Ask Slashdot: What's Holding Up Single Sign-On? 446
An anonymous reader writes "Like most web users these days, I have enough accounts on enough websites – most of which have *inconsistent* password syntax restrictions — that when I need to log into a site I don't visit very often, I now basically just hit the "Forgot Password" button immediately. Microsoft's "Passport" gave us the promise of a single web sign-on. What happened to that idea? Why hasn't some bright spark (or ubiquitous web corporation) already made a fortune standardizing on one? I can now buy my coffee with my phone. Why do I have to still scratch my passwords on the underside of my desk?"
Single Sign-On (Score:5, Insightful)
Single breach of security.
Re:Single Sign-On (Score:5, Insightful)
Not to mention the tracking/privacy issues.
Re:Single Sign-On (Score:5, Informative)
Yep...I'd prefer NOT to have every website and business out there to be able to more easily tie all their data on me together. I don't want it any easier than it already is.
And please, don't anyone mention using FB as the universal ID. I don't have and don't want FB account(s).
I don't want to pay for coffee or anything else with my phone either...I hope if the new iPhone 5 has NF on it...it can be easily and permanently shut off.
I like to use cash whenever possible...anonymous, and it gives me a much better feeling for how much I'm spending a month, that using credit which to me, ads a layer of abstraction to money, much like how chips do in a casino. With chips or CC's ( and now a phone) it is more like 'play' money than real money..and it is easier to lose sense of how much you're blowing here and there.
Re:Single Sign-On (Score:5, Insightful)
One phrase: Single point of failure.
The only system I can think of that would not be bad for a single sign-on would be something client certificate based, where the program that used your cert would prompt for access. Even then, it better support different certificates for different sites, so not every site is linked to one key.
I wouldn't mind seeing something that functioned like SecurID, except used public/private keys. That way, I could copy the key to a keyfob so I can use it for offline challenge/responses, as well as use my smartphone. If I were on a computer I trust, the client cert daemon would prompt if the site deserves a response and to hand them one from what key I used to authenticate.
Not too difficult to code, but because it is a fairly open system, not many hardware vendors would want to do it.
Re:Single Sign-On (Score:5, Informative)
How about openID it can be whatever you want based. There is no global single point of failure as people can stand up there own openid site and any site that accepts openid can use it. The only thing saved on the end site is your openid url these can be many to one and/or specific to a given site. Pretty much you can add as much complexity as you want on your server or find somebody to do so for you.
Re: (Score:3)
I'm a supporter of OpenID. It disperses the eggs into multiple baskets, forcing an attacker to attack multiple sites.
Plus, it adds some ability to pack one's own parachute. I could keep all my OpenID stuff on a co-located box that is heavily secured, and know exactly what measures are in place, as opposed to taking someone's word that something is secure.
Re:Single Sign-On (Score:4, Informative)
Mozilla Persona/BrowserID, is certificate based and lets you have different profiles for different sites. It requires you to have an Identity Authority that can vouch for your email, but if you have your own domain you can be your own IA.
http://lloyd.io/how-browserid-works [lloyd.io]
Re:Single Sign-On (Score:5, Insightful)
I'm all about anonymity when appropriate, but trust me, the NSA, CIA, FBI, etc. couldn't possibly care less about your latté habits
Of course they do - that's the whole point of the NSA's data mining [cnet.com] efforts.
If they know that a group of interest meets at 8pm on the 1st, 17th and 23rd of each month, and you buy a Latte from the Starbucks next door to the meeting place only on those days at 7:45pm, then you become a person of interest.
Re:Single Sign-On (Score:4, Informative)
If they know that a group of interest meets at 8pm on the 1st, 17th and 23rd of each month, and you buy a Latte from the Starbucks next door to the meeting place only on those days at 7:45pm, then you become a person of interest.
Technically its the first Friday of the month 5 to 8 local time. But whatever.
http://www.2600.com/meetings/ [2600.com]
Re: (Score:3)
And I can't user sites that only use facebook as a signon, because 1) I don't have or want to have a facebook account and 2) my company blocks facebook and anything that links to, mentions or smells like facebook.
Re: (Score:3)
Not to mention the tracking/privacy issues.
