Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security The Internet Technology

The Liberty Alliance Grows Again 111

Posted by Hemos from the now-if-they-would-just-do-something dept.
sempf writes "The Liberty Alliance, a Sun-backed open-specification alternative to the Microsoft platform's Passport system, has added two very powerful members, Oracle and Intel. Now over 150 members, one wonders at the future of a world where we have two single sign-on systems. With the three big IM platforms joining forces, is the identity standard of the world going to be Microsoft, or Sun? Is this going to be the next Browser War?"
This discussion has been archived. No new comments can be posted.

The Liberty Alliance Grows Again More

The Liberty Alliance Grows Again

Comments Filter:

  • No. (Score:5, Insightful)

    by Morgahastu ( 522162 ) <bshel ... fave bands name> on Monday July 19, 2004 @08:07AM (#9736774) Journal
    No. There won't be a war because no one wants it. MSN's passport has been around for a long time now and barely anyone uses it.

    • Re:No. (Score:5, Interesting)

      by 16K Ram Pack ( 690082 ) <tim DOT almond AT gmail DOT com> on Monday July 19, 2004 @08:11AM (#9736795) Homepage
      That's for a number of reasons.

      - You have to pay to use it for your site.

      - Lots of people don't trust Microsoft's security.

      - Some people are concerned about single platform/single corporation.

      I'd love to have a single ID.

      • Re:No. (Score:5, Interesting)

        by blowdart ( 31458 ) on Monday July 19, 2004 @08:17AM (#9736820) Homepage
        Yes, but is anyone actually using Liberty? It's all very well signing companies on, but what web sites actually use the damned thing?

        Reading the testimonials [projectliberty.org] it's all fluffy, without implementation (excluding one company which seems to use it for internal enterprise authenication, which is a way different market to Passport)

        • I suppose it's the old "small acorns" thing.

          If there's enough big companies, particularly in the mobile area, there's a chance of big advertising.

          I have lots of different sign ons, and would like a single sign-on, if only just for information sites rather than credit card sites.

          Small site builders could also benefit from having no need to have their own security databases.

        • Liberty Alliance has devolved into an industry interest and lobbying group. I dson't think there are any plans to roll out a united sign-on anytime soon. When Passport died, so did the utility of this body. One has to wonder why it still exists.
          • Everyone here seems to have missed the point. The biggest application of Liberty Alliance and WS-Federation is to provide authentication for web services. Web services have no standard authentication mechanism. Don't you see how exposing authenticated web services would be huge for interconnecting businesses?

        • Re: or... yes! (Score:3, Interesting)

          by atomico ( 162710 )
          Liberty-based Single-Sign-On is a very interesting solution, especially for mobile operators: entering usernames and passwords for each service using a phone is such a pain that allowing Single-Sign-On would increase acceptance of mobile subscription services. In addition, you already have a powerful means of authentication, the one allowing you to attach to the network and place calls.

          Some vendors already have Liberty-compliant solutions ready for production, with mobile operators running trials. I am no

          • " you already have a powerful means of authentication, the one allowing you to attach to the network and place calls."

            In Europe it's already there, it's a SIM card. So again, what's the point? When authenication is implemented in hardware and can be easily passed around by the operator why implement a software solution?

            • The SIM card is used to authenticate to the mobile network -implemented in hardware, as you well said. This authentication can also be reused by the operator for the services it sells to its customers. But, if no other mechanism is implemented, it remains limited to the operator realm.
              The advantage of the Liberty single-sign-on specification is that it provides a method to share the SIM authentication with third parties, so that the end-user does not have to go through the login procedure each time.
              Libe

      • Re:No. (Score:3, Interesting)

        by zimba-tm ( 598761 )
        That really put the question :
        - Why they can't do a protocol without wanting to take it for them ? :p

        I mean, have you seen somewhere on the internet that all the emails have to be at hotmail ? :D

        ^^ This leads to :
        Developp a free sign-on protocol
        Use user@domain, so everybody can own it's informations (don't know if I expressed myself well enough)

        • Re:No. (Score:3, Informative)

          by ClubStew ( 113954 )
          A Microsoft Passport doesn't have to be from hotmail.com or msn.com or even passport.com. Hotmail and MSN email addresses are automatically Microsoft Passports, but you can register any email with www.passport.com [passport.com].

