible way. An 'opensource' perhaps applicant to the rules of FSF if suitable. Here the extreme rules of FSF are indeed very suitable as this must be a public interest project.

      The unified identity system must be implementable/joinable by all interests accross platforms. It must me implementable/joinable by all developers and users in spite of financial status. And for that reason again, unexploitable. Thats a major system development task - but is required. Security bust be built into the system. A socalled social solution will not be adequate, as it is possible that not everyone are playing straight.

      I have signed up for the mailing list at http://projectliberty.org/interest.html and I am looking forward to the see how it evolves. Maybe even try to contribute. But if the openness in the solution does not apply and the concerns/issues above are not resolved and perhaps others as well, I can not approve, and I can't imagine anyone who can without having a special agenda that is not favouring the public interest.

      best regards
      Vspirit - Casper Andersen
      Administrative Manager - Sophistic Systems

      • Boy, I never thought I'd say something like this, but ...

        Digital Rights Management (DRM). And for once, we would mean that literally.

        At the Seybold Seminar in San Francisco this week I saw a couple of demos of how DRM software works to protect things like MP3s, movies, etc. The licensing server can offer various forms of contracts with the user -- you can rent information, sell it outright, offer it for a limited time or perpetually, offer a free preview of part of the content, expire it at will, offer incentives to users for passing it along, etc. etc.

        Seems to me the only single logon system that would be acceptable to most of us here would be one that offered all these possibilities to EVERY USER -- applied to ANY AND ALL personal data associated with his/her profile.
    • The interesting ones are the Apache Software Foundation and O'Reilly and Associates, who are likely to be concerned about all our concerns. One produces a certain heavily-used program which could use or reject untrustworthy suppliers, and the other might well publicise misbehavior...

  • This is a good thing (Score:3, Interesting)

    by friday2k ( 205692 ) on Wednesday September 26, 2001 @02:28PM (#2353817)
    I believe that we need to have a competitor for Passport. Well, that is nothing new. I would highly appreciate if Project Liberty has the guts to build private credentials (you might want to look here [freedom.net] for more Info by Adam Shostack). This would be THE alternative for specialized identification (you have to be of legal age to see this page, you have to be Mr. Smith to view your taxes, ...). We need identification, but it needs to be untraceable and there must be no way to collect and combine information.
  • And with the insanely powerful Starcat server [slashdot.org] talked about yesterday (blatant plug for a story I submitted that was actually accepted), Sun can track everyone anytime, anywhere, for the rest of eternity.

  • Is it just me... (Score:4, Troll)

    by szcx ( 81006 ) on Wednesday September 26, 2001 @02:32PM (#2353836)
    ... or is "Liberty Alliance" is an odd choice of words coming from the likes of McNealy [wired.com]?

    "You have zero privacy anyway," Scott McNealy told a group of reporters and analysts Monday night at an event to launch his company's new Jini technology.

    "Get over it."

    You thought Hailstorm was scary? Just wait until Scott McNealy (or is it McCarthy?) gets his hands on your data.

    • You're taking McNealy out of context (Score:4, Insightful)

      by Anonymous Coward on Wednesday September 26, 2001 @02:58PM (#2353982)
      When Scott mentions that "You have zero privacy anyway," He's not talking about how he has planned to take away your privacy in the future with his nefarious schemes. He's making an observation about the here and now.

      Currently most people recieve the bulk of their information in little paper wrappers that are then placed in unlocked tin boxes that sit in front of the place they live waiting to be picked up when said people come home from work...or by somebody else before they come home...

      Currently most people make purchases over the phone, using the 16 digits on the front of their credit card and 4 more digits for the expiration date...and nothing else...these numbers are then processed by another person, a person who doesn't earn alot of money most likely, and who even more likely doesn't like their job or care anything about the person giving them 20 digits and an order to place...

      The idea that your information and transactions are currently secure and computers will only make them insecure is a false notion. It's only a matter of time before somebody get's the idea of breaking laws that for the most part are unenforcable, or deciding their job isn't worth keeping to do something that jeopordizes your privacy. Wouldn't you at least like their to be some hurdles and tracking in the way to protect you? You currently have zero privacy anyway, get over it. This is progress, and wouldn't you like your progress open and not controlled by just one entity?