You can run your own identity provider so that you are the only one able to spy on yourself
Re: (Score:3, Interesting)
Most password reset protocols are just a kludgy 'authentication via email' already.
I would've logged in, but I no longer have access to the email account that I used to create my /. account 10+ years ago.
Re:Single Sign-On (Score:4, Interesting)
Re: (Score:2)
Yeah I was going to say "the fact that it's a terrible idea" but that hasn't stopped so many other terrible ideas from becoming wildly popular.
Re:Single Sign-On (Score:5, Insightful)
Like passwords. I mean, the entire notion of securing access to an account using something that can trivially be sniffed, forged, etc. is utterly insane.
Or those fake software-based "second factor" authentication systems where your cell phone (or some other remotely crackable device) is the second factor.
The fact is that nobody is willing to do security right, because doing security right is hard as hell, and damned inconvenient. So instead, everybody adds hack on top of hack to try to maintain the illusion that these fundamentally flawed authentication mechanisms are somehow useful or robust. Single sign-on just eliminates the illusion of security. :-)
Re: (Score:3)
Using a SMS message to a cellphone is better than nothing. Generally if a remote cracker gets access to passwords, they generally won't have the ability to intercept those.
Of all the two factor authentication mechanisms, Google has theirs done pretty well with not just the ability to call a backup number, but handing you a few one use codes to stash aside in case of emergency.
Re:Single Sign-On (Score:4, Interesting)
Just use Keepass. Allows you to remember just one password. I use LastPass, but of course it is not for the super-paranoid (it could be hacked with all my passwords on it).
Re: (Score:3)
LastPass encrypts on the client. The only way to crack your passwords would be do it from your own machine, and then Keepass is broken too.
Re:Single Sign-On (Score:5, Insightful)
Not as bad.
Where do I have accounts? Do you know? You can guess, and probably get several of them...but not all of them. Not the ones even I have forgotten about. Hell, you don't even know what other usernames I use when the one I have here isn't available (hint: This one isn't actually my first choice)
On the other hand, if I use an SSO service, and you get that.... depending on how you get it, it could be very bad. The SSO service could, concievably have info on every service that I have ever used through it. You could log on to sites I haven't been on in years and start using my name to spout whatever you want....
Imagine that.... you go to some power tools website to ask a question about your new drill. You get the info you need, never go back. Then two years later, some guy who 0wn3d the SSO server hands a password list to his buddies....and a few months later you now have an extensive library of incendiary posts about minorities and gays in your name.
Could it happen other ways? Sure, but.... talk about making it easy to do widespread damage. Oh now I am locked out of ALL of my accounts...spiffy. Oh you just initiated phishing attacks using my otherwise legitimate accounts on 50 different websites... score.
Oh was one of those accounts the one where you posted messages in a online support group for other people with HIV or some other stigmatizing medical condition? Ooops, looks like the links to all your posts just got posted on your FB wall.... have fun.
Re:Single Sign-On (Score:4, Informative)
Re:Single Sign-On (Score:4, Interesting)
On the accounts that aren't important who cares, but..
On the ones that are important at least do something simple like
$goodpassword+sitename
So you would have X43snv!yahoo
or X43snv!citibank
That way any automated attacks with your scalped email and password would fail. A dedicated attacker may see the pattern and break in, but it's at least more time consuming for them.
Re: (Score:3)
A little thing called trust (Score:5, Insightful)
Who is worthy of yours? I see Facebook SSO everywhere, but I don't want to be any part of Facebook.
Re:A little thing called trust (Score:5, Interesting)
Re:A little thing called trust (Score:4, Insightful)
> I can even be my own single sign on service provider if I have my own domain name.
But Google and Yahoo and Facebook and Twitter are NOT going to allow you to use a *different* service to authenticate your sessions with them, not your own service provider and *certainly* not each other.
Because THEY want the monopoly position, and they don't want people to NOT create an account with them.
And that's why SSO will never fly. The websites that "matter" won't let us do what we want, and N of us will not have a google account (not since they went to the dark side and/or are based in the USA), and M of us won't touch facebook with a 1000 foot pole.
And if the techies won't use something, the millions of techies won't tell their non-techie friends and relatives to use it either. End of story.
