Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Bug

Passport's Pocket Picked 327

Posted by michael from the department-of-insecurity dept.
emmons writes: "It looks like there's another hole in MS Passport according to Wired. This one allowing a user to steal another user's Passport Wallet, credit cards and all, by getting them to open a hotmail message. Nice." What happens when someone steals the basket with all your eggs?
This discussion has been archived. No new comments can be posted.

Passport's Pocket Picked More

Passport's Pocket Picked

Comments Filter:
  • and get a Passport. I was about to buckle under the pressure...
      • From what I've heard of XP, Microsoft is trying a new technique: The peer pressure technique.

        Installing XP: Do you want to sign up for a passport account?

        booting up for the first time: Cmon, sign up for a passport account.

        starting up internet explorer: Sign up for a passport account. I'll be your freind!

        entering hotmail: Oh yeah? well I'm not going to let you go here unless you sign up for passport!

        this is a dramatization. I haven't used XP, and I don't want to(I have enough waiting in my life, thank you very much :))
  • ...this is just the beginning.

    • Do'nt put all your eggs in one basket (Score:4, Interesting)

      by dattaway ( 3088 ) on Friday November 02, 2001 @05:53PM (#2514554) Homepage Journal
      Quoting a gem from the article:

      "More than 70 sites are in the process of deploying Passport's authentication technology, according to Microsoft. Among them is Prudential Banking's Egg.com online bank, which is switching to Passport..."
      Egg.com sounds kind of ironic. Must be quite a marketing effort on Microsoft's behalf getting banks to deploy not tested technology on a mass scale.

    • Re:And think... (Score:2, Insightful)

      by El_Nofx ( 514455 )
      May I be mod'd as redundant....
      If you are stupid enought to trust ANYTHING vital to Microsoft in the first place then you deserve to have it stolen.
      I want to see the press release they put out on this, i can see it now

      "Here at Microsoft we are devoted to security, those evil hackers have again stolen your information, we must pass more laws punishing the offenders and in the future we will assure that nothing like this will happen again"

      What he is saying is (we want to throw the smart people in jail so only idiots are left to use our software)

      • The Right to Read [gnu.org]

        • ...Dan had had a classmate in software, Frank Martucci, who had obtained an illicit debugging tool, and used it to skip over the copyright monitor code when reading books. But he had told too many friends about it, and one of them turned him in to the SPA for a reward (students deep in debt were easily tempted into betrayal). In 2047, Frank was in prison, not for pirate reading, but for possessing a debugger.

        How long until it becomes true, instead of being a whacked-out conspiracy theory fantasy?

        --jeff
        • statusbar (jeff at statusbar dot com) wrote:

          > How long until it becomes true, instead of being a
          > whacked-out conspiracy theory fantasy?

          Oh, I don't know. I think certain companies and groups in certain industries (Microsoft, RIAA, MPAA) are nearly there now. I'm half expecting someone to get arrested soon for possessing a pencil or a scanner (both highly illegal in a warped view of the already warped DMCA).

          It seems that every few years/decades, some greedy moron(s) get some brilliant idea that will allow them to turn all their customers into cash cows, round them up, and milk them dry. Sooner or later, the usually placid customers start to resent such treatment and move on to the next, much greener, pasture (if the moron was lucky enough to have found some cows willing to be rounded up in the first place). This of course puts the idiots out of business. I'm sure the nice folks at Digital Convergence can explain that process to you in detail (assuming they have any staff left).

          What we are seeing now is the usual greedy idiocy stuff, plus companies and whole industries that are feeling really threatened. Microsoft has pretty much reached the end of its Windows/Office gravy train and is thrashing around trying to figure out how to keep the cash coming in. The recording industry is facing the double threat of file sharing and basement recording studios. Hollywood is also troubled by Internet copying of movies, and has some reason to worry about digital video and the success of a film like Blair Witch (not to mention competition from the Internet itself as a form of entertainment).

          Add to all that the uncertainty of the times, and you've got a bunch of scared, greedy folks who are grasping at anything to defend and expand their precious bottom line. Right now, they are all jumping on the intellectual property bandwagon. Sooner or later, John and Jane Q. Public are going to get fed up with their antics (probably when they try to tape the Super Bowl and find HDTV won't let them), and it will all stop.

