eBay Retires MS Passport Sign-In 304
fihzy writes "eBay have announced they will retire Microsoft Passport Sign-In and .NET alerts. The Microsoft Passport Directory of Sites has been discontinued, too. Is Microsoft's Single Sign-On vision edging towards oblivion?"
well (Score:2, Insightful)
Re:well (Score:5, Interesting)
Re:well (Score:2, Interesting)
Re:well (Score:3, Interesting)
you wouldn't like to look/be responsible for a system you don't have the keys to, it's quite hard to fix things that you can't access even.
I actually used it (Score:5, Interesting)
Eventually, I got a new login and walked away from one with 20 favourable reviews on it thanks to that damned system. Hope it fries in hell.
Re:I actually used it (Score:5, Interesting)
On top of that I used their hotmail account to register for the Passport, since that's their recommended option. I never use Hotmail for my daily webmail, in fact, the only message I have there is a thank-you for signing up. The bozos from hotmail kept threatening me with turning off the account, and they did execute their threats every 90 days. So unless I remember to log in to the Hotmail account, which I never use, I lose my passport, and have to go through easy but still frustrating retrival system at hotmail.
The guys who designed this system are probably competing with Clippy team on who builds the most annoying product.
Re:I actually used it (Score:2, Insightful)
Re:well (Score:3, Insightful)
Re:well (Score:2, Informative)
<a href="http://www.yourlinkhere.com">Your text here</a>
Re:well (Score:2)
In Other shocking news... (Score:2, Funny)
Edging into oblivion? (Score:5, Funny)
Re:Edging into oblivion? (Score:5, Insightful)
Re:Edging into oblivion? (Score:2)
Re:Edging into oblivion? (Score:2, Funny)
Re:Edging into oblivion? (Score:5, Interesting)
The worst thing about Passport and the related
In retrospect, Microsoft made a bunch of mistakes:
1) The whole thing got muddled in the general confusion of
2) Most other web companies actually valued control of their user data more than ease of development.
3) No user demand for single sign-on, either because users don't care, or because they actually value their privacy and don't want different websites to share user data.
It's finally gone. Good riddance.
Re:Edging into oblivion? (Score:2)
Good idea with major control issues (Score:3, Insightful)
It's been dead for a while, people are still cleaning up the carcus.
Microsoft Bob redux. (Score:3, Funny)
Good idea, bad implementation (Score:5, Insightful)
As a Webmkaster, I would like to have some simple authentication solution, so that the users dont have to register in forums and what not to post. However, the implementation is just unacceptable:
Small sites who would benefit frim such service don't have $10,000 to throw around, and large sites, which do have the money, just will write their own username+password code.
Re:Good idea, bad implementation (Score:3, Insightful)
Bad idea, implementation irrelevant. (Score:5, Insightful)
Bad idea, implementation irrelevant.
Instead of having to compromise each site (presumably on a semi-secure server), have just one single entity provide and verify the virutal avatar... based on data resident on a machine administered so incompetently as to have six types of spyware and four spammer worms on it because the underlying operating system is as secure as swiss cheese.
> Small sites who would benefit frim such service don't have $10,000 to throw around, and large sites, which do have the money, just will write their own username+password code.
I've lucky in that got a good "mind" for (secure!) passwords and have no trouble remembering dozens of them.
But even if I didnt... even if I wrote all my userid/password combinations on Post-It notes, a Post-It note resides in an area with reasonably secure physical access controls. Not so with a network-connected PC and a single-signon application.
Re:Bad idea, implementation irrelevant. (Score:4, Interesting)
That is what I call bad implementation, if done right this whole thing would have worked via smartcards. Have a key stored on that card and encrypt the login information on the card itself, don't store any information on the computer itself. Would have even allowed to move to another computer and login there without risking to get the password spyed away. Good smartcard are ever protected by a pin which you can enter on the card itself, so you don't even need an extra numpad. On the server side all that would be needed would be some standard protocoll to comminucate with the client/smartcard.