      • A passport alternative. (Score:1, Informative)

        by Anonymous Coward
        Here is a research project (here [cornell.edu]) that is building a replacement for Passport. The main idea, as I understand it, is to use multiple authenticators in different administration domains (unlike Passport controlled by a single entity, namely MS) to authenticate a user, and then use threshold crypto to combine the result into a single authentication token.
    • Yeah, and beside that, screw all this browser war junk. I don't give a crap which different browsers and methods there are - web languages are the most versatile of all because everyone's free to make their own browser innovations and design pages for whatever they want.

      I'm a web designer and even though dealing with multiple browsers complicates the code, it's the entire reason the web has so many options and capabilities today.

      And yeah, this isn't on the subject of Passport, but this frickin' 'everythi

      • Re:No. (Score:3, Interesting)

        by SpaceLifeForm ( 228190 )
        Well, maybe the 'browser war junk' as you put it still exists because *you* indirectly support it by 'dealing with multiple bwowsers'. Instead, why don't *you* just design your webpages to W3C standards and be done with it?

        • Re:No. (Score:2)

          by jc42 ( 318812 )
          Instead, why don't *you* just design your webpages to W3C standards and be done with it?

          Uh, which W3C standard(s) should I follow?

          Have you seen how many standards they've published? Do you honestly think any merely-human brain could even start to hold all that?

          Meanwhile, I'm out here doing' my best. I do feed pages to various online validators quite often. Sometimes I can even make sense of what they tell me, and I fix the problems. Sometimes I'm just baffled at what they want me to do. But in thos

          • Uh, which W3C standard(s) should I follow?

            In the spirit of FOSS - to wit, building a working one to back up your specifications - try this [w3.org]. If 50% of websites got a clean bill of health there, the world would be a better place.

            Sometimes I'm just baffled at what they want me to do.

            The error messages there recently got much better. See if you can spot which explicatory message I contributed to the list. The takeaway message is, don't just whine - fix it.

            They may be a bunch of meeting-bound administrator

        • Well it's a good thing I never expect *too* much intelligent life in /. I'd be terribly disappointed. It's your browser war; you wallow in it. Put simply, if you can't handle possibility and innovation in browsing then you can go ahead and fall behind, restricting yourself to limited capabilities just because you think it'll end this 'browser war' you've come up with.

          Jc pretty much debunks the W3C stuff, so that makes my life easier. I'm in the middle of a project which uses (gasp!) Javascript, CSS and

  • Single Sign In (Score:4, Insightful)

    by dochood ( 614876 ) on Monday July 19, 2004 @08:07AM (#9736777)
    It's called Mac OS X's Keychain.

    • Re:Single Sign In (Score:4, Interesting)

      by TheRaven64 ( 641858 ) on Monday July 19, 2004 @09:06AM (#9737092) Journal
      This may not have been an entirely serious suggestion, but it is a much better idea. I would much rather store passwords locally and trust my own security than trust anyone else's (it may not be more secure, but at least it's my fault if it isn't). The only thing I would like to see a specification for is labelling fields in HTML forms so that they can be auto-completed with information from my vCard. Safari does a good job of guessing at the moment, but it's not perfect.

      • half solution (Score:3, Interesting)

        by DreadSpoon ( 653424 )
        This is only a half-solution, however. It still requires creating separate accounts on each host, doesn't allow you to use computers other than your already configured Mac to access those sites, and doesn't let sites share authentication data. (i.e., site A authenticates you, site B authenticates you, and those two sites want to make sure they're both talking to the same person.)

        There is a big different between actual single sign on and (for lack of a better word) hacks that auto sign on for you.

        • Re:half solution (Score:3, Interesting)

          by drinkypoo ( 153816 )
          It's a short hop between having a keychain stored on one computer, and having a keychain stored in a smart card or iButton which you can carry with you and which is itself protected by strong encryption. It does require you to trust the computer the data is passing through but that is always an issue.