          For now, we need to work to keep said groups and companies from introducing idiotic laws. It also helps speed things along if you stop doing business with the idiots in question, and keep your family, friends, neighbors, and coworkers informed of what is going on. Aunt Judy may not be a loyal Slashdot reader, but she would really care about being hauled off to jail for possessing a VCR. Better get her to write her congresspeople before that happens. Just be sure to tell her not to send snail mail (Anthrax scare), email (not taken seriously), call by phone (busy signals last I heard), or send a fax (probably out of paper due to it being stored in infected office buildings). Hm, maybe our (USA) lawmakers employ a psychic? ;)

          Microsoft, in particular, needs to just throw in the towel. They don't have the security to begin to attempt something like Passport. You can't just slap a EULA on someone's wallet, and say "Sorry, we aren't responsible". No amount of silencing security researchers or screaming "industrial terrorism" is going to cut it. Heck, Gates was on CNN this evening (talking about the stupid consent decree). He couldn't even face the camera and talk out of the front of his mouth like a real, honest, person! Sheesh!

          Happy Birthday, Godzilla! (The movie "Gojira" first aired in Japan on November 3rd, 1954.)
  • What happens when someone steals the basket with all your eggs?

    You through a smoke screen around the area until you can fabricate some new ones. Not to be a troll or anything, but this was only a matter of time.

    Maskirovka

  • What happens when someone steals the basket with all your eggs?

    You have nothing left for trick-or-treating with.
    • alternate answer: You become a non-person, unable to perform simple tasks such as apply for a job, purchase goods, or even recieve unemployment benefits. Forced out of modern society, you hitchhike across the midwest for several months, until you finally settle in southern Wyoming, where you manage to build a crude log cabin, and live off the land. Eventually, your life moves from survival to enjoyment of your new "wilderness" surroundings, and you spend the remainder of your years communing with nature in peace and tranquility.

      See, Microsoft did you a favor after all!

  • pre-paid Spam (Score:5, Funny)

    by DataPath ( 1111 ) on Friday November 02, 2001 @05:43PM (#2514503)
    great... the single greatest magnet for spam is also an open book to your credit cards. I can see it now: "Hot dirty sex... you've paid for it already, so you might as well cum see!"

    "You've already paid the fee to get in on our bogus pyramid scheme, so now it's YOUR turn to go steal from someone else!"
    • Whole new chain letters will come into existence...

      "Here is a list of credit card numbers. Add yours and send this mail to everyone you know. Don't break the chain!" Except you have already added your CC number and mailed it to everyone you know, thanks to Passport and a virus.

  • In 6 months .... (Score:4, Funny)

    by SirSlud ( 67381 ) on Friday November 02, 2001 @05:45PM (#2514515) Homepage
    > In addition, the company has modified a software timer so that Passport users must re-enter their password anytime they attempt to access the wallet service.

    will be

    > In addition, the company has modified a software timer so that Passport users must re-enter all the information associated with their passport account (including their Wallet account) anytime they attempt to access the wallet service.

    Which might be shortly followed by the first time MS has ever been able to claim their technologies are relatively secure. (Yes, I'll avoid being a jerk and suggesting anyone can ever be 100% secure. :)

  • Burning Reichstag (Score:3, Troll)

    by perdida ( 251676 ) <thethreatprojectNO@SPAMyahoo.com> on Friday November 02, 2001 @05:46PM (#2514518) Homepage Journal
    If this is Microsoft's unviersal security solution, I can';t believe they'd put out something that can be so easily cracked without knowing it.

    Is it concievable that M$FT is deliberately designing holes, staging exploits and publicizing them in order to get popular support for federally controlled security systems and universal elimination of anonymity?

    The anthrax could be the same thing.. government allowing it to spread, or spreading it themselves, to pressure Congress to pass the USA PATRIOT act, which they did, and to pressure us to accept strictures on our behavior?

    In both cases, ask: Quo bono? In the current climate, who benefits from these activities?

    Terrorists don't benefit from the anthrax, and OSS doesn't benefit from these Passport exploits. In both cases, the government benefits.

    • Re:Burning Reichstag (Score:5, Insightful)

      by Shotgun ( 30919 ) on Friday November 02, 2001 @05:58PM (#2514586)
      Good conspiracy theory, but I would have to say look at history in this case. MS is threatened. Sales revenue is in the toilet and the outlook for future sales is even bleaker. They have to come up with a strategy and implement it fast. What do they do?

      What they always have done. Rush a half-finished product out the door, and use whatever leverage they have to force it on whoever they can, while keeping the engineers busy in the back room with the bubblegum and duct-tape. Eventually, they'll get around to releasing a decent product.

      Course, I won't be buying it then either. 8*)

      • Unfortuantely, there will always be conspiracy theories behind Microsoft's mistakes. Microsoft does not have a simple 2D personality. There seems to be many sides to its marketing department. One side researches and then "invents" said technology into aa colorful package, another pushes that technology to everyone including those who don't need or want it, and one side cleans up the mess.

        And I'm sure there's a legal arm of its marketing department. The whole company reeks of marketing. There are way too many security fiascos from this company as they agressively push their touted inexpensive technologies onto the masses.