  • MS == Power (Score:3, Insightful)

    by Wind_Walker ( 83965 ) on Wednesday September 26, 2001 @02:33PM (#2353845) Homepage Journal
    Well, my first question is really "Does anyone outside of Microsoft actually use passport for authentication?" Microsoft uses it a lot for MSN Messenger, Hotmail and all its other stuff, which isn't really bad (for Microsoft products that is). However, I have yet to see Passport used _outside_ of Microsoft.

    Then, assuming that other companies do begin to use Passport at a significant level (despite no one using it after months of its deployment), there then becomes the question "What happens when Microsoft denies companies access to passport authentication?" For example, what happens if a Hotmail competitor wishes to use Passport authentication for its web mail login? Clearly, Microsoft would be helping their competitor if they allowed it, and acting monopolistically if they don't. That does provide a small problem for Microsoft.

    Third is something that the article points out very early on about the very reason people need something like passport. To paraphrase, the article states that people dislike the idea of their online grocery store having access to their online stock trading when they use the same password. This problem doesn't go away with Passport, it is just enhanced. Now, instead of your grocery store having access to your stocks, Microsoft has access to both your grocery store and your stocks, without doing anything but being a middle man authenticator.

    But what am I saying? Microsoft is the good guy, who would never abuse its power. That's why its okay for Microsoft to use its powers to "innovate," just like its okay for the US to develop defensive systems that give it the power to launch nuclear weapons without fear of retaliation.

  • Definitely an answer to passport/hailstorm

    A competitor maybe... I don't like the idea of having a single entity keep track of my usage online (even if it has chivalrous reasons for doing so like making my life easier). Just because this is not Microsoft doing this doesn't necessarily mean that I should like the idea/technology any better.
  • Yay, yet another way to be tracked on the Internet.

    Well, as I read this article there is yet another person who can complain but doesn't contribute. So in the Open Source philosophy, I have a question for everyone:

    What do you want to see in a centralized authentication system that you would use and trust?

    For example, would you like it to be overseen by the government, a company, a board of individuals or someone or something else? Should it be Open Source to allow for improvements, or closed source to deter cracking?

    I feel rather that simply complain about how terrible this and Hailstorm are, we should discuss what should be in a centralized authentication system we would use and trust.
    • or closed source to deter cracking?

      if you mean security through obscurity, that is more an invitation for black hat cracking by far than an open source security system. i think we've all seen how well security through obscurity works, and i for one do not want my identity published^H^H^H^H^H^H^H protected by such means.

      -sam
    • "What do you want to see in a centralized authentication system that you would use and trust? "

      Decentralization!

    • Re:Centralized Authentication: What Do You Want? (Score:1, Insightful)

      by Anonymous Coward
      All that I'm interested in seeing is a list of the information that's available about me, a list of companies that have accessed it recently, and a simple, red-tape-free way of removing or editing the information of my choosing.

      My hotmail/passport account has little information tying it directly to me, so I'm not too concerned about it anyhoo. I don't use any other MS Services, like Expedia, that would take that information.
  • This looks much better then .net. Besides the obvious "it isn't built my microsoft," having companies like RSA and both of the major airlines on board, as well as my bank of choice (BofA) makes me much more less suspicious of this initiative. I mean, I already store basically all my information with my bank, and if they want to tell me it is secure ( along with RSA) , I'll probably beleive them. I won't beleive M$.
    • I don't see how it can "look...much better". There is nothing to see. It is not even vaporware - it is vacuumware.
    • Look at the motives. Most look like companies that would not want to put blind trust in someone else, that have some idea of the responsibilities of handling confidential information. Sun wants to sell computers, big computers. Microsoft seems like it is aspiring to be some kind of second-rate AOL/Time-Warner who I would not want to be responsible for the safekeeping of any sensitive personal information.
  • Definitely an answer to passport/hailstorm.

    And that answer is: "Me too!!!!"
  • Three columns: website, login, password. You maintain it. You control it. You decide who sees it. Or you give someone else the ability to maintain, control, and see it.
  • microsoft - we put the ass in passport

    sun, err, uh, puts the bert in liberty alliance?

  • What about XNS? (Score:2, Informative)

    by johnseq ( 68966 )
    Doesn't an open alternative to Passport already exist at www.xns.org? I'm familiar with what they're trying to do, but not why they haven't really gained much traction (besides a mention in the economist.)

    Anyone know enough to compare the two?