      • Re:Single Sign In (Score:3, Informative)

        by glesga_kiss ( 596639 )
        The only thing I would like to see a specification for is labelling fields in HTML forms so that they can be auto-completed with information from my vCard.

        Been done already, and most big commercial websites support it. It's a tag that goes on text entry fields denoting what they are, say "name", "e-mail", "phone" and so on.

        Programs like Roboform, Google Toolbar and Gator (spit) use these to autofill your forms for you.

        However, this misses the point; these identification are supposed to securely ident

    • There's another single sign-in solution called public key cryptography. I'm a little confused as to what problem passport and liberty alliance are trying to solve that wasn't solved 20 years ago by diffie, hellman, rivest, shamir, and addleman. Perhaps someone can enlighten me. With PK, you can authenticate yourself to anyone without revealing your secret key.

      Is passport/liberty alliance a solution to the public key distribution problem? Is it a hack to support PK-like authentication without requiring

      • PKI only does authentication. Single sign on requires acreditation: what is the user allowed to do or access when they are logged in. Passport and Liberty do acreditation, PKI (on its own) does not.

  • who cares? (Score:5, Insightful)

    by castlec ( 546341 ) <castlec.yahoo@com> on Monday July 19, 2004 @08:10AM (#9736788)
    Who cares what company has the new identification standard? I'd rather keep my multiple passwords than rely on one breach of one system to lose my entire online life. I'd assume most geeks are the same and I've met some pretty paranoid non-geeks out there about having any information on the web. So unless we really believe that the information we need to have to exist in our online world won't be available outside of the authentication standards of a few companies, we have nothing to worry about.

    • Re:who cares? (Score:3, Interesting)

      by sim000 ( 721371 )
      Except it won't be the geeks who have control over this. A single sign-on system is something 99% of the population would welcome. Surprisingly (not?) most people aren't really happy about having to remember dozens of obscure passwords. But a war? Nah. Fight, maybe.

      • Re:who cares? (Score:3, Insightful)

        by sigaar ( 733777 )
        Well I certainly don't want one password for everything, much less a very server which has the names of all the services that I use in. Right now I *can* have the same password for everything I use, and who would know. If someone breaks into my hotmail account, then that's about it, they broke into my hotmail account. They still don't know squat about any other services I might use.

        Let users choose for themselves. But having one password and links to all the services I log into, stored by the company w

        • RTFA (Score:2, Informative)

          by mindfucker ( 778407 )
          This is in not simply a single sign-on system like MS Passport, where only they manager/control your identity. This is just an API for identity and authentication, and the "identity provider" can be anybody such as the company you work for, the government, or a third party identification service like Thawte.
          • I was talking about Passport. But the same applies, just on a different scale. Having only one password to different services, and having the password stored in or changed from one place is a security hazard as far as I'm concerned.

            To use a simple anology, I have two bank accounts and a credit card. I have different pin numbers for each card. If I lose my wallet, and say I don't realise this for a couple of hours, someone might somehow figure out my pin and access one account. But he'll have to figur
    • Comment removed based on user account deletion

    • Re:who cares? (Score:5, Informative)

      by cmj ( 34859 ) on Monday July 19, 2004 @08:38AM (#9736920)
      One of the points of the Liberty Alliance is that you, the end user choose whether to Federate your accounts or not, and you get to choose to break that Federation. Take a spin through the backgrounder paper [projectliberty.org] on Liberty - there's a lot of tech, but there's also quite a bit of thinking about privacy and security there.
      • Yes, Liberty has done some great thinking about privacy and security, but it's still a hub-and-spoke system in which they (the 150 rich and powerful members) own your identity and (in their parlance) "provide" you with access to it through an "Identity-Provider".

        Still, it's a lot better than Microsoft, where the only good thing to say about Passport is you know that the database won't get bought by Microsoft.