      • You were going well up until this point:

        Eventually, they'll get around to releasing a decent product

        but that part didn't make sense to me, after all, this is MS we're talking about.

        I can remember since the days of Windows 3 (about eight or nine years ago) that people have been hoping for Microsoft to eventually "release a decent product". We're still waiting for it. With every new release, people seem to forgive MS immediately and brush it off with "oh well, maybe the next version will be good, we'll endure the suffering in the meantime". (Perhaps XP is "it", but then is it really acceptable to wait close to *ten years*, and pay several times over during the wait, to get a half-decent product which is anyway several years behind what OSs should be by now, technologically? I can't think of a feature in any Microsoft Windows version that hadn't already been around for several years in some other system, and that includes XP)

    • 1. Terrorists DO benefit from anthrax, because it's scaring the shit out of the nation. That's, uh, the point of terrorism.

      2. Saying OSS doesn't benefit from passport exploits implies that the Open Source Software movement is responsible for the exploits. They're not. Microsoft is. And through some twisted, delusional logic you assert that Microsoft benefits from building in exploits.

      It's a well-known fact that CmdrTaco is trying to make it as easy as possible for trolls to post to slashdot, because he could use them as an excuse to further crack down on Joe Poster.

      Also, hospitals won't treat you if they find you have an organ donor card -- they'll let you die because other people need your organs.

      Furthermore, the entire world is an intricate conspiracy designed to repress you.

      LOOK OUT! THEY'RE COMING NOW!
    • >Quo bono?

      He was the whiny-voiced guy in the mohair vest that sang with that tall gangly chick before she had a minimum 35% post-consumer recycled body.

      Became a congressman and newest poster child for the Agony of Defeat(TM).

    • Never attribute to malice what could be explained by ignorance or stupidity. And Microsoft and the government have plenty of that to go around.
    • Comment removed based on user account deletion

  • Did anyone not see this coming? (Score:4, Insightful)

    by chronos2266 ( 514349 ) on Friday November 02, 2001 @05:46PM (#2514520)
    I remember a year or two ago a person could send you an email and obtain your hotmail account. Hotmail is a gaping hole in the passport service.

    With passport, microsoft wishes to be the customs agent of the internet. However, with flaws like this they really are not going to turn many people over to their side.

    I'm sure more exploits will pop up in the future. Most of them will likely use hotmail in someway or another to enter.

    • Re:Did anyone not see this coming? (Score:5, Insightful)

      by Jason Earl ( 1894 ) on Friday November 02, 2001 @06:48PM (#2514798) Homepage Journal

      Hotmail is also the source of all of the passport accounts. Microsoft knows that Windows XP is not going to generate enough Passport accounts to entice web sites to start including Passport hooks. Hotmail, on the other hand, is very popular, and already has millions of users. Besides, if Microsoft can't design a secure Passport site, what is the chance that the bozos at your bank are going to be able to design a secure Passport site?

      In other words Hotmail is both the primary draw for Passport, and an important proof of concept. Unfortunately for Microsoft it is also a huge gaping pile of security holes.

      • I come here to the altar of Slashdot to confess it:


        I too have an Hotmail account!!!


        Come to think of it, i have at least 5 of them, all with funny names.


        Judging from the options Hotmail returns to me when i try to register a funny name and it's already take (it sugests things like funnyname54@hotmail.com), i would say i'm note the only one...

    • No one knows, or cares (Score:5, Insightful)

      by xtremex ( 130532 ) <cguru@bigf[ ].com ['oot' in gap]> on Friday November 02, 2001 @07:57PM (#2515015) Homepage
      The typical user does NOT get this information.
      They are happily using their Hotmail accounts and have NO clue that these things exist. Sure, they might have it in PC World, or maybe the Technology section of the Times, but my MOTHER does not read these things. Only us geeks in the industry know ( we are a small percentage of the population).
      Microsoft will fix this to appease the security experts, but that's about it.
      As long as Joe Sixpack can stay happily ignorant, MS is happy. For example, one of my friends, a very intelligent Nuclear Physicist, just got suckered in to a CompUSA MegaPC w/ 1.2 GHZ, 1 GB RAM , DVD RAM and Windows XP for anout 5 Grand. He browses the web PERFECTLY fine on his 988 MHZ PC. He said the "pretty colors" of XP sold him. I told him of the security flaws and reasons for not going with XP (never mind the absolute non-necessity of the PC), and his response was "How come I haven't heard about these things you talk about?" I had no answer. That's how Microsoft stays in power. If we step outside the industry for a minute, we can see that Linux means nothing to most people, AOL IS the internet, and Windows IS a computer. How do we fix this? I don't know, but someone must.
    • Passport is definitely an easier solution for consumers than any alternative yet presented. Having all your information stored in one central location is definitely better than having all your information stored all over the place. Microsoft also has a lot more motivation and resources to protect it than Joe Random Vendor.