Downside is of course that such smartcard reader would have cost a little bit of money, but given that now basically every PC comes with Flash-, SD-, XD- and whatever they are called slots, such a reader shouldn't have ben all that expensive, especially if Microsoft would have backed it up with a little 'force'.
Sadly all dreams, and we are stuck for the coming years with passwords and password managers which basically store everything in almost plain-text on the client...
Re:Bad idea, implementation irrelevant. (Score:3, Insightful)
This would have worked for about 30 minutes before someone would have modified a worm to spy on the smartcard-reading-process.
Re:Bad idea, implementation irrelevant. (Score:3, Insightful)
Password managers are a pretty ideal solution. People tend to have a super-secret password for their bank account and crap passwords for noisy boards. My browser does a good job at storing them.
This is a solution looking for a problem more than anything.
Re:Bad idea, implementation irrelevant. (Score:2)
What the parent poster was refering to was IMHO that MS Passport stored all information to log into passport on the client, so it ended up being no better than all those password-man
Re:Bad idea, implementation irrelevant. (Score:3, Funny)
Can you provide a link to a story about this?
Re:Bad idea, implementation irrelevant. (Score:2)
Re:Bad idea, implementation irrelevant. (Score:2, Interesting)
Now, it's true that Windows is not exactly the most secure system. Indeed, in recent security tests, it was passed by an unlocked door, and a large neon sign displaying the sensitive data.
On the other hand, this is definitely the problem with the OS, and not the idea. If you run Kerberos on OpenBSD or a reasonably
Re:Bad idea, implementation irrelevant. (Score:2)
I'd prefer a system that is capable of a moderate to high degree of flexibility, as you can't decrypt something if you don't know the encryption algorithm used.
Your serious? This is not 1850... Encryption is based on keeping the key secret (or one of the keys secret with PKI). The algorithms should be well known, understood, and studdied by others in the field.
It is unlikely that you would come up with a truly unique and fresh algorithm. You might have independently discovered it, but it has quite possi
Re:Bad idea, implementation irrelevant. (Score:2)
Some of the ideas in this system were bad, but auth aggregation is an incredibly useful idea already in widespread use. There are two ways I can think of that this idea could be usefully designed with a fair number of fairly minor variations.
The real problem I see at this point is that of existing auth protocols RADIUS has already been extended beyond what it can do, diameter has turned into typical standards body masturbation that is so complex that complete workin
leave swiss cheese alone (Score:2)
so you really cant compare that to windows
Re:Bad idea, implementation irrelevant. (Score:2)
> Bad idea, implementation irrelevant.
So I guess you hide your money in your bed too?
lol $10,000. a ROFLMAO Year? (Score:4, Interesting)
What they were asking is like holding the door open for someone then asking for a hundred spot.
Passport not only had security flaws, but would be the biggest target ever imagined for phishing scams. Its funny too because the passport URL was so long that you didn't even see the www.microsoft part. You could have sent them to any site to login, and just kept their login and passport.
Microsoft failures are great for jokes.
Hmm... GoogleLogins anyone? (Score:3, Insightful)
Anyway, the idea of a simple username+passport system for the 99% of websites where we care about security "a little" does exist. I think Passport was overengineered. I suspect that a most people will NEVER trust their bank passwords to the same system that holds their Slashdot passwords. Without that
Re:Good idea, bad implementation (Score:2)
That and I have 3 levels of passwords, which these single identity sites don't handle well. One for nonsecure, who cares info. two random alphanumerics for
Re:Good idea, bad implementation (Score:3, Informative)
If was [sic] really important it would allow me...to change my password.
In its infinite wisdom, Microsoft did make it possible to change your password. Here's how:
nope (Score:3, Insightful)
or perhaps I am suffering from wearing a tinfoil hat too much... but I think I might be on to something... replace passport with something directly tied to windows that users have no choice in, since their machines have unique ID's, as do their accounts... they will not be able to be anonymous on the web, and said info will be used to make browsing easier for average joe q. public, meanwhile identifying every user out on the web... really sneaky...
Re:nope (Score:3, Funny)
Insightful? Give me a break.