        There are other personal identity platforms coming in the open source/grassroots arena. One

  • Sign-on War (Score:5, Insightful)

    by bheer ( 633842 ) <rbheer&gmail,com> on Monday July 19, 2004 @08:12AM (#9736798)
    I'll believe there's a "sign-on war" the day Ebay locks people out for not having a passport/liberty alliance account. (Currently they support Passport+their own system.)

    Honestly, site-specific sign-on systems are easy to develop and most e-tailers have a powerful motive to offer their customers as many choices as possible. This is stark contrast to the one-or-the-other image a "war" connotes.
    • What's the incentive for ebay (or anyone else) to do that?

      • Re:Sign-on War (Score:3, Insightful)

        by iMMersE ( 226214 )
        To get as many people using their system? I, for one, am often put off when having to fill in a form to gain access to some area of a site. If I just just sign in using some shared system, I would use more of these sites.
        • That's an incentive to offer one or both of these as *options*. I'm asking where the incentive is to make one or both of these *compulsory*. Big difference!
          • Yes, sorry, I misunderstood you. You are right, there are no incentives for any site to limit their users to using one single sign-in system.

            Also, if you did, your site wouldn't be much good if the third party was down for whatever reason.

            As an aside though, thinking about the children for once, it would give the script kiddies a really good target for their DDOS of the month.

  • Patent (Score:3, Interesting)

    by millahtime ( 710421 ) on Monday July 19, 2004 @08:12AM (#9736800) Homepage Journal
    Does Microsoft have a patent on this kind of single signon? It sure wouldn't suprise me if they have one or one in the works.

  • How universal can it be? (Score:5, Insightful)

    by frostman ( 302143 ) * on Monday July 19, 2004 @08:12AM (#9736802) Homepage Journal
    How universal can any kind of "identity system" be before it gets scary and/or illegal? (Illegal in countries with data protection laws anyway.)

    Nokia is on board [nokia.com] with this, and as more and more of my personal information gets concentrated on my phone I'll probably end up using it.

    Eventually we'll probably all have a digital "passport" of some kind - and much better this way than the Microsoft way - but it's still a bit creepy.

    • How universal can any kind of "identity system" be before it gets scary and/or illegal? (Illegal in countries with data protection laws anyway.)

      The Data Protection issue (I'm in the UK, we have these laws) can easilly be worked around. All they need is your consent to share the data, all it would take is some text stating that by logging in to a new companies site, you consent to sharing your details. Which is why you are logging-in in the first place.

      The Data Protection stuff is going to be a big failu

    • How universal can any kind of "identity system" be before it gets scary and/or illegal? (Illegal in countries with data protection laws anyway.)

      In theory at least, it is the end user who chooses to 'federate' her different accounts so she has to log just into one of them.

      Now that you mention Nokia, this issue is really hot in the mobile world, where the mobile network operator would play the role of Identity Provider, allowing Single-Sign-On to a number of mobile websites or even subscription data serv

  • Microsoft or Sun? No... (Score:5, Insightful)

    by Glock27 ( 446276 ) on Monday July 19, 2004 @08:13AM (#9736804)
    is the identity standard of the world going to be Microsoft, or Sun?

    With, as you point out, over 150 member companies the Liberty Alliance is scarcely just "Sun".

    • Point taken. It is Sun people doing much of the work, though, and is largely built around the Java language, which is Sun controlled. But you are right, it is The Man versus The People, I suppose.

      S

      • Re:Microsoft or Sun? No... (Score:2, Informative)

        by raul ( 829 )
        The Liberty Specification does not dicatate any Language implementation. It is just a extension of SAML [oasis-open.org] that is just a XML schema above SOAP with some XML-SEC message security. Nothing more fancy. I think that PingID has a .NET implementation.

        Any one can download the specs and do a client/server implementation just using apache projects. (Xerces, XML-SEC) and some DOM/servlets knowled to implement their
        protocol.

        Any how you can do it in c++/java/.NET or whatever languege you like.

  • They're all terrified of MS' power (Score:5, Interesting)

    by Anonymous Coward on Monday July 19, 2004 @08:13AM (#9736806)
    So they're all finally joining forces.