      The problem is that they haven't had any success protecting it anyway. To be completely fair, neither has anyone else. The other difficulty is that although I would trust MS rather than JRV to protect my data, the necessity of distribution and interaction opens up a whole new class of security holes that no one has even thought of before.

      The unfortunate truth is that right now the only way to protect your privacy online is not to give out any information, and that Passport will do exactly nothing to remedy this situation.
    • Hotmail is a gaping hole in the passport service.

      But why is Hotmail special? (OK, aside from the fact that most of the 200m Passport users MS claims probably got hooked in via that route.)

      Passport is supposed to be an independent data store, right? A Passport-enabled client needs to know something about you and you've signed in, so they can go ask MS for that specific information. They aren't supposed to get anything else back. So, given that Hotmail is just another client (it is just another client, right?) then surely if you can break it using Hotmail, someone else could expose the same vulnerabilities via any other Passport-enabled client using similar Passport features.

      So, what am I missing? What's so special about Hotmail? Why is Hotmail the gaping security hole?

  • more info (Score:5, Informative)

    by Leper ( 22654 ) on Friday November 02, 2001 @05:47PM (#2514523)
    ok, obviously my post will be rejected as this one already made it through (they rejected Marc's initial story which I guess shouldn't surprise me), but here's more linkage about where you can read about the technical details:

    Marc's Passport Advisory [znep.com]

  • i want to go home and play civ3 (Score:4, Troll)

    by smack_attack ( 171144 ) on Friday November 02, 2001 @05:47PM (#2514524) Homepage
    What happens when someone steals the basket with all your eggs?

    Send special forces to kill the bunny. And cluster bombs, lots of fucking cluster bombs
  • You sue them under the DMCA, future SSSCA, Anti-Terrorism Act, or the like.

    A testimony to the proposition that security CAN be legislated.

    (Yeah, right.)

    • Re:What happens when someone steals the basket wit (Score:5, Insightful)

      by MaxwellStreet ( 148915 ) on Friday November 02, 2001 @05:55PM (#2514565)
      Interestingly, this is exactly what will happen.

      Only the discoverer of the hole will be forced to announce it anonymously, and publish it only in dark little places where the lawyerly eyes of Microsoft won't find it. And unscrupulous eyes will.

      I can see it happening already. And Microsoft would not even hear of the hole until it's far, far too late. It will be a very, very dark day if information is compromised on this scale.

      The DMCA in this case would directly contribute to the destruction of the integrity of the Passport system.

      Simply put - if only outlaws find security holes, then only (genuine) outlaws will have access to them.
      • Interestingly, this is exactly what will happen.

        Only the discoverer of the hole will be forced to announce it anonymously, and publish it only in dark little places where the lawyerly eyes of Microsoft won't find it. And unscrupulous eyes will.

        Or you could just post it in any country in the free world that doesn't have the absurdities DMCA and such. You might try pretty much anywhere in Europe, for a start. :-)

  • Killing the messenger? (Score:4, Interesting)

    by Rinikusu ( 28164 ) on Friday November 02, 2001 @05:48PM (#2514532)
    Anyone remember the story with MS whining about how security people should just shut their cake-hole and not "reveal" exploits? I wonder if they'll take the same stance on this one.

    "Well, it wouldn't have been too much of a problem until those meddling kids at Apache showed up..."

    • He did exactly what MS asked, "Because of the severity of the flaws, Slemko withheld publication until Microsoft had an opportunity to correct it."

    • Re:Killing the messenger? (Score:5, Interesting)

      by bstrahm ( 241685 ) on Friday November 02, 2001 @06:37PM (#2514746) Homepage
      I am just wondering what the legal implications of reveiling a flaw to Microsoft is...

      Imagine this scenario...
      1) You discover a flaw that allows you to get a hold of everyones on the Internet credit card
      2) You tell the vendor and wait.
      3) The vendor acknoledges the flaw and posts a patch
      4) In between 2 & 3 "nasty evil little hacker" discovers the same flaw and exploits it to his economic advantage (but not enough to get himself caught)
      5) Vendor discovers that "your" hack has been used againt them for a period of time...

      Who would you send the cops after ???
      How would you go about proving your innocense, Don't get me started on Innocent until proven guilty -- I don't buy it for a second...

      6) spend 20-life in jail ???

  • Well so much for single sign-on (Score:5, Informative)

    by geophile ( 16995 ) <(jao) (at) (geophile.com)> on Friday November 02, 2001 @05:49PM (#2514534) Homepage
    I really like this part:

    In addition, the company has modified a software timer so that Passport users must re-enter their password anytime they attempt to access the wallet service.