Here (Score:5, Funny)
I'll give you a single sign-on! Send all your login information to me and I'll set something up...
The same thing that killed 'Passport' (Score:5, Insightful)
Users don't want everything tied to a single identifier, particularly one controlled by Microsoft, Google, Facebook or some other company.
Re: (Score:2)
Re: (Score:3)
Users don't want everything tied to a single identifier, particularly one controlled by Microsoft, Google, Facebook or some other company.
Indeed. So I asked myself the next question: "Who would I trust?" The Dalai Lama? Yes, I would trust the Dalai lama, but sure as shit China would hack whatever the Lama was using and that would be the end of that too.
Obstacle #1 who to trust and obstacle #2 vulnerability of that trust.
It's an old but apt term -- "all your eggs in one basket" -- convenient but still a bad idea.
Re: (Score:3)
Single Sign on aka FB (Score:5, Informative)
The real reason holding it back is people that make the websites are either to lazy to include it. ie blogging sites. Or want increased security aka financial sites.
Re:Single Sign on aka FB (Score:4, Informative)
Or users who rebel.
Re:Single Sign on aka FB (Score:5, Insightful)
The real reason is that FB forces me to use my realname, and I don't want to use my realname on a public internet that stores my messages for the next 20, 30, 40 years. I don't want either my employer or some government agency using those posts to develop a profile about me. (Or using them as excuse to reject my resume, or stick me on a Do Not Travel list.)
I get-around the "single login" deficit by using the same name/pass across all websites where I don't care if they get hacked (like posting replies on newspapers). I use a 2nd password for personal websites like email. And a 3rd strong password just for the two banking/stock websites. Nothing gets written down so I don't have to worry about somebody finding my "scrawled passwords" laying in plain sight.
Re: (Score:2)
The real reason is what's been said before: trust. I can't think of any entity that I trust with so much that I'm OK with them knowing when & where I'm logging into something, let alone hold my keys.
Re: (Score:3)
Re: (Score:3)
Do you really want all your FB friends to see "Foo2rama liked THE ANAL INTRUDER from www.xxxtoys.com!" when you accidentally click "Like this on Facebook" instead of "Add to Cart"?
Password Hasher (Score:2)
Re: (Score:2)
What happens if I have various PCs? Or if one of my devices doesn't have firefox (ie: webOS)?
Re: (Score:3)
That's still short of an SSO. If I'm 100km from home, and my laptop crashed and burns, I can get a new one; how would I get the data for the plug-in there? What if it's a loaned laptop? What if I want to log in from my tablet somewhere? There's dozens of scenarios where PH won't work, and a good SSO would.
Facebook (Score:2)
Facebook has made one of the largest pushes into this area. Has it worked? I'm not sure, just because I tend to prefer to not tie my various accounts to Facebook. I assume some people feel the same way, but I suspect the population at large likes this.
Trust and Compromise (Score:5, Insightful)
Also what happens once the central repository is compromised?
Re:Trust and Compromise (Score:4, Informative)
If you have something like OpenID, you could set up your own SSO providers.
Face it; average joe uses the same password everywhere, and won't care about the trustability of the service provider.
Re: (Score:2)
It's impossible to find someone everyone trusts.
You don't have to trust the same people I do. So long as we can find identity providers who talk compatible protocols so that consumers of identities don't need to care, it doesn't matter. (Note that the majority of providers only really guarantee to tell sites "this is the same person who logged in as that other time" and not any information more than that, such as actual names. For a lot of uses that's good enough, but not all.)
Also what happens once the central repository is compromised?
You'd rather have logins on hundreds of badly-maintained blogs instead of a we
It's already here (Score:5, Informative)
Facebook, OpenID, Yahoo, AOL, Google, Microsoft - they all support SSO for websites that want to use it. It's just a matter of the individual websites implementing it.
If you notice, Slashdot has even implemented it.
Re: (Score:2)
Yes, they all support being SSO providers, but if EVERY service provider provides me with an SSO, but none of them let me log in with a third-party SSO, then I don't have a choice but to have a differente account on each place; a facebook account, a google account, etc.