    Intel is terrified that Longhorn's .NET hardware independent toolset will allow MS to move away from x86 at will and set up their own chip division. MS can't grow their software division much more in a saturated market, but if they use their own chipset (or licence it to a couple of 3rd party suppliers) they can take over all of Intel's current profit.

    Oracle is of course competing against SQL Server.

    All these large IT companies have known for years that MS is going to eat their lunch, but they couldn't work out what to do about it.

    The penny has finally dropped - the only way to combat MS is for them all to work together using common standards : hence, their support for Linux, the Liberty Alliance, J2EE and so on.
    • Intel isn't just paranoid. Rumors have it that the Xbox2 will usee powerpc cpu's instead of intel or even AMD

    • Re:They're all terrified of MS' power (Score:5, Interesting)

      by TheRaven64 ( 641858 ) on Monday July 19, 2004 @09:10AM (#9737117) Journal
      Actually, I think Intel is more keen to ditch x86 than MS. They tried to with the i860. They are trying with the IA64. I recall a few months ago an Intel representative stating that they thought x86 only had a couple of generations left. Unfortunately, they can't jump ship if AMD doesn't. Hopefully Longhorn will ship for several CPU architectures (as NT did), and will include something based on VirtualPC for running legacy x86 code.

      Note that the only non-x86 architecture properly supported by Windows at the moment is IA64.

    • MS can't grow their software division much more in a saturated market, but if they use their own chipset (or licence it to a couple of 3rd party suppliers) they can take over all of Intel's current profit.

      Mind you, it's not so easy to design a new chip with a performance comparable to Intels' recent x86 processors (or AMDs', for that matter). It would take a few years at least, and that is with buying some technology from others.
      No, I think the only thing that might happen is a MS system based on Powe

  • A pretty good standard (Score:5, Interesting)

    by Cyberax ( 705495 ) on Monday July 19, 2004 @08:13AM (#9736808)
    Liberty is a pretty good standard, it allows federated and distributed authoring instead of Microsoft's "only we know who you are" approach.

    It's a shame that everything this alliance has produced up to date is just a pile of PDF specifications. Hope it will change soon.
    • You mean like these [projectliberty.org]?

      [Ironically, the page has "last week's name" for Sun's product, Access Manager [sun.com]. Even groups that Sun founds can't keep up with the continual name changes!]

      My big beef with it is the lack of perl and PHP defined APIs. Given the amount of LAMP (along with perl) being used on the web these days, it seems extremely short-sighted not have them defined. Just think, /. and the rest of the OSDN sites could be using Liberty to cross-authenticate rather than requiring each site to do their

  • Single Sign-On (Score:5, Informative)

    by storem ( 117912 ) on Monday July 19, 2004 @08:15AM (#9736812) Homepage
    Be sure that this will be the next big war. But it will most certainly not be fought in the open field. My guess is that this will mostly influence companies as they move more and more to single sign-on solutions.

    Article from Internet News [internetnews.com]

    June 30, 2004
    Single Sign-On Gains Liberty Support
    By Clint Boulton

    Although a lack of interoperability has threatened to hold Web services adoption back, Liberty Alliance, a group dedicated to forging an open identity standard, cracked that barrier by certifying nine single sign-in products this week.

    The group awarded Ericsson, Hewlett-Packard, IBM, Netegrity, Novell, Oracle, Ping Identity, Sun, and Trustgenix its "Liberty Alliance Interoperable" mark in a conformance test.

    The certification, which covers Liberty Alliance Identity Federation Framework (ID-FF) version 1.1 and 1.2 for single sign-on services, involves a rigorous testing process that gauges identity federation, authentication, session management and privacy protection. Vendors must demonstrate interoperability with two other randomly selected participants.

    Secure single sign-on services are a key ingredient for Web services, a high-flying concept for distributed computing that allows applications to talk to one another to perform tasks. But customers are afraid to "sign-on" without a secure brand, because crackers can swipe their personal information if the site is not safeguarded properly.

    According to a Liberty statement, the products are interoperable out-of-the-box, which pares deployment schedules and saves costs. This is key, as customers are loathe to license technology if it isn't supported by a validated standard, according to Gartner analyst Ray Wagner.