    • Re:What about XNS? (Score:2, Interesting)

      by j-beda ( 85386 )
      There seems to be a lot of behind the scenes movement at xns.org [xns.org] involved in getting some unnamed mystery big player partners lined up. The xns mailing list has been getting quite restless at the lack of information available about the technical specifications release and the first release of the open source reference code.

      There seems to be a feeling that big movements at XNS could occur in the many weeks/few months time frame which is not that long, but since we have just passed the one year anniversary of OneName's and XNSorg's rollout of the XNS implementation of the single-signon/universal name/self-updating ecards, and there has been little further movement visible from outside - people are starting to get frustrated.

      I think that there is a real worry that while XNS was one of the first boats to leave the dock, one of the less-open boats could well make it out of the harbour before them.

      I am hoping that it will turn out that one of these industry groups like the "Liberty Alliance Project" will be using XNS technology as their underlying foundation and that the open specs and open source implementations will win the day, but it is frustrating to not hear much new information from XNSorg.

  • So this is basically a case of the Death Star vs the Borg, right? I think I saw a fan CG animation of this somewhere.
  • xns [xns.org]. Read the backgrounder for a good understanding.. xns is to dns as xhtml1.0 is to html4.0

    a distributed lookup service which could hold information defined by schemas written in XML. The first application was/is personal info. It's been around for a couple years, and has a public trust organization defining the community, hopefully alleviating people's worries of one company taking over. So what's happened to it? I guess it doesn't have the backing of sun or ms :)

    the underlying software will be open source, although I don't think most of it is written yet. The only current implementation of the server is done by the closed source company who's idea this all was, onename [onename.com].

    And for those of you mac old-timers, the head of the public trust organization is Adam Engst [xns.org]!

    • From the XNS web site:
      XNS is a combination of five major components--a naming/addressing/identity service, an XML vocabulary and metavocabulary, an XML protocol and metaprotocol, a legal and operational infrastructure, and a development platform--that together provide a foundation set of services for the next layer of Internet infrastructure, the "web services" layer.

      Plus, it's fully buzzword compliant! It's got "web services," "metavocabulary," "metaprotocol," and the ever-popular XML. The buzzword content of that site is 3 times the nominal level. Then they throw a couple of incomprehensible analogies into the mix just to make sure you're fully confused.

  • Why is Passport bad? (Score:1, Interesting)

    by Anonymous Coward
    What reasons do I have to not trust Microsoft? When have they ever used customer information with customer approval? When have they ever violated my privacy?

    Their registration is optional. Their activation system was designed with privacy explicitly in mind.

    Seems to me that Microsoft has done a great deal to ensure their customer's privacy. I haven't heard a single example of them not doing so.

    As far as I can tell, there is no good reason to not trust Microsoft other than the classic big-brother "they COULD do something bad" argument, or that stupid slippery sloap crap people always talk about.

    The fact is, it should be up to consumers as to whether or not Passport is a good thing. Are they willing to take the "risk" of storing their information in a central location for the benefits of My .NET Services (new name for Hailstorm). If not, they won't.

    So get over it people. If you don't trust Microsoft, ask yourself these question: Do you trust your bank? Do you trust your HMO? Do you trust your insurance company? Do you trust your credit card company?

    The answers to all of these is probably, at the very least, partial trust. You are willing to give up some information and some privacy for services or goods. The same will be true of these services.
  • Can the OSS community come up with a competitor to both of these systems using an approach like Napster - a central server everyone connects to? Then the systems actually involved in the transaction of data talk directly to each other, just like Napster. The difference being one of the systems is YOUR cache of data that YOU maintain on YOUR server (or on a Geocities account or something).

    You would have the benefit of it being accessible from anywhere, could interoperate with Passport or Liberty Alliance, give neither Sun nor Microsoft direct access to your data, keep you in control of your own data, etc.

    The "system" on your end could be as simple as a servlet or jsp accessible only via SSL, keeping your private data securely encrypted until needed. As an extra precaution, the data sent back could be encrypted using the Public key of the system requesting it (for the paranoid). Perhaps one-use passwords for access, so keeping the password given to a particular company doesn't gain them anything?