Re: (Score:2)
And if it's google, yahoo, aol or a pile of others they can be used as OpenID. Right now it's pretty much facebook as the holdout as they want all that juicy data. OpenID is the only one in the mix that lets you be in control you can host it on your own site add multipart authentication to it and generally be assured of it's safety as it's completely under your control (as much as anything that relies on DNS is).
Re:It's already here (Score:5, Insightful)
That's the great thing about single sign-ons: there are so many to choose from!
My Single Sign On (Score:5, Informative)
Re:My Single Sign On (Score:4, Interesting)
Yes. Exactly. All the SSO I need.
I have a FB account, but, since when do I trust them to know every single website I go to? You know how many non-FB websites I have EVER logged into with my FB account? 0. Exactly 0.
As far as I can tell, the only reason they offer SSO is so they have yet more info to aggregate and sell. I don't use FB login for the same reason I don't allow my web browser (via requestpolicy) to connect to facebook at all when loading non-facebook sites.
FB doesn't need to know where I go to stream music, it doesn't need to know where I read my news or post my comments, it doesn't need to know jack shit other than what I post on my wall, on facebook.
Re: (Score:2)
Not really SSO, if I find myself on a trip with a broken laptop, I can't quickly log in from a new one, or from a friends one, I'll need to salvage the data on it first. And since it's the SSO, I can't get a remote backup without it.
Keepass has it's uses; SSO isn't one of them, nor is it a substition for SSO.
Re: (Score:2)
Or LastPass.
I've had single sign-on for years! (Score:5, Funny)
I simply use the same password for everything! Brilliant, I know!
There are a few out there (Score:4, Informative)
In the meantime - LastPass! (Score:3, Informative)
In the meantime, check out https://lastpass.com/ [lastpass.com] - you get to use a single password to protect all of your other passwords. You can generate random ones, store the passwords in the cloud, so are accessible by you, anywhere. I cannot do justice here to the security and features offered.
Essentially you visit a site, and LastPass fills in the username/password for you.
Re: (Score:3)
LastPass discloses potentially personally-identifying and personally-identifying information only when required to do so by law, or when LastPass believes in good faith that disclosure is reasonably necessary to protect the property or rights of LastPass, third parties or the public at large
The highlighted clause is totally out of order. There is only ever one reason they should release data; when instructed by a lawful legal order.
Re:In the meantime - LastPass! (Score:4, Informative)
Fortunately they don't have access to your unencrypted passwords.. https://lastpass.com/support.php?cmd=showfaq&id=1096 [lastpass.com]
"AES utilizing 256-bit keys.AES-256 is accepted by the US Government for protecting TOP SECRET data. AES is implemented in JavaScript for the LastPass.com website, and in C++ for speed in the Internet Explorer and Firefox plug-ins.
This is important because your sensitive data is always encrypted and decrypted locally on your computer before being synchronized. Your master password never leaves your computer and your key never leaves your computer. No one at LastPass (or anywhere else) can decrypt your data without you giving up your password (we will never ask you for it). Your key is created by taking a SHA-256 hash of your password. When you login, we make a hash of your username concatenated with your password, and that hash is what's sent to verify if you can download your encrypted data."
Re: (Score:3)
That's about as useful as saying magic unicorns protect your security.
Unless it's open source, you're still depending on the good graces of a third party to not do something else with your password. A black box with AES stamped on the outside garners the same level of trust as a black box with ROT13 stamped on the outside. How do you know they're not AES encrypting the username, and keeping passwords in plaintext? (through incompetence, malice, or just simply a bug)
Go with KeePass [keepass.info] instead, and keep e
It Doesn't Work (Score:2)
The core problem (Score:5, Insightful)
The technology is already available - OpenID and several other standards are ready to go.
The trouble is that everyone wants to be the ID provider, but no one wants to accept other providers. Passport is a great example - Microsoft wants to be the central gatekeeper. Well thanks, but no, I'd rather run my own, but of course MS won't accept it.
So we're now in a standoff.
Bad idea! (Score:2)
This is a really bad idea across the board. First you would have to get a bunch of web sites to agree on a set of standards - really have you looked at what clusterf*ck most standards have turned into? Assuming you can somehow make the first one happen with the blessing of the FSM on the second harvest moon of the year you still have a problem.
