Ask Slashdot: What's Holding Up Single Sign-On? 446
An anonymous reader writes "Like most web users these days, I have enough accounts on enough websites – most of which have *inconsistent* password syntax restrictions — that when I need to log into a site I don't visit very often, I now basically just hit the "Forgot Password" button immediately. Microsoft's "Passport" gave us the promise of a single web sign-on. What happened to that idea? Why hasn't some bright spark (or ubiquitous web corporation) already made a fortune standardizing on one? I can now buy my coffee with my phone. Why do I have to still scratch my passwords on the underside of my desk?"
Single Sign-On (Score:5, Insightful)
Single breach of security.
A little thing called trust (Score:5, Insightful)
Who is worthy of yours? I see Facebook SSO everywhere, but I don't want to be any part of Facebook.
The same thing that killed 'Passport' (Score:5, Insightful)
Users don't want everything tied to a single identifier, particularly one controlled by Microsoft, Google, Facebook or some other company.
Re:Single Sign-On (Score:5, Insightful)
Not to mention the tracking/privacy issues.
Trust and Compromise (Score:5, Insightful)
Also what happens once the central repository is compromised?
The core problem (Score:5, Insightful)
The technology is already available - OpenID and several other standards are ready to go.
The trouble is that everyone wants to be the ID provider, but no one wants to accept other providers. Passport is a great example - Microsoft wants to be the central gatekeeper. Well thanks, but no, I'd rather run my own, but of course MS won't accept it.
So we're now in a standoff.
Re:It's a bad idea (Score:3, Insightful)
Single sign-on means that if you're compromised once you're compromised everywhere.
I don't think there is a rule that you have to use a single account. I have multiple gmail accounts to separate hobby sites from work sites, etc.
If you use single sign on for slashdot, gizmodo, etc., I'm not really too concerned. It's not like someone is going to abuse my mod points more than I already do.
For important accounts I'll still use a separate identity/password.
I think there is confusion about SSO being forced for every account.
Re:Single Sign on aka FB (Score:5, Insightful)
The real reason is that FB forces me to use my realname, and I don't want to use my realname on a public internet that stores my messages for the next 20, 30, 40 years. I don't want either my employer or some government agency using those posts to develop a profile about me. (Or using them as excuse to reject my resume, or stick me on a Do Not Travel list.)
I get-around the "single login" deficit by using the same name/pass across all websites where I don't care if they get hacked (like posting replies on newspapers). I use a 2nd password for personal websites like email. And a 3rd strong password just for the two banking/stock websites. Nothing gets written down so I don't have to worry about somebody finding my "scrawled passwords" laying in plain sight.
The answer, and solution, are both simple. (Score:5, Insightful)
The answer is easy: Too many eggs in one basket.
That could be one place that if it gets broken into everything is lost, or it could be one entity that knows all the dirty little secrets since they know all the sites that authenticate your identity. It could also just be one entity that must be up and available, which is a tall order.
The solution is simple: Public key cryptography.
Most of the people on /. are probably familiar with ssh. A key is generated on the client end. The public material is put on the server end. If the server is compromised nothing bad happens as the attacker now has a public key they can't use to log into any other service.
There is no technological reason the web can't work the same way. There is a lack of agreement on how to do it that is holding us back, and also a User Interface problem in browsers. However it's not hard to imagine a world where a browser generates a key pair, and during the sign up procedure for a web site it transmits the public material. It looks like single sign on to the user, but they didn't have to trust any third parties, and if the web site is broken into the attacker gets no useful data. It could be implemented with x.509 certificates which browsers already have support for, or it could be done as specific form types and key formatting a-la how ssh does it today. Users could create multiple keys if they wanted, and by syncing the private key material between their devices have passwordless access across all their devices.
A small amount of standards work and UI here could make passwords nearly obsolete. Sysadmins don't use telnet and passwords anymore; we need to upgrade users, and the user tools to achieve the same benefits. Single Sign On, and all of its drawbacks, disappear in the process, a win-win!
Re:er becuase its Microsoft ! (Score:5, Insightful)
Go buy my mortgage (sorry no lien on my car), then ask if you can have the keys to my house, see how far that gets you. It will get you told off, shown the bird, and possibly even mooned at that point...what it isn't going to get you, is any keys from me.
More than that.... what do they need the information for? My employer signs my paychecks, few things hold more sway over my life. Do you think that means I emailed my boss my facebook password so he could poke around and see what I am up to in my personal life? No!
The more of such a relationship I have with them, the MORE I feel I want my personal data protected. What if I am gay and they hate homosexuals? What if I am straight and they hate straight people? Maybe they don't like something my wife had to say? Point is, if I have to worry that they might make discriminatory decisions against me, then its best that they don't have information that can be used to make such decisions. Better that they keep a racist on staff who doesn't know the race of the people whose accounts he deals with than find out the hard and long way that I am one of the people he hates.
