{"id":924,"date":"2008-02-25T12:29:58","date_gmt":"2008-02-25T20:29:58","guid":{"rendered":"\/?p=924"},"modified":"2008-02-25T14:13:40","modified_gmt":"2008-02-25T22:13:40","slug":"from-screen-names-in-bondage-to-openid","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=924","title":{"rendered":"From “Screen-Names in Bondage” to OpenID"},"content":{"rendered":"

Google's Ben Laurie proposes using “functions of passwords”<\/a> rather than plain passwords as a way to avoid phishing:\u00a0<\/p>\n

Kim Cameron writes about fixing OpenID\u2019s phishing problems by using Cardspace<\/a>. Certainly I agree that using strong authentication to the OpenID provider fixes the phishing problem – but if you have strong authentication, why bother to use OpenID at all? Why not strongly authenticate to the site you are really trying to log into, instead?<\/p>\n

Of course, Cardspace is a pretty heavyweight solution for this, so perhaps that\u2019s what Kim\u2019s getting at? It also doesn\u2019t work well if you have more than one machine – moving your credentials around is not something Cardspace does well.<\/p>\n

In my view, there\u2019s a sweeter spot for solving this problem than Cardspace (or OpenID, obviously) – and that is to do strong authentication based purely on a password. That way, you can use the same password everywhere, so no problem with moving between machines, but can still resist phishing attacks and don\u2019t have to make yourself linkable across all sites. Obviously supporting this would be way easier than taking the whole of Cardspace on board, but would have all of the immediate advantages. Clearly it would get you nowhere with advanced identity management, but its not like we don\u2019t already have protocols for that and nor does there seem to be much demand for it yet.<\/p><\/blockquote>\n

I take it Ben is talking about having a toolbar that asks for your password, and transforms it based on the site's identity so you can use the same password everywhere.\u00a0 Perhaps he is even thinking about a digest protocol where this transformed password would be used to calculate a “proof” rather than transported over the wire.<\/p>\n

Phished\u00a0or Pharmed<\/strong>\u00a0<\/p>\n

Problem is,\u00a0such a toolbar is as\u00a0easily “pharmable<\/a><\/em>” as OpenID is phishable.<\/p>\n

How does a user know she is typing her password into\u00a0the legitimate toolbar – rather than an “evil replica”?\u00a0 Our experience with toolbars teaches us that is easy to trick a\u00a0LOT of people into using fakes.\u00a0 In fact, sometimes the fakes have propagated faster than the real thing!\u00a0 Once people get used to typing passwords into a toolbar you have truly opened Pandora's Box<\/a>.<\/p>\n

Let's\u00a0look at what happens when\u00a0the kind of\u00a0“common password” Ben proposes is stolen.\u00a0In fact, let's compare it to\u00a0having money stolen.\u00a0<\/p>\n

If\u00a0you go into a store and\u00a0are short-changed,\u00a0you just lose money in one store.\u00a0 If\u00a0you are\u00a0pick pocketed,\u00a0you just lose what's in\u00a0your wallet –\u00a0you can cancel your cards.\u00a0 But if\u00a0your “common\u00a0password” is intercepted, it is as though you have lost money in ALL the stores you have been in.\u00a0\u00a0\u00a0And sadly, you will have lost a lot more than money.<\/p>\n

The ultimate advantage of moving beyond passwords is that there is then NO WAY a user can inadvertantly give them away.<\/p>\n

Is CardSpace too heavy-weight?<\/strong>\u00a0<\/p>\n

CardSpace\u00a0should be a lighter-weight experience than it is today.\u00a0 We're\u00a0working on\u00a0that,\u00a0making it less “in-your-face” while actually increasing its safety<\/em>.\u00a0 I also agree with Ben that it needs to be easier to roam credentials.\u00a0 We're\u00a0working on\u00a0that too.\u00a0<\/p>\n

The point is, let's\u00a0evolve CardSpace – and the interoperable software being developed by others – to whatever is needed to really solve\u00a0the relevant privacy and security\u00a0problems, rather than introducing more half-measures that won't be effective.<\/p>\n

So why OpenID?<\/strong><\/p>\n

If that's all true, Ben wonders why we bother with OpenID at all…<\/p>\n

The most important reason is that OpenID gives us common identifiers for public personas that we can use across multiple web sites – and a way to prove that we really own them.<\/em><\/p>\n

That is huge.\u00a0 Gigantic.\u00a0 Compare it to the cacophony of\u00a0“screen-names” we have today – screen-names in bondage, prisoners of each site.<\/p>\n

Technology people are sometimes\u00a0insulted when you imply they haven't solved the world's problems.\u00a0 But to be really important, OpenID doesn't have to solve the world's problems.\u00a0 It just has to do this one common-identifier thing really well.<\/strong>\u00a0 And it does.\u00a0 That's what I love about it.<\/p>\n

CardSpace doesn't\u00a0address the same\u00a0problem.\u00a0 CardSpace plus OpenID solve it together.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

Common identifiers that accrue reputation across social networking and blog sites will knock your socks off. <\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[24,8,15,22,4],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/924"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=924"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/924\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}