passwords are passé, sayeth Microsoft, Google, and PayPal

[Deviant Ollam]

Technology Leaders Favor Online ID Card Over Passwords

SAN FRANCISCO — Microsoft, Google and PayPal, a unit of eBay, are among the founders of an industry organization that hopes to solve the problem of password overload among computer users.

The Information Card Foundation is an effort to create a single industrywide approach to managing identity online that promises to reduce drastically the use of passwords and create a system that is less vulnerable to fraud.

“There is such a market requirement to solve this problem,” said Paul Trevithick, chairman of the new group and chief executive of Parity, an identity-protection technology company in Needham, Mass., that is developing what it calls an i-card. ... Rather than logging on to sites with user IDs and passwords, people will gain access to sites using a secure digital identity that is overseen by a third party.

i suspect there's plenty here that can get hackers' collective dander up. i'm not in favor of this sort of thing, but then again, i'm not in favor of just about every major "advance" in technology of the past decade that has served primarily as a means to make the internet experience more palatable or "cushier" for people who maybe don't need to be out there on the tubes.

One thing that i personally would like to see (and which would have an immediate effect on "password overload" without harming people's privacy) would be if more e-commerce sites would allow customers to check out without creating a fucking user identity.

If i could shout into a megaphone and be heard at an online retailer's convention, i would likely say something like this...

Hey, shitbag... i'm buying these packets of tomato seeds for my aunt who likes to garden. I'm never going to buy gardening supplies again, and I'm only buying from you this particular time because you had the lowest price when i did a Google search 30 seconds ago. I don't need to spend twice as long as the actual transaction itself picking a username, picking a different username because your site's backend won't let me simply use my junk email address, picking a new username because the one i wanted is already taken, selecting questions about my favorite pet's name and streets where i used to live and then just typing "suck my cock" into the answer field like i always do because no merchant needs that info about me, etc etc etc.

Just let me buy the fucking seeds and go on with my life without winding up in your database or memorizing yet another password. I will somehow find the strength to go on living even if my days remain devoid of the knowledge concerning the next time when you're having a sale on Miracle-Gro.

[renderman]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

I say we use Biometrics, of course that is also subject to tampering, glitches and other problems.

If you want simple, easily replicated and even more unique and individual than fingerprints than other existing biometric identification, I suggest Rectal Scans, because no two assholes are the same.

[streaker69]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

I say we use Biometrics, of course that is also subject to tampering, glitches and other problems.

If you want simple, easily replicated and even more unique and individual than fingerprints than other existing biometric identification, I suggest Rectal Scans, because no two assholes are the same.

Hey, that's my joke!

Exact same thing I told the guys at our plant they were going to have to do to authenticate to the SCADA system. You sit down on a specially designed chair with the 'probe' on it, and your system comes alive. ;)

[Voltage Spike]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

i'm not in favor of this sort of thing, but then again, i'm not in favor of just about every major "advance" in technology of the past decade that has served primarily as a means to make the internet experience more palatable or "cushier" for people who maybe don't need to be out there on the tubes.

The problem is that it is significantly easier to build technology with a certain infrastructure in place (read central organization, usually some corporation) than to build true peer-to-peer/personal technologies.

Everyone even remotely interested in online identity should watch Dick Hardt's talk on Identity 2.0. While most people focus on the style (which is brilliant and I would love to see it copied at Defcon), the content is thought-provoking and I think most people here would agree with his ideas.

One thing that i personally would like to see (and which would have an immediate effect on "password overload" without harming people's privacy) would be if more e-commerce sites would allow customers to check out without creating a fucking user identity.

I've never really understand the obsession with having to manage/maintain that much user data. Is it a matter of gathering marketing data, or do small web sites simply include that as part of the process "because everyone else does it"?

[moleprince]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

I agree completely on hating signing up for one-time purchases.

However, this does bring up a question. Would you support the use of OpenGPG cards as tokens for a less password-heavy system like they propose?

I'm generally opposed to the idea of focusing on biometrics, at least if they aren't just one factor in an MFA system. Which ironically means removing most of the convenience they're marketed towards.