You have now just made /any/ website that did somehow join your standard much more profitable. Why? Users are lazy, not only do they share passwords they also typical
Who do you want to hold your data? (Score:4, Interesting)
Ok the problem with Single Sign on, is the fact we are all going to choose a company for the SSO.
Do enough of us really trust Microsoft, who has been in the headlines for massive security breaches.
How about Facebook, you know those guys who take your data and sends it to everyone on the face of the earth.
Perhaps Google, You will get targeted adds based on every place you login too.
Open ID, how much do you really trust a bunch of harry toe programmers, who go to these black hat hacking events?
Some distributed architectural system where you can find many points of weaknesses from some armature setup.
That is the problem with Single Sign On. We just don't have any trust, in these sources. And to have one that you trust enough for the rest of the world?
Two solutions already exist (Score:2)
Password Policies (Score:2)
Many people have very secure passwords, and good schemes to secure them, generate unique ones for each site, etc. So if my password for a site is "Lkjsdf834kklLKjlkj90uKLjh89yhLK98" - that could be very secure. But if some arbetrary site as a rule that states "Your password must have a least one punctuation character in it" - it rejects my password. Now, the system I have in place to generate
Re: (Score:2)
The answer, and solution, are both simple. (Score:5, Insightful)
The answer is easy: Too many eggs in one basket.
That could be one place that if it gets broken into everything is lost, or it could be one entity that knows all the dirty little secrets since they know all the sites that authenticate your identity. It could also just be one entity that must be up and available, which is a tall order.
The solution is simple: Public key cryptography.
Most of the people on /. are probably familiar with ssh. A key is generated on the client end. The public material is put on the server end. If the server is compromised nothing bad happens as the attacker now has a public key they can't use to log into any other service.
There is no technological reason the web can't work the same way. There is a lack of agreement on how to do it that is holding us back, and also a User Interface problem in browsers. However it's not hard to imagine a world where a browser generates a key pair, and during the sign up procedure for a web site it transmits the public material. It looks like single sign on to the user, but they didn't have to trust any third parties, and if the web site is broken into the attacker gets no useful data. It could be implemented with x.509 certificates which browsers already have support for, or it could be done as specific form types and key formatting a-la how ssh does it today. Users could create multiple keys if they wanted, and by syncing the private key material between their devices have passwordless access across all their devices.
A small amount of standards work and UI here could make passwords nearly obsolete. Sysadmins don't use telnet and passwords anymore; we need to upgrade users, and the user tools to achieve the same benefits. Single Sign On, and all of its drawbacks, disappear in the process, a win-win!
You forgot one other issue (Score:3, Insightful)
Your solution moves single-sign-on from a solution-provider to the individual, but it completely ignores the fact that some of us DO NOT WANT identities tied together.
True, I could have multiple, independent public keys just like I can have multiple independent sign-ons.
However, you and the world still need to realize that one of the things holding back single-sign-on in any form is that many people simply do not want it.
Yahoo Has Single Sign On... (Score:2)
I moved to Google after the collapse of my Yahoo single sign on multiverse. All things became one, which was the security reason why I shut down my Yahoo accounts and left for Google. Yahoo as a web portal has a number of quality services that are linked. If only their privacy options were more robust I might still be there to enjoy them.
-Xin
Facebook SSO / Windows 8 (Score:2)
Facebook is doing SSO really well for stuff that's just not that important. Sign in to random websites/games/apps/forums with a single click.
I wouldn't want SSO for my bank/finances/medical though because of the single point of failure issue.
However, for PC's Windows 8 now allows you to log in with your Windows Live credentials (not sure if you could do this before)... I personally liked that feature since you can log onto different PC's/tablets around the house without reconfiguring things.
Just for intra-organizational sign-ons. (Score:2)
Single Sign-On technology only makes sense within a single organization. For example, if you get a loan from the same institution you do personal banking with, you may want the convenience of a single sign on to their loan system and their banking system. But in this case, you don't have to worry about privacy issues as it is already the same organization with access to both sets of data, even if they are two different systems in the back-end, possibly due to a corporate merger or something.
However, with cr
Because everyone want to be the provider (Score:2)
Because everyone want to be the SSO provider.