    While Slemko's exploit, which relied on stealing browser cookies used by Passport, has been rendered inoperable by Microsoft's fixes, the programmer said "deeper issues" remain with the service.

    "Passport's greatest marketing strength -- the single sign-on -- is also its chief technical weakness. It will be fairly trivial for attackers to dream up new ways of exploiting this," he said.

  • XP Integration is evil (Score:5, Informative)

    by jeeryg_flashaccess ( 456261 ) on Friday November 02, 2001 @05:49PM (#2514537) Homepage Journal
    Why? I installed XP for my dad, everything works perfectly. The OS is great. I got tired of passport starting up, so I clicked on it, cancled a few prompts, went to settings, check 'do not start up on boot', and closed the program. IT STILL STARTS UP ON BOOT. My point is that MSFT has made it very difficult to stop the damn thing from starting. Screw Passport.

    • Re:XP Integration is evil (Score:5, Informative)

      by Phil Wherry ( 122138 ) on Friday November 02, 2001 @06:11PM (#2514643) Homepage
      Passport really isn't an application on your desktop machine, but MSN Messenger (which requires Passport) is. Messenger is a really irritating application in its own right. And it's actually even more irritating if you have signed up for Passport using a Hotmail account, since it feels compelled to notify you of waiting email at Hotmail every eight microseconds--and it's essentially impossible to keep Microsoft from spamming you with "special offers" that you must know about right away.

      You can, however, uninstall it!

      Have a look at the file c:\windows\inf\sysoc.inf

      Then change the line that reads:


      msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7

      to

      msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,,7

      Then go to the Control Panel, choose Add/Remove Programs, then select the "Windows components" tag. You'll note that "Windows Messenger" now appears at the bottom of the list; just remove it, and Windows/MSN Messenger will bother you no more.

  • Public knowledge (Score:1, Insightful)

    by lexcyber ( 133454 )
    I sure hope this don't stay on slashdot. It should really be public knowledge that this sort of thing can happen in the passport service that MS provide. - ASAP

  • New Passport Slogan... (Score:5, Funny)

    by ZZane ( 144066 ) on Friday November 02, 2001 @05:49PM (#2514539)
    Where did your wallet go today?

    -Zane
  • This is but one example, but. . .how many user names/pass do you think can be garnered through a simple brute force script? A third? My father does a good number of things through Sun. Check out their auth. It relies more on SAW encrypt, which in turn in certainly more solid. And yes, I have your hotmail account. . .
  • Yeah so the chance that I'll ever give microsoft an important piece of information: 0. I can't wait to see how they spin this.

  • File suit with the FTC (Score:5, Interesting)

    by dillon_rinker ( 17944 ) on Friday November 02, 2001 @05:54PM (#2514555) Homepage
    Who'd like to file suit with the FTC against Microsoft for false advertising? I think we all know that there is no such thing as absolute sceiruty, or that security is a process, not a result, etc etc. But does the average non-geek American know that? For that matter, does the marketing deparment at Microsoft know that?

    You can't market a product as having qualities it doesn't have without getting into trouble with the FTC. Granted, MS will try to spin this as "Those bad Linux hackers will steal your data!" The fact remains that they've lied to the American consumer. I think they need to be forced to amend their advertising.

    • Re:File suit with the FTC (Score:5, Funny)

      by ktakki ( 64573 ) on Friday November 02, 2001 @06:54PM (#2514827) Homepage Journal
      I am in the process of preparing a personal injury lawsuit against Microsoft.

      A few weeks ago, I happened to see their advertisement promising "99.999% uptime". The subsequent expulsion of my carbonated beverage through my nose injured my delicate nasal passages and frightened my cat.

      When I become Emperor of the Universe, Microsoft's advertisements will have to bear a Surgeon General's Warning.

      k.
      • Let me know if/when you win. I'm going to come after your new found wealth for the same reason. I laughed so hard at your post, I fell out of my chair... :o)
      • > A few weeks ago, I happened to see their advertisement promising "99.999% uptime".

        Believe it. If you have the bucks, you can even make Windows reliable, if not terribly flexible. They got clustering pretty good (I didn't say spectacular) in Win2k datacenter, and they get real experts running it. That you have to buy this kind of SLA to get a web server that doesn't, say, fall over upon receiving 256 concurrent hits, is rather sad.
    • The fact remains that they've lied to the American consumer. I think they need to be forced to amend their advertising.

      Excelent point.

      Not that we'd be able read or hear such amendments, but it still might affect the consumer. Having Microsoft ads sound like a drug ad or "used car sale mega blowout" ad with those rumbling fast-mouths at the end might persuade the consumer to think twice before swollowing the MS pill.