    The only way I see any way to preserve privacy is to keep the data off of central servers. Can something like that be implemented under either Passport or LA now?
  • I'm still a bit confused what exactly does this (and presumably passport) offer me? So I can store all my data at one location? OK why don't we use my PC as that? True I'll have to take a copy to my work pc too, but that's easy enough. Why do I want some company keeping this? Rule 1 is not to give my password to others. Why give it to some company? Personally I like mozilla's feature for storing my passwords, and form info if I want. Now that would be cool. If all the websites out there had a standard form for filling in address, credit card, so it's recognized by a browser at all times. That'd be nice. And I could control where my info is stored/give to.
    -cpd
  • I don't know, I guess it just makes me nervous when the ratio of number of companies involved to lines of code written is so high. The effort might be a good thing, if it actually becomes real, though. I'm guessing that Brian Behlendorf had something to do with this - he was talking about the need for open standards for single sign on at LinuxWorld.

  • More than just "being tracked" (Score:5, Interesting)

    by SysKoll ( 48967 ) on Wednesday September 26, 2001 @03:19PM (#2354097)
    Michael writes:
    Yay, yet another way to be tracked on the Internet

    Well, a tool such as Passport or LAP can be used to track users, that's true. No one said tools cannot be misused. But remember: Programs don't track people, marketdroids do.

    The keyword here is convenience. The only way of protecting our information on the Internet is through encryption. Which implies passwords and key management. Something that 99% of users are not willing to do.

    Unfortunately, this unwillingness to use the Net securely affects all of us. Cool products and services that could be available today are not offered because of lack of good security models. If they are offered at all, they are either too cumbersome to use, or rely on such simplistic security that they cannot be trusted (Hotmail anyone?)

    This is an old problem. An analog is the credit card industry. Even if you carefully protect your credit card info, you're still paying for all the people who get their CC number and expiry date stolen. CC companies past the cost to all of us clients.

    So we need ease of use for security products, or they won't get used. If LAP can spread the use of a safe, easy-to-use, one-time Internet-wide authentication, then it's welcome.

    Did anyone notice that French company Gemplus is among the LAP supporters? This company provides smart cards. Several projects touting smart cards for web authentication have already been proposed. Maybe we'll see a new, more successful approach this time. It's certainly easier to carry a smart card and enter a 4-digit PIN than to remember and type 20 different passwords.

    I am not saying that this new LAP initiative is going to solve all authentication and privacy problems. But these problems are real and need to be addressed. It doesn't boil down just to marketdroid tracking us.

    -- SysKoll
    • This is an old problem. An analog is the credit card industry. Even if you carefully protect your credit card info, you're still paying for all the people who get their CC number and expiry date stolen. CC companies past [sic] the cost to all of us clients.

      Well, actually it is the merchants who take on the burden of fraudulently used credit cards, not the consumer. This happens in two ways:

      First, the merchant pays a discount fee on the purchase. A portion of this discount fee is really a markup on the portion of the inherent risks that are born by the card association and the member banks. Over the last 30 years average discount fees have dropped from 7% to 2% largely due to reduced amount of fraud.

      Second, if a card is used fraudulently, the Card Holder notifies his/her Issuing Bank which issues a charge back on the transaction. The merchant ends up eating the entire cost of the purchase in addition to a substantial chargeback fee. If a merchant has too many chargebacks over several months, then the card association will begin levying very large fines on the merchant.

      • You are right about the CC mechanism (and the dumb typo). However, the resulting cost-passing is the same. Its effects are diluted among countless merchants instead of a few hundred credit card emitters, but we consumers end up paying for it.

        The current lack of wide-spread Internet authentication/encryption mechanism acts to deter service providers and deprive us all, in the same way as fraud acts to raise costs and allow thieves to pick a penny from each pocket.

        --SysKoll
  • While there are some benefits for consumers, these efforts are about securing and tracking rights managment for content.

    By grouping together enough content partners into one system, it will be impossible for consumers to avoid becoming enrolled. At that point, rights management will be effectively tracked through one authorization hierarchy.

  • This [zdnet.com] is an insightful article which compares the Liberty Alliance vs. Passport over on ZDNet. There's also a commentary [zdnet.com] as well.

    Don't mind me, just doing a little karma whoring.

  • Where are the details? (Score:3, Insightful)

    by -tji ( 139690 ) on Wednesday September 26, 2001 @03:39PM (#2354230) Journal
    I looked through the WWW site for this initiative, but I found no implementation details.