Basically, we had OpenID. Along came plenty of services which gave you an OpenID account (or something VERY similar), but none of them allow you to log in using a single sign on hosted elsewhere.
Example: Facebook is a SSO. So is google. So are plenty others. But since google wants to be the provider, they won't allow you to log in with facebook's OpenID. The inverse also applies.
In the end, everyone is an OpenID provider, but the only place I can log in with
For all those non-important signups (Score:3)
Why don't people just tell their browser to remember their login/pwd information? That's what I do for Slashdot, BoingBoing, fb, lj, gmail, etc.
Bank websites and credit card websites, I still store the passwords in my noggin, but social media? I don't care if someone who's stolen my laptop suddenly can make twitter posts in my name.
Re: (Score:3)
Why don't people just tell their browser to remember their login/pwd information? That's what I do for Slashdot, BoingBoing, fb, lj, gmail, etc.
Bank websites and credit card websites, I still store the passwords in my noggin, but social media? I don't care if someone who's stolen my laptop suddenly can make twitter posts in my name.
Because many people are using multiple devices, in which case they have to store your passwords in "the cloud" with some sort of browser sync. Also, folks are accessing resources with a browser sometimes and apps at other times.
LastPass does a pretty good job of filling in the gaps.
Re: (Score:3)
Then use something like the keychain in OS X, which encrypts the passwords. You can't even look at them without typing your account password.
If something like this would be part of every OS (with a nice UI of course, and browser integration and sync over all your devices) nobody would need any external SSO. Which are a bad idea anyway, not least because you can be tracked over all sites you're using it on.
Trust (Score:2)
There is no company large enough to make a plausible attempt at "single sign-on" that would also be trustworthy enough for most people to give them that level of access. And there probably never will be, since our current system of corporate capitalism not merely permits but actively requires corporations to act in a sociopathic manner.
single sign-in = single point of failure (Score:2)
yea, that sounds like a great idea!(sarcasm)
How Will They Get Paid? (Score:2)
Someone mentioned the very good point that Facebook is TRYING to become the single signon king. However, nobody trusts Facebook.
It brings up the question of how a single signon organization would make its money.
Nobody would trust it, use it, if it makes its money like FB or Google......basically by selling its users out.
It would have to be some sort of not-for-profit trust that could pay its employees well without having ties to other businesses.
That sounds like the government. I wouldn't want to give
never write down your passwords (Score:2)
DO NOT WANT (Score:2)
* I want to keep my identities separate.
* I don't want _SINGLE_SIGNON_PROVIDER_ to have keys to my entire online life.
* I'd rather "spread the risk" of having my login information compromised.
I don't have a common key for my house, office, and car either. Nor do I want one.
No Multiple Single Signons. (Score:2)
I have my personal windows live account, my day job Office 365 user account, and an Office 365 admin account for a friends small business I administrate for him on the side.
Whenever I needed to switch I need to clear my cookies and close all browser windows, then login again. It was a massive PITA.
What I do now is use IE for day job, Firefox for personal, and Chrome for admin; so they each have separate cookie sets.
I probably should switch to separate VMs.
The Problem with Microsoft Passport (Score:4, Insightful)
The problem with Microsoft Passport was Microsoft.
SItes Don't Want it (Score:3)
No. (Score:3)
Invoking Betteridge.
Mozilla BroswerID / Persona plug (Score:3)
This question has many parallels to "Why do all the browsers suck?" circa 2002. Similar answer: end users' interests are not aligned with commercial ventures, thus commercial entities fail to address the need. Governments, for similar reasons, are not welcome as solution providers.
Mozilla has a potentially gamechanging solution in alpha. It is inherently user controlled and FLOSS. It's also intended to be very easy to use by building user-controlled personas into the browser, allowing single sign in without revealing sign-in habits to a third party. Developers and testers welcome.
https://login.persona.org/ [persona.org]
http://identity.mozilla.com/ [mozilla.com]
Re:er becuase its Microsoft ! (Score:4, Funny)
Re:er becuase its Microsoft ! (Score:5, Insightful)
Go buy my mortgage (sorry no lien on my car), then ask if you can have the keys to my house, see how far that gets you. It will get you told off, shown the bird, and possibly even mooned at that point...what it isn't going to get you, is any keys from me.