Main issue off the top of my head: Biometrics being unique are very problematic in that once someone compromises your fingerprint [or rectum!], you can't simply revoke your finger and grow a new one. I suppose in theory you could have 10 chances.. but take voiceprints or retinal IDs. Now consider trauma that might damage or negate your ability to use biometrics, eg a gasoline fire melts your fingerprints off [like an uncle of mine]. Moreover, unless the scanner you use is swabbed after every entry, you wind up with a token that's like leaving characters of your password in the login box for the next person who logs on to see. Low end scanners at least offer up a host of exploitation possibilities even just for latent prints. And um. Right, ranting. Back to work.

[moleprince]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

On a related note, this is a lovely presentation by Dick Hardt on the topic:
http://identity20.com/media/OSCON2005/

[Deviant Ollam]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

this is a lovely presentation by Dick Hardt

his style reminded me of Johnny Long's intro.

[Deviant Ollam]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

by the way... a thread on Dave Farber's "Interesting People" mailing list is conversing about this topic.

a great post from someone named Rich Kulawiec included the following very relevant points...

when (not if) the third party is successfully hacked,
then the users' credentials will command a higher price on the open
market because they'll facilitate access to more than one site.

Oh, and would anyone like to make a side bet on how many days will elapse
before the third party is served with a national security letter compelling
full disclosure of every scrap of information in its possession and of
course forbidding it from announcing this publicly?

he's spot-on with both points, i believe.

[Voltage Spike]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

when (not if) the third party is successfully hacked,
then the users' credentials will command a higher price on the open
market because they'll facilitate access to more than one site.

What alternative do we have, though? Even in Identity 2.0 (that is, the user maintains various pieces of information that are signed by more-trusted entities), someone capable of reading the private key of a trusted entity could create identites at will (even yours! *cue ominous music*).

I suppose we could stick with the "walled garden" scenario and simply not share information between entities. (Which some users don't want and therefore willingly compromise their credentials for improved utility.)

A thought that just occurred to me is one-off access URLs for web services. The user inputs the partner site they wish to share their information with, the information site provides a URL with a long random number that the partner site can access, and the user provides that URL to the partner site. It doesn't immediately solve the (to me) lesser problem of Single Sign-On (SSO), but we could trivially develop a scheme for SSO, as well. Since the idea is so obvious, does anyone know who is currently implementing this scheme?

[moleprince]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

Google does something sort of like that for their webalyzer system where they will generate random string named HTML for you to create on your server to verify that you are indeed the owner, if they can crawl it you are then authenticated.

Discover takes one approach where they can generate random one-time tokens that you can pass to a shopping cart instead of your cc number.

I'm not sure how strong their RNG is on either of those methods, though.

[streaker69]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

Google does something sort of like that for their webalyzer system where they will generate random string named HTML for you to create on your server to verify that you are indeed the owner, if they can crawl it you are then authenticated.

Discover takes one approach where they can generate random one-time tokens that you can pass to a shopping cart instead of your cc number.

I'm not sure how strong their RNG is on either of those methods, though.

Doesn't Amex issue one time card numbers as well for online purchases?

[Voltage Spike]

Re: passwords are passé, sayeth Microsoft, Google, and PayPal

Google does something sort of like that for their webalyzer system where they will generate random string named HTML for you to create on your server to verify that you are indeed the owner, if they can crawl it you are then authenticated.

That's not quite the same thing, but still a pretty clever manner of proving administratorialship.

Discover takes one approach where they can generate random one-time tokens that you can pass to a shopping cart instead of your cc number.

I thought of that system as I was writing my post, as well. Most credit card companies seem to offer "virtual CC numbers" (i.e., a valid credit number tied to your account with some sort of restrictions (amount, uses, time)), and the intent is somewhat the same: I would like to unlock my information for someone, please give me a new key that I'm going to give to only one person.

Like I said, the idea isn't entirely original, so I wonder if anyone has applied such a solution to this problem space.