    If done correctly, this has the potential to be a very good thing for all involved. But, there are some key criteria that it needs to meet before I would use it. A few that come to mind are:

    - The user must have 100% control of their personal data & what can be redistributed?
    - Any changes of policy, or distribution of data must require user approval (opt-in), nothing should be done without the user's consent.
    - In the "distributed authentication" model, I would want my data stored by an entity I trust. Such as, a non-profit consumer advocacy group.
    - The security around storage of my information must be rock solid.
    - The protocols used for passing authentication to applications must be secure. The services using the authentication must not have access to my password.

    I'll reserve judgement until I can read the implementation details.
  • ... you mean like slashdot's web-bugs?

    - A.P.
  • The obvious implmenentation would be to sign into the *browser* somehow, and have it authenticate you to some Central Authority. Then when you visit any site the browser would exchange your identity with that site (which would probably again have to check it against the Central Authority). Does that sound right?

    Given that microsoft conrols most of the browser marketshare, how does *anyone* have a legitimate shot at controlling single sign-on, other than MS?
  • Gasp. I know i'm asking for it but why don't they try and become the governing body MS was talking about when they said they wanted to open passport up so that they didn't solely control the information. IT seems like that would be more effective than creating a competing standard.
  • Sun announces alot of stuff.

    But then..... sort of like their stock price. What will happen to Java if they go bust?
  • I can see it going down now:
    - Sun makes this passport-knock off
    - It's a dismal failure because Passport is much better and has more functionality
    - Sun gets burned
    - Sun gets angry and takes their competitive problems to the court and sues MS for being a big bad meany monopoly.

    It's unfortunate that Sun can't innovate and make their own products, or make Java better and compete with .NET rather than copying it. I realize Java was first, but it seems Sun has picked up on some of MS' good ideas and is turning Java into .JAVA. It's unfortunate. I work with Java every day and Sun had a good thing going, but there just isn't a lot of positive movement in the Java realm. Just from what I've read, .NET is the Java that Java never was. Is this Sun's fault? Probably. Can they fix it? Absolutely! But not by copy-cating MS and picking legal fights with them.
  • Well, you got a competition, Microsoft. Well, let's see... storing user's information and access anywhere. Hmm... Let's see:
    Well, you've just bought me a workstation. Guess what? You've transfer $10,000 to my account. Thanks! I'll login as you more often next time :)
  • When you go into a new environment, you need an identity. This includes the web. When I shop on the web, I need to use my real-world identity. When I post on /. I can use a /.-generated identity which is less exposed.

    What's wrong with a commercial venture that manages identities? You approach this company, and ask them to create you an identity, possibly based on some real-world data like your credit card number. When you interact with a third party you can say "I have personal ID number 57798 issued by that company", together with some documentations (e.g. using public-key certificates). If this third party trusts the company, they will agree that you are who you say you are. This way you can create binding contracts with people you've only met on-line.

    Of course, if you couple such a system with a monopoly in some market (e.g. operating systems, mainframes, or insurance) you get in trouble. This is the general problem with monopolies. Also, I'm not sure if I'd use an identity offered by my credit card company since they know enough about me already. If I think some company won't keep my info secret, I won't deal with them, etc. In any case, it's then a matter of consumer choice.

    The "let people have IDs on your site" approach doesn't work for sites who who do major business with those people -- you need some third party who'll vouch that these people are genuine.

    Remember, the only way to have complete privacy is not to interact with anyone else.

    Just my rants.
  • ...the Internet is sucking more and more everyday. I really wish these big corporations would go and create their big corporate private network (as was proposed in earlier articles, because the Internet doesn't 'conform to economic models properly'). Then the Internet can go back to what it was intended to be used for -- sharing of information and open communication, with a nice simple text interface... :-)
    • We can kick all of the users off who aren't at Unviersties or government reserach sites and finally get the discourse back up above the level of a 10 year old...

      Or is thsi not what you had in mind? This IS in fact what the "Inetrnet was intended for" not to mention origanlly funed for-- academic research.

      Be careful what you wish for.
  • Novell (well known as the makers of Netware) rolled out their "DigitalMe [digitalme.com]" product several years ago to great disinterest (but then Novell couldn't market eternal life either.)

    From their online propaganda:

    The interactive nature of the Internet enables e-businesses to gather information about consumers in unprecedented amounts. While many e-businesses maintain privacy policies -- and post them for users to see -- the fact that this personal information is being collected and shared without the knowledge and permission of the consumer has some individuals and advocacy groups calling for government intervention.