    Customers who are thinking about federation projects need some reassurance that there won't be a huge amount of manual integration necessary between partners with different infrastructures," Wagner told internetnews.com. "Requiring compliance with Liberty, SAML, WS-Federation, and WS-I Basic Security Profile, or a subset of the above, will provide some assurance that systems have the capability to work together."

    Wagner said he believes most vendors who make identity management products will provide compatibility with specs or standards in the short term, noting that Federation protocols in particular (SAML, Liberty, WS-Federation) will likely converge in the medium term.

    With Liberty's certification, companies can say that their products are compliant with the Liberty identity standard, making their identity management software more appealing to customers looking to shore up their Web services platforms with authentication via single sign-on services.

    Forrester analyst Randy Heffner said using Identity Web Services Framework (ID-WSF) requires Liberty's ID-FF and offers an interoperable path to Web services as long as users start with Liberty's ID-FF.

    "There is a test suite to ensure broad testing coverage of the technical interfaces," Heffner told internetnews.com. "But successful operation of the tests is sort of on the honor system -- except that a vendor who wants the Liberty logo must participate in an interoperability event and successfully connect with a couple of other randomly chosen products."

    "This is better than a simple, pre-planned interoperability event, which only proves that there is 'at least one' configuration by which products can work together -- but not that this is the configuration that any given user might need," Heffner concluded.

    Web services have been slow to take off over the last few years, due to obstacles such as interoperability, security and manageability. But this is changing, owing in part to the steady work companies have been putting into the matter and the increasing acceptance of the more broad service-oriented architecture approach to software services.

    The following products are now Liberty compliant: the Ericsson User S

  • What Standard? (Score:4, Interesting)

    by jackb_guppy ( 204733 ) on Monday July 19, 2004 @08:17AM (#9736819)
    There a can be no indentity standard, because there can be no indentity.

    IPs can be spoofed, mail foraged, add to that proxies and firewall... There is no way of telling who is really on either end of the connection. Now, add single signon security, without forced timeout of passwords and without heavy forced editing preventing reuse and dictonary attacks.

    Look to windowsupdate.microsoft.com. Are you connecting to truly to microsoft? No, you are not. So you are taking a SECURITY download from a site, that may have an associtation with MS but not MS itself. Boy are we trusting.

    So where does that leave the rest?

    • Re:What Standard? (Score:4, Funny)

      by Tim C ( 15259 ) on Monday July 19, 2004 @08:23AM (#9736843)
      mail foraged

      Yeah, I hate it when people forage through my email - it's bad enough that my girlfriend goes through my phone sometimes, but my email? No way!
    • -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have a GNUPG key. Now, that only means that all messages signed by that key are from the same person, but if combined with a credit check, or some other such thing (SSN for example) it can be quite secure. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) - WinPT 0.7.96rc1 iD8DBQFA++UyB31qu1vt9NcRAthUAJ922zl1pfQFnXTqBLpjJY EwyK/SYwCfdI17 MQYZ+U8aU6/9BJr9bnG+qU8= =J0tc -----END PGP SIGNATURE-----

    • There a can be no indentity standard, because there can be no indentity.

      Maybe you are trolling or maybe you are just pandering to the tin-foil hat crowd who would love to believe that they can be without identity.

      You seem to be forgetting public key cryptogrpahy. And the forced timeout is not an issue. A SAML assertion says when the user was authenticated and when the assertion itself was created. True it may not be forced timeout, but every site that I visit that has important personal info of mine has

      • public key crypo is only as good as the guy that signed your key.

        This is same problem with Notary Public. They have to follow standards and so on... but what happens when one is "bad" and others use them?

        What about a doctor or the guy that fixes your car?

        In each and every case a form of trust is required that I claim I am who I say I am. And the other end does them same.

        But with faceless techinology, it is impossible to realy besure.

        EBay has tried one method - called feedback. With it other faceless

  • I think claiming (Score:4, Funny)

    by Anonymous Coward on Monday July 19, 2004 @08:18AM (#9736824)
    that something is the 'new browser war' is the new black.