  • And this will be reported by who? (Score:5, Interesting)

    by cluge ( 114877 ) on Friday November 02, 2001 @05:55PM (#2514561) Homepage
    Sad isn't it, here is the VERY thing all those "privacy people" keep screaming about. The thing that MS says won't happen. The idea should chill us all to the core, after all with XP released it's just a matter of time before a magority of american's will have a "passport". Will it be reported by any big news organizations? Will it make front page (it should).

    In the end I guess I best move to the bahamas and start ordering lots of neat things with all these new credit card numbers that magically appeared in my hotmail account.

  • Microsoft .Net and Passport to blame!

    Bill Gates identified as culprit: "We of the Taliban shall never be defeated!" shouts the software terrorist as he is hauled off to a comfy cell.

    More news as this story breaks ...

  • What about PayPal etc.? (Score:4, Insightful)

    by byronne ( 47527 ) on Friday November 02, 2001 @05:56PM (#2514571) Homepage
    Maybe I'm being stupid here, but what's the diff between Passport and PayPal, and why hasn't PayPal been a crack target?

    Also, I had no idea 165 MILLION people were already using Passport - I suppose my OS hasn't asked me enough times to sign up for it until I break under the strain...

    • Re:What about PayPal etc.? (Score:4, Interesting)

      by dwlemon ( 11672 ) on Friday November 02, 2001 @06:03PM (#2514610)
      There have been attempts to get PayPal user's information. Quite a while ago somebody set up a site called PayPaI.com (note the capital I) and sent out spams that linked to the site. the site looked just like PayPal with a place to type your username and password.
    • 165 million people are using Hotmail

      99% of statistics are wrong or misleading

      Just like all those people who have installed windows media player, it is added to an IE upgrade by default.....

      Yawn
      RickB
      • so I would assume that, unless your statmenet is an extremely rare (like, say, 1% ;) case, what you just said is wrong or misleading.

        don't you just love paradoxes?
        } // stupid_geek_humor()
    • Also, I had no idea 165 MILLION people were already using Passport - I suppose my OS hasn't asked me enough times to sign up for it until I break under the strain...

      Hotmail accounts are Passport accounts. This probably accounts for the bulk of them. A non-zero number of Hotmail accounts are inactive, or are just used as throwaway accounts. Interesting to see figures on this.

      Microsoft just changed their Hotmail policy to require a login every 30 days or they'd disable your Hotmail. If you pay them money, you can get an upgraded account that includes never being disabled (while yu pay) and more storage. Still has a paltry attachment limit though.

  • Passport liability (Score:4, Insightful)

    by stox ( 131684 ) on Friday November 02, 2001 @05:57PM (#2514582) Homepage
    I haven't read the pasport user's agreement, but would I be incorrect in guessing that Microsoft takes no responsibility for the safety of one's personal data? We're sorry we ruined your life, but if you read the fine print you will see that we are not responsible for anything. When will Microsoft be held responsible for it's actions?
    • The other interesting thing about this, is that one of the arguments against open source software is that "who are you going to blame". Sure, with commercial software, there is an entity you can holler at, but the Licencing Agreements give you about the same redress in case of bugs in software.

  • Another lesson to be learned from this (Score:4, Insightful)

    by Paul Boven ( 211567 ) on Friday November 02, 2001 @06:02PM (#2514604)
    This shows that your private information may not be in the best hands when entrusted to a company
    like Microsoft. But there are other 'takers'. Some even with the best of intentions.

    If any of them ever gets to be the one and only 'central repository', they will be subject to just this kind of attack as well. If you can't compromise the service, then hack into the user's desktop. As soon as enough people use it, it becomes a very attractive target. In a similar vein, there have been viruses that target the client end of home-banking software.

    Security is enhanced by redundancy, by having several distinct systems in place, preferably as dissimilar as possible. Monoculture and monopolies always form a fertile environment for viruses and other pests.

    I feel this makes the whole idea of a centralized service like Passport or any of it's competitors an extremely dangerous development.

  • This is why... (Score:4, Informative)

    by Amazing Quantum Man ( 458715 ) on Friday November 02, 2001 @06:03PM (#2514608) Homepage
    I never (knowingly) allow any site to keep my CCnumber and why I always use a "temporary" CC number (for example Amex Private Payments).

  • it isn't just about hotmail and passport wallet (Score:5, Interesting)

    by Marc Slemko ( 6200 ) on Friday November 02, 2001 @06:05PM (#2514618)
    While I make this point in my paper, I just wanted to make sure people understood:

    The real risk here isn't to hotmail or passport wallet (passport wallet isn't really an integral part of passport, just another service using it for authentication). It is to all things using passport. That isn't so much right now. But if Microsoft has their way, it will be. The sample exploit used Hotmail and Passport Wallet simply because they are commonly used services.