    Novell's digitalme is the first major effort by a large, multi-national corporation to give consumers the ability to control their personal information and manage their online relationships. With digitalme, management of online relationships is put firmly in the control of the user.

    We call this new orientation toward consumer empowerment, meBusiness, and it ushers in a revolutionary new age of commerce on the Internet. A world where every person is empowered to manage their relationships with individuals and businesses by controlling how their personal information is shared, used and maintained on the Net. A world where every e-business is systematically enabled to responsibly use, and on request, purge customer information. All of which is designed to lead to less intrusive marketing, more trust in online relationships, respect for personal privacy and greater acceptance of e-commerce as a viable alternative to brick and mortar retailing.

    Aside from the icky overheated writing style (and pathetically bad Gen-X look of the website) the idea seems to be the same as all of the others: We'll escrow your information and dole it out. The question is of course always how and to whom and with or without my permission. They've also got a dynamic address-book function and a web form-filler - woohoo.

    When this thing launched I seem to recall Novell positioning it as a universal login to websites through online authentication. Now that seems to be dropped and a simple keychain function used instead. Whatever the case it's all built on Novell's awesome NDS [novell.com] (called "eDirectory" this week) technology which gives it some street-cred. NDS is the most mature directory service out there and scales awesomely, very flexible and at this point pretty mature. MS's projects are, well lets just say "quality is a journey" at MS and with Sun, well Jini [sun.com] sure is nifty!

    Anyway, an interesting third example of this increasingly debated service.

  • Read the article. This is NOT a centralised system like passport. It is a distributed system - you keep track of your own data. It's very vague, but it sounds as if this system simply provides standardised formats and protocols etc. for personal data.


    A federated identity model will enable every business or user to manage their own data, and ensure that the use of critical personal information is managed and distributed by the appropriate parties, rather than a central authority.


    seems pretty clear to me - you manage your own data, and it is authenticated in a distributed way, not maintained and authenticated in a centralised Microsoft database. Further:


    In a federated view of the world, a person's online identity, their personal profile, personalized online configurations, buying habits and history, and shopping preferences are administered by users, yet securely shared with the organizations of their choosing.


    Emphasis mine. You maintain your own data, and decide who you will alow it to be shared to.


    Can someone please tell me how this is not (at this vague stage) the sort of thing that we've been wanting? A decentralised, distributed information management system...


    Jedidiah

  • Re: One big corp fighting another (Score:3, Interesting)

    by Derkec ( 463377 ) on Wednesday September 26, 2001 @06:32PM (#2355291)

    I've seen a number of times people have said this is just a big corporation which is maybe trustworthy (Sun) competing with one which is most likely not trustworthy (Microsoft). The Liberty folks, while led by Sun, are not exclusively Sun. On their site, they list the charter members which include big nasty corporations and some players who are more likely to be loved than hated on Slashdot. For instance, the Apache Software Foundation and O'Reilly & Associates.


    Sun probably orchestrated this. Why? Not because they want your data, but because they passionately hate Microsoft and don't want to risk letting Microsoft take over a large chunk of the web. They are trying to Liberate a web that has yet to be enslaved by Microsoft, but one which they are scared will be. Other comments regarding the charter members:


    Microsoft enemy AOL-TimeWarner is not there


    Microsoft enemy RealNetworks is


    eBay is a charter member - which is interesting since they were one of the first to sign up for passport. Second thoughts perhaps?


    What I'm trying to say is that this is not Sun vs Microsoft round 6000, there are a number of companies here who will hopefully keep one another honest.

    • eBay is a charter member - which is interesting since they were one of the first to sign up for passport. Second thoughts perhaps?

      Am I the only one that conceives of the notion that they could use both? Or perhaps implement both then roll out out as official if the other tanks? When you develop something, do you download the first toolkit you find and swear by it forever, or do you evaluate different solutions?

      • "Am I the only one that conceives of the notion that they could use both? Or perhaps implement both then roll out out as official if the other tanks? When you develop something, do you download the first toolkit you find and swear by it forever, or do you evaluate different solutions?"


        Yah, fair enough. But it does show that the iron grip Microsoft was shooting for in authentication left even their first passport customers nervous.

Slashdot Top Deals

Real Programmers don't eat quiche. They eat Twinkies and Szechwan food.

Close