Yeah, I'm sure that eBay and Amazon want to make sure they limit all of their customer base to only those people running a brand new OS. Sure.
And in case you didn't realize, the system you are describing is already built into Windows XP. It's name? Microsoft Passport. You can tie your Windows account directly into your Passport account so you don't have to login. Look how well that's worked.
Please, try to learn a little more about what you are talking about before ma
Re:nope (Score:5, Interesting)
The only system I know of that fits the bill is the nascent Identity Commons [identitycommons.net] system that is just starting to come online [2idi.com]. (Disclaimer: I am 2idi's CTO)
Re:nope (Score:3, Insightful)
Even if they did push for something like that do you really expect MS to follow their own standards?
Re:nope (Score:2)
Who thought Microsoft would ever dominate the browser market when the first version of IE was released? I guess we all laughed. Then the newer versions became slightly better and since it was more convenient to use IE than Netscape (because IE came with the OS) everybody switched.
Why shouldn't it work this time? And
Re:nope (Score:2, Insightful)
That was actually EXACTLY the goals of Windows XP, it's integration with the
Yahoo's going strong (Score:4, Interesting)
Re:Yahoo's going strong (Score:5, Insightful)
Yahoo's failing: (Score:2)
Re:Yahoo's going strong (Score:2)
This just tells me that single sign-ons are just a bad idea. Maybe you should at least have two different identities associated to an account, so if one fails you can use the other?
LOL (Score:4, Funny)
Is the only paid use going away? (Score:2, Interesting)
Those are currently being transfered to the developers in-house system.
In a couple months that use will be gone too.
What does that leaving using it? Hotmail?
I never even linked my ebay to one of my
Nice idea but only handy if it filled out everything for you on lots of sites, which i dont think i'd like the idea of anyway.
Re:Is the only paid use going away? (Score:2)
Re:Is the only paid use going away? (Score:2)
No one trusted Microsoft on this (Score:4, Interesting)
When it arrives, single sign-on is going to have to come with some bill of rights for users...I don't see MS providing any level of transparency.
A Directory Page revision for MS... (Score:5, Funny)
The .NET Passport service offers streamlined sign-in at a wide range of Web sites and services that are soley owned by Microsoft.
We have discontinued our Site Directory because nobody really trusts us and few people really care, but you'll know when you can use your Passport to make sign-in easier and the marketing data more easily collected. Just look for the .NET Passport Sign In button! We have one at least. You can use the Passport account you created to get us to stop bothering you about it after your Windows or Microsoft Office install process. One day, the powerful Passport login will give you exclusive access to Security Patches, Updates and Service Packs.
Why not get used to it now?
Wait a second... (Score:3, Funny)
Re:Wait a second... (Score:2)
Passport.com (Score:2)
It never was. (Score:5, Informative)
As usual, Microsoft paid as little attention to their proposed standard systems as the rest of the industry. (Remember, Windows Notepad didn't get the Ctrl-O and Ctrl-S shortcuts until Windows 2000, even though other MS programs had them in Windows 3.x.)
I noticed this also (Score:2)
I have a Passport account for the Microsoft Newsgroups and for my MSDN Universal subscription. I would constantly have to relogin to these sites whenever I opened the browser, even if I had already logged in to the other site. It was like a Single-Sign On system with multiple sign ons.
Re:It never was. (Score:2)
Lo and behold, my secondary email address already had an account associated with it, but I use that for MSN Groups, which is personal, not work related. I had to create another email account to get a MS Passport, so that i could use their Microsoft's IM... (I couldn't use the work account for a couple
Re:It never was. (Score:2)
Two existing accounts need a third account to link them. "Single signon" becomes a bit of a misnomer....
Incidentally, Bungie.net should allow you to sign in with your Gamertag alone. It seems that the Player Stats URL doesn't require a Bungie.net account, but they don't tell you that. There should be no need for me to create two additional accounts in order to acc
Only Microsoft stuff is widely used (Score:3, Insightful)
(Xbox Live's case is a little more complicated, but it does use Passport at its core.)