    I would also like to note that Microsoft has been quite forthcoming with details and admitting the problems and fixing them. They are very good at being reactive. We will have to see how well this works going forward.
    • I would also like to note that Microsoft has been quite forthcoming with details and admitting the problems and fixing them. They are very good at being reactive. We will have to see how well this works going forward.


      As good as MS has been at reacting to problems, I think the fear here is that MS has not shown much interest in being PROactive in preventing such problems, particularly problems with such potential for ruining people's credit histories or bank accounts. If that is a legitimate fear, then it's a whopper!

      As you imply, this is the tip of the iceberg, if Passport is intended to be the be-all, end-all for .Net access to those services offered by MS and its agents.

      ---

  • "It is very clear that either Microsoft does not have sufficient resources in place to properly review the security of their services and software, or that they are aware of the shortcomings but decided that attempting to gain market share was more important than their user's security," he said.

    I'm gonna go for all of the above

  • XP == (Score:4, Funny)

    by dbretton ( 242493 ) on Friday November 02, 2001 @06:09PM (#2514636) Homepage
    eXport Privacy

  • Offline Forever (Score:3, Interesting)

    by rusti999 ( 167057 ) on Friday November 02, 2001 @06:13PM (#2514647)
    Comment from Passport's program manager:

    the wallet service will remain offline until the company can add additional security features "to ensure that similar exploits cannot be used to compromise our user's credit card information."

    What's the standard for this? Based on Microsoft's track record, a new exploit will come up regardless of how many patches are issued. No way I'm going to let them keep my personal data. Too bad the average consumer may not realize this.

  • Anyone ready for that negligence suit? (Score:3, Interesting)

    by weez75 ( 34298 ) on Friday November 02, 2001 @06:13PM (#2514651) Homepage
    While we espouse our need to breakup Microsoft we have overlooked our great need to sue for negligence and false advertising. Their products do not perform safely nor with the diligence we as consumers need. This is another case of a lack of thought and concern put into a consumer product. If Passport were a vehicle or food product, the manufacturer would have been sued for negligence.
    • ...But people have been conditioned to accept software bugs and security holes as the norm. People's expectations of software (whether on their own PC or on an Internet server somewhere) is so low that MS can get away with crap like this. What low expectations don't cover, the EULA will. If a negligence suit ever saw trial, I bet the jury would be hit over the head with the "IN NO EVENT SHALL MICROSOFT AND/OR ITS SUPPLIERS BE LIABLE FOR...ANY DAMAGES WHATSOEVER..." language from the EULA. After all, the users agreed to live with this level of service. If Ford and Firestone only had a EULA to cover their problem...

      -z

  • What about the other ways your CC # can be stolen? (Score:3, Insightful)

    by nvrrobx ( 71970 ) on Friday November 02, 2001 @06:19PM (#2514665) Homepage
    People seem to be blowing this out of proportion, IMHO.

    How often do you hand your credit card to a server at a restauraunt? A store? Over the phone to pay for something? Are you forgetting that your credit card number can easily be stolen that way? Most receipts from purchases have your credit card number on them. Do you shred / burn them to stop someone from getting your CC #?
    • Do you shred / burn them to stop someone from getting your CC #?

      Actually, many people do just that.

      That's not the major point, though. This "crack" will allow someone to, perhaps, manipulate your financial portfolio if it's set up through Passport. "What do you mean, I just bought 10,000 shares in Hot Girl Condos on margin?" Millions and billions of dollars there, at risk, if MS gets their way and that sort of thing is hooked through your Passport account.
    • Yes, at the very least I tear out the code, rip it in half and throw away the pieces separately. Nor do I ever let my credit card out of my sight at a resturant. If I make purchases online or over the phone I have a separate minimum-limit ($500 limit) card that I charge to. And if Im really suspicious I create a one-time cc number with not more than the amount due available on it.

      You do realize that you can be held liable for whatever charges your card incurs if you do not follow this kind of practice, dont you? And you do realize what happens if you are held liable for a $10K shopping spree that someone went on with your credit card? You pay it, you pay it at once, or your credit rating is slashed, you default on your house mortgage as your bank suddenly wants their money back and their money back _now_, you wont be able to get a new loan and you'll have to sell pretty much everything you own.

      Im not kidding, I've seen that happen. I have a coworker who makes as much as I do, who can barely afford to eat lunch in the company resturant. Your life suddenly becomes a helluvalot more expensive once you're put on rapid payback on all your loans and the interest rates you're paying are doubled.

  • Wow (Score:5, Interesting)

    by augustz ( 18082 ) on Friday November 02, 2001 @06:24PM (#2514691)
    I can't beleive this actually happened. I mean, their entire .NET initiative is riding on this passport business and showing they can secure your information.

    What folks need to do is hold off on publishing these exploits (as Microsoft requests) until they've got a lot more riding on it. When a couple of banks lose a couple of million bucks on this, not to mention the confidence of their customers, well, then you might get some real coverage.