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Monday July 19, 2004 @08:19AM (#9736828)
    Comment removed based on user account deletion
  • Both Microsoft and Sun to make equally useless products that nobody really wants to use... for now.

  • This would be like fighting over... (Score:3, Funny)

    by Anonymous Coward on Monday July 19, 2004 @08:29AM (#9736876)
    ...who gets to give you herpes.

  • Summary is misleading (Score:4, Insightful)

    by CdBee ( 742846 ) on Monday July 19, 2004 @08:29AM (#9736880)
    The big IM providers are NOT joining forces, they're just making a tidy sum providing Microsoft with a way of routing messages between networks. IM convergence would mean being able to send a message to a user on another network directly, that still is not on the cards.

    I'm just waiting for Google to offer a Messenger service, using a gMail account as a login. I think they could bring great things to the IM market, especially if the based an offering on an OSS project like Jabber, for which other IM software providers could then incorporate support.

    Passport is already tied closely to Messenger and Windows XP in particular, I don't see the opposition gaining ground without going the same way.

    • Re:Summary is misleading (Score:4, Insightful)

      by sempf ( 214908 ) on Monday July 19, 2004 @09:01AM (#9737065) Homepage Journal
      ... IM providers are NOT joining forces ... IM convergence would mean ...

      Note that I did NOT say IM convergence. I DID say they are joining forces. They are. Despite all of the vitrol, reality has forced them to hold hands and play nice. I'm sure the ability to send a message from one platform to another using a common P2P platform is not far off, despite your claims.

      How exactly is Google making a gMail messenger any different from MSN mesenger, or Yahoo messenger? All great brands, all good technology. Will it be better because you like Google more? Don't get me wrong, I like Google too, but how will a fourth standard make it any better?

      • How about an IM proxy service? Something where you type "NETWORK:ID" and it starts a conversation into that network, through the proxy server. The proxy is connected to all networks, and would display your username after it's. So, as an example conversation:

        MSN:Fred Hi Fred!
        >IMProxy George: Hi Fred!
        AIM:George Hi George.
        >IMProxy Fred: Hi George.

        Basically so that you don't have to sign up for everything, someone else does the work. Sort of like BugMeNot. GAIM does this well for a single user, I'm thin

  • Liberty Alliance is not the same as Passport (Score:5, Informative)

    by Anonymous Coward on Monday July 19, 2004 @08:32AM (#9736893)

    The Liberty Alliance is not a single signon like Passport. It doesn't put all your data in the hands on one organisation. It basically allows you to link logins and share data between them.

    It's a tricky concept to grasp but I've found these two introductions helpful:

  • Neither? (Score:4, Insightful)

    by blanks ( 108019 ) on Monday July 19, 2004 @08:39AM (#9736923) Homepage Journal
    How about I just keep my identity and NOT have any single company owning my personal data? Yes convince is what America is all about, but there are still many steps needed to be taken in the real world to prove your identity, why do we need one system that everything will be required to use (think about the future). With something like this, I can see something bad happening. The US government (world government too) has been trying to remove the ability to be anonymous on the internet, with a system like this INFORCED at many different levels, the ability to be anonymous would no longer exist, the moment you connect your pc to the internet (LAN?) you would be authenticated.

    • Re:Neither? (Score:3, Insightful)

      by iso ( 87585 )
      How about I just keep my identity and NOT have any single company owning my personal data?

      That's what the Liberty Alliance is. It's a way to share authentication info without one company controlling it all. RTFA.
    • convince is what America is all about?

      What the hell are you on about.

      And it's Enforced, not inforced.

      And if you've got an IP address, then you're not exactly anonymous anyway.
    • You should have started this fight back in say the 60's. It's a little too late now.
  • Does anyone know what dotGNU proposes to do?

    From their website it seems that they are making some kind of decentralized "passport". Is The Liberty Alliance also pushing a decentralized solution?
  • Microsoft or Sun, we need more choices, like a different single sign on system for everything we log into. Oh, wait, we already have that. Now what where we trying to fix again?