Rememeber, anything can become illegal/considered imoral/irrationally disliked by any number of people at any time....and if you aren't ever saying or doing anything that couldn't be taken thr wrong way, or expose you to discrimination, then you just are not very interesting...and thats the last thing we should be encouraging as a society.
Re:Last pass (Score:4, Insightful)
I manage my passwords with lastpass. The service that Steve Gibson from GRC has vetted to be safe and secure
Hahahaha.
Wait - the same Steve Gibson that insisted raw sockets are security threat, some 10 years ago?
That Steve Gibson?
Hahahahaha.
Re:It's already here (Score:5, Insightful)
That's the great thing about single sign-ons: there are so many to choose from!
You forgot one other issue (Score:3, Insightful)
Your solution moves single-sign-on from a solution-provider to the individual, but it completely ignores the fact that some of us DO NOT WANT identities tied together.
True, I could have multiple, independent public keys just like I can have multiple independent sign-ons.
However, you and the world still need to realize that one of the things holding back single-sign-on in any form is that many people simply do not want it.
Re:Single Sign-On (Score:5, Insightful)
Like passwords. I mean, the entire notion of securing access to an account using something that can trivially be sniffed, forged, etc. is utterly insane.
Or those fake software-based "second factor" authentication systems where your cell phone (or some other remotely crackable device) is the second factor.
The fact is that nobody is willing to do security right, because doing security right is hard as hell, and damned inconvenient. So instead, everybody adds hack on top of hack to try to maintain the illusion that these fundamentally flawed authentication mechanisms are somehow useful or robust. Single sign-on just eliminates the illusion of security. :-)
The Problem with Microsoft Passport (Score:4, Insightful)
The problem with Microsoft Passport was Microsoft.
Re:Single Sign-On (Score:5, Insightful)
Not as bad.
Where do I have accounts? Do you know? You can guess, and probably get several of them...but not all of them. Not the ones even I have forgotten about. Hell, you don't even know what other usernames I use when the one I have here isn't available (hint: This one isn't actually my first choice)
On the other hand, if I use an SSO service, and you get that.... depending on how you get it, it could be very bad. The SSO service could, concievably have info on every service that I have ever used through it. You could log on to sites I haven't been on in years and start using my name to spout whatever you want....
Imagine that.... you go to some power tools website to ask a question about your new drill. You get the info you need, never go back. Then two years later, some guy who 0wn3d the SSO server hands a password list to his buddies....and a few months later you now have an extensive library of incendiary posts about minorities and gays in your name.
Could it happen other ways? Sure, but.... talk about making it easy to do widespread damage. Oh now I am locked out of ALL of my accounts...spiffy. Oh you just initiated phishing attacks using my otherwise legitimate accounts on 50 different websites... score.
Oh was one of those accounts the one where you posted messages in a online support group for other people with HIV or some other stigmatizing medical condition? Ooops, looks like the links to all your posts just got posted on your FB wall.... have fun.
Re:Single Sign-On (Score:5, Insightful)
One phrase: Single point of failure.
The only system I can think of that would not be bad for a single sign-on would be something client certificate based, where the program that used your cert would prompt for access. Even then, it better support different certificates for different sites, so not every site is linked to one key.
I wouldn't mind seeing something that functioned like SecurID, except used public/private keys. That way, I could copy the key to a keyfob so I can use it for offline challenge/responses, as well as use my smartphone. If I were on a computer I trust, the client cert daemon would prompt if the site deserves a response and to hand them one from what key I used to authenticate.
Not too difficult to code, but because it is a fairly open system, not many hardware vendors would want to do it.
Re:Single Sign-On (Score:5, Insightful)
I'm all about anonymity when appropriate, but trust me, the NSA, CIA, FBI, etc. couldn't possibly care less about your latté habits
Of course they do - that's the whole point of the NSA's data mining [cnet.com] efforts.
If they know that a group of interest meets at 8pm on the 1st, 17th and 23rd of each month, and you buy a Latte from the Starbucks next door to the meeting place only on those days at 7:45pm, then you become a person of interest.
Re:A little thing called trust (Score:4, Insightful)
> I can even be my own single sign on service provider if I have my own domain name.
But Google and Yahoo and Facebook and Twitter are NOT going to allow you to use a *different* service to authenticate your sessions with them, not your own service provider and *certainly* not each other.
Because THEY want the monopoly position, and they don't want people to NOT create an account with them.
And that's why SSO will never fly. The websites that "matter" won't let us do what we want, and N of us will not have a google account (not since they went to the dark side and/or are based in the USA), and M of us won't touch facebook with a 1000 foot pole.
And if the techies won't use something, the millions of techies won't tell their non-techie friends and relatives to use it either. End of story.