    Remember, Microsoft wants to build houses of straw, and likes to call anyone who points out they are made of straw terrorists. Of course, as soon as I see that attitude from someone I'm supposed to trust I run as far and as fast as I can just as I'd run from a used car salesmen who wouldn't let my mechanic check out the car.

  • Where do you want to go with my money today? (Score:4, Funny)

    by Srsen ( 413456 ) on Friday November 02, 2001 @06:28PM (#2514713)
    You will be assimilated. Resistance is fut- HEY! Who took my wallet?

  • WWMRTD? (what would mr t do?) (Score:4, Funny)

    by dbretton ( 242493 ) on Friday November 02, 2001 @06:32PM (#2514729) Homepage
    What happens when someone steals the basket with all your eggs?

    Eggs? What you talkin' all about eggs for? Don't give me none of that Gibber-Jabber, or you best be tossed!

    You took a wallet? I don't see no crazy wallet! You're talking like Face, crazy fool!
    Besides, you don't need no wallet! Just dial
    1-800-COLLECT and save a buck or two.

    XP? That better mean Xtra Punishment, cause that's what I'm gonna do to that Gates fool! He can't escape me, cause my van's hella fast!

    Don't do drugs! Drink milk!

    Come here, sucka. I'll toss you!
  • Is a single .sig service... No matter which service I am logged into (web, e-mail etc.) I get the same lists of .sigs

    - Nothing but a 32 bit operating system, running on a 16 bit core, based on an older 8 bit operating system, run by a 4 bit company that can't stand 2 bits of competition

  • Priceless (Score:3, Funny)

    by vex24 ( 126288 ) on Friday November 02, 2001 @06:51PM (#2514810) Homepage
    Dell Computer: $1099
    Microsoft Windows XP: $219
    Compaq IPaq with Windows CE: $499
    Subscription to .NET services: $19.95/mo
    Microsoft Passport: Free*

    Having your MasterCard(TM) info on the net for anyone to see:

    Priceless.

    (*note: This is a parody of the successful "Priceless" MasterCard(TM) advertising venture. As a parody it is protected under the 1st amendment established by MasterCard(TM) v. Nader) :p

  • FYI (Score:2, Informative)

    by SmurfButcher Bob ( 313810 )

    The odd thing, however, is that these cookies that are set as a result of Passport authentication are, at times, unique to the browser window they were set in. If I open a new browser window, the cookies are not sent and I am not authenticated.

    Think DRM tokens, e.g. pay per viewing instance.

  • Economic Issues (Score:3, Interesting)

    by shadowtech ( 161397 ) on Friday November 02, 2001 @09:03PM (#2515139)

    I have been ranting to all of my clients and friends about this sort of problem ever since MS came up with the idea of passport.

    Scenario:

    2 years from now 150 million people actually have their personal details and credit card numbers stored with MS (this isn't so now, people have passport accounts by default due to hotmails reliance)

    Another hack comes out and it is proven that the vast majority of credit card numbers for people were compromised.

    Visa, Amex, Mastercard et al are forced to re-issue credit cards to all people using passport

    The global economy is severely disrupted due to the downturn in online spending, the overall costs incurred by the replacement and the lack of consumer confidence in online shopping, banking etc

    Microsoft point to the famous "we're not liable for jack shit" clause in the agreement



    So what happens? Does MS still get sued? Do the credit card companies just sit back, hemorrhage and go "Oh well, shit happens."?

    Most importantly, do consumers finally realise that they have been taken for a ride for the last 7 years and boycott?



    This really scares me. Giving personal details to any company is bad. Giving them to a company with a severely impaired security record is just plain stupid.

  • estimates of the number of Passport users? (Score:3, Interesting)

    by call -151 ( 230520 ) on Friday November 02, 2001 @11:15PM (#2515383) Homepage
    Any ideas on how to get a reasonable estimate of the number of Passport users? From the article:
    Overall, up to 200 million people have signed up for Passport accounts, which are nearly impossible to avoid under Microsoft?s new Windows XP operating system.
    200 million is more than half of all Americans, newborns to 100+ year olds, so if these were only Americans, that seems ridiculous.

    "Up to" is vague- It is true that "up to 7 billion people have as much money as Bill Gates", but it might be good to have a better estimate...

    If you are counting hotmail accounts, many people have multiple accounts, which could get things up towards 200 million just in the US, so I am curious how many distinct users there really are. In particular, how many people have more than the default setup from having a hotmail account and actually have info in a Passport wallet? For people with multiple hotmail accounts (for different purposes, expired purposes or just forgot about it) presumably they would have one or only a few accounts with the credit card info and so on.

Slashdot Top Deals

Know Thy User.

Close