    • Re:Why stop at just two (Score:4, Informative)

      by Samari711 ( 521187 ) on Monday July 19, 2004 @10:54AM (#9737881)
      actually despite what the person who posted this article implies, LA is not a monolithic sign on like Passport. LA basically provides a protocol for a person's identity to be authenticated via a third party and the token from that third party server passed to different sites that trust the third party. The standard does not however stipulate that there can be only one company capable of identity verification, but rather lets sites choose who they trust the information from.
      • actually despite what the person who posted this article implies, LA is not a monolithic sign on like Passport

        Actually it was just a bad attempt to be funny before the morning sugar rush hits my head. But the implication that we can be authenticated via a whole long list of places proves my point a little more rather than less. Mainly that we are simply going to have a long list of places to authenticate to just like we already have, so what did we fix? Or to put it another way, my dad has 6 different
        • part of the standard allows you to pick and choose what information you share with whom. granted you'll still be giving all your information to one identification provider but you get to say what of that information is available to any company you want to link the login to. I'm not sure how to go about giving phony information other than having a bogus account though.
  • I found the logo (and even the name) to be vaguely reminiscent of the Alliance and Leicester bank [alliance-leicester.co.uk]. I wonder if it's just a coincidence?
  • The first link says MS, AOL and Yahoo have joined forces.
    The Liberty Alliance page shows AOL as one of the 15 "Management Board Members".
    Seems AOL is positioning themselves to be a win/win member.
  • I prefer "Coalition of the Willing (TM)."
  • This article and the replies contained therein clearly demonstrate BIg Brothers ability to polarize the American public on who is the best provider of security while keeping the focus off the real issue at hand, the sytematic destruction of your personal privacy. Who cares which one is better! I don't want either! Who really believes you can catch the bad guys by keeping track of the good guys? We have proven that to be false and flawed, over and over, and that that approach simply doesn't work. The ba
  • What will the Microsoft-led coalition be called? Team Advantage? (In a perfect world, Liberty Alliance would be US Alliance. I know.)
  • ..then we could back it unreservedly
  • you download a form, fill it out, and send it back to them. No online verification, and no electronic forms. I give it a thumbs down. Join the 21st century, Liberty Alliance!

    "Warning slippery when sarcastic!"
  • Coming to a Marvel comic book near you soon
  • I want multiple signons, so a single server crack doesn't jeopardize all my info, along with everyone else's. I want a single client that manages all those signons. That security architecture also makes any one crack less profitable - getting all my info isn't nearly as attractive as getting every customer of a big web merchant. The distributed security will reduce the damage, and increase the trust of the infrastructure.
    • That sounds great in theory. Unfortunately the facts are that most of us provide the same information to all the websites and vendors we deal with. Gaining access to any one usually means the theif has access to all your information.

      In the end, I'd rather trust all my information to one of the largest security systems in the world rather than Joe Bob's Tackle Supply.
      • If people used a simple login manager at their client end, we could be even lazier than when we use the same password for many servers. And the actual crack cost:benefit analysis is much worse for each person than for the attractive servers full of many people's information. I'd prefer to get my own client from a reputable source, and many people would like to get theirs from their bank, for example. Joe Bob can resell any certified (and insured) login manager client he likes.

  • Cross-site scripting (Score:3, Interesting)

    by ngunton ( 460215 ) on Monday July 19, 2004 @12:40PM (#9738972) Homepage
    It seems like there is a major problem with cross-site scripting that is very hard to fix in all cases. For example, here's one [securityfocus.com] related to Passport. The point is that css is hard to fix because you can't guarantee that another website that uses the same single signon system won't be vulnerable. So if there is a single signon system, then it seems to me that it's all only as secure as the most insecure website in the network.
  • Last I heard, Sun sold their soul to M$ for about $2 billion.

  • Identity Commons (Score:2, Informative)

    by spot ( 3593 )
    The Identity Commons [identitycommons.net] is also working on the same problem, but they have taken a more useful approach than the Liberty Alliance.

Slashdot Top Deals

Love may laugh at locksmiths, but he has a profound respect for money bags. -- Sidney Paternoster, "The Folly of the Wise"

Close