More than that.... what do they need the information for? My employer signs my paychecks, few things hold more sway over my life. Do you think that means I emailed my boss my facebook password so he could poke around and see what I am up to in my personal life? No!
The more of such a relationship I have with them, the MORE I feel I want my personal data protected. What if I am gay and they hate homosexuals? What if I am straight and they hate straight people? Maybe they don't like something my wife had to say? Point is, if I have to worry that they might make discriminatory decisions against me, then its best that they don't have information that can be used to make such decisions. Better that they keep a racist on staff who doesn't know the race of the people whose accounts he deals with than find out the hard and long way that I am one of the people he hates.
Rememeber, anything can become illegal/considered imoral/irrationally disliked by any number of people at any time....and if you aren't ever saying or doing anything that couldn't be taken thr wrong way, or expose you to discrimination, then you just are not very interesting...and thats the last thing we should be encouraging as a society.
Re: (Score:2)
Would you trust a convicted monopolist with your keys?
As opposed to their competition? Uh.. yeah.
Re: (Score:3, Insightful)
Single sign-on means that if you're compromised once you're compromised everywhere.
I don't think there is a rule that you have to use a single account. I have multiple gmail accounts to separate hobby sites from work sites, etc.
If you use single sign on for slashdot, gizmodo, etc., I'm not really too concerned. It's not like someone is going to abuse my mod points more than I already do.
For important accounts I'll still use a separate identity/password.
I think there is confusion about SSO being forced for every account.
Re: (Score:2)
But if you do that, then why not just use a different password for each such group? Passwords aren't that hard.
Re:It's a bad idea (Score:5, Informative)
But if you do that, then why not just use a different password for each such group? Passwords aren't that hard.
I believe the submitter touched on part of the reason. Inconsistent password policies for length, characters and expiry date.
To this day there is one PITA site that won't allow "!" as a password character and it throws my whole system off.
Also, if I want to change my password, with SSO there is one change. With multiple sites....
Passwords may not be hard... but SSO is easier.
Re: (Score:3)
> Inconsistent password policies for length, characters and expiry date.
We _really_ need standards for passwords & passphrases: minimum LENGTH and SYMBOLS included.
If you site can't handles passwords / passphrases around ~ 96 characters long with the characters (space) 0x20 - 0x7E, your site is *broken*.
The same crap with usernames. Stop limiting me to a max username length of 12 characters A-Z,a-z because your shitty architect / programmer / DB guy doesn't have a clue about security.
I propose a mul
Re: (Score:3)
Many financial sites limit passwords to letters and numbers because they have a phone service (that you'd likely never use) that uses the same password. It's really quite annoying.
Re: (Score:2)
I love lastpass. No need to remember login info at all (except for your master password). The _only_ problem is when using my phone/ipad, it's a bit difficult to dig up passwords.
Re: (Score:2)
Re:Last pass (Score:4, Insightful)
I manage my passwords with lastpass. The service that Steve Gibson from GRC has vetted to be safe and secure
Hahahaha.
Wait - the same Steve Gibson that insisted raw sockets are security threat, some 10 years ago?
That Steve Gibson?
Hahahahaha.
Re: (Score:2)
Yes, but people still want a solution to the issue.
Re: (Score:2, Informative)
There is. Password managers.
Kwallet for example can do this automatically. I don't have to "remember" anything but the single password I encrypted it with. It remembers everything else. All the convenience of single-sign-on, without the problems of a single compromised site leaking all your sign on data to everything, and the problems of tracking.
Re: (Score:3)
What do I do when I want to log in to do a bank transfer when I'm at my mom's? Log in to read some email when at my friend's house? Post to /. from work?
Re: (Score:3)
Having a bootable linux flash drive is an option.
Yeah, if you like questions like:
What is that thing?
Why do you have to reboot my computer?
What the heck did you just do?
That's not Windows!
Did you break my computer?
Of course the next time they get a drive-by download while looking for porn (on their already virus-laden computer), it'll be: "My internet has been broken ever since that computer hacker guy screwed around with my computer."
Re: (Score:2)
Re: (Score:2)
In this case, ignorance isn't bliss. Reading about these [wikipedia.org] sort of protocols might be a good idea.