Melissa
about bloody time (Score:2, Informative)
Just goes to show... (Score:4, Insightful)
Too many people (especially pundits) see such a list and take it as irrefutable evidence that the thing in question is destined to take over the industry.
Hubris, thy name is Microsoft (Score:5, Insightful)
1) with their record of bad faith toward their own customers and their ongoing security lapses, most knowledgeable end users would not trust Microsoft to manage their personal information, and
2) with their record of bad faith toward their own business partners and their ongoing security lapses, online retailers wouldn't relish the extra burden of sending a monthly tithe to Microsoft.
Luckily Microsoft makes bazillions off Windows and Office and can throw a couple billion here and there on various schemes--gaming, set top boxes, what have you. They know as well as anyone that the commoditization of operating systems and productivity software is underway and they won't be able to maintain their margins forever. If they don't find a cash cow soon they'll be forced to (horrors!) make less money.
Re:Hubris, thy name is Microsoft (Score:2)
Re:Hubris, thy name is Microsoft (Score:2)
There was a woman who was head of Sony's game division in America that was being interviewed about the Xbox and how it was third behind Gamecube and PS2 in terms of unit slaes and game sales and they asked her how she thought Microsoft was going to respond to losing so much money on it.
Basically she said something to the effect that Microsoft wa
It never worked anyways, and eBay didn't care. (Score:3, Interesting)
I tried to use it multiple times. I'd be logged into MSN, MSN Messenger, reading hotmail, and in some new window (using IE, even) I'd try to log into eBay and, nope, same page, repeatedly, asking for the username and password.
I'd have liked for it to work, but I don't think anyone at eBay ever actually cared whether it worked.
Some don't want a hotmail-account (Score:4, Informative)
The fact is that you can use your regular email with Passport, but I think alot of people believe these two services to be the same.
Maybe MS just need to relaunch the service. When it was created, Joe Average didn't have a gazillion different passwords. Things have changed since then.
Re:Some don't want a hotmail-account (Score:2)
Re:Some don't want a hotmail-account (Score:2)
One account for EVERYTHING... no thanks! (Score:5, Insightful)
It's sometimes irritating to remember a number of different logons/passwords, and maybe I'm just paranoid, but I prefer the compartmentalization that separate logons brings.
Yes, yes it is and here's why (Score:4, Funny)
Is Microsoft's Single Sign-On vision edging towards oblivion?
Yes, the MS single sign on is going away and here's why. Anyone from Redmond reading this, listen up.
Microsoft is not the Internet.
I know, I know it's hard to believe...but it's true. The online community is actually *much larger* than Microsoft's vision for it.
This is why "embrace and extend" (and then make incompatible) keeps failing as a strategy.
Re:Yes, yes it is and here's why (Score:3, Funny)
As for me, I would like a reasonable and optional single signon. Yes, I have a passport because my nephew uses Messenger and they made me get one for that. But I also have a bunch of low-security usernames and passwords. My slashdot ID, for example, is protected with a weak password. Go ahead. Crack it. Ruin my life.
One compromise, multiple 0wnz (Score:4, Funny)
I hope not, I so liked the idea of having one login that if compromised would allow access to multiple sites for multiple micheiveous activities. This is why I used my
Please say it ain't so! How else can I be throroughly humiliated with just one account being cracked?
I already have one account for everything I need! (Score:2)
As if (Score:2, Troll)
I always wonder who those mystery customers are that they listen to? Because
Bad idea anyway. (Score:4, Insightful)
If I did, I would want it to be my computer.
If I didn't want it to be my computer, I wouldn't want it to be on a computer I had to pay for.
And even if I were willing to pay for the inconvience of having someone else be in control of my passwords, I wouldn't want that person to be Microsoft.
Passport was based on a flaw premise;
The reason we don't provide personal information to every site that asks for it isn't because it's too hard to type it in.
-- Should you believe authority without question?
How do I become a .NET Passport Site? (Score:4, Informative)
Re:How do I become a .NET Passport Site? (Score:3, Informative)
I don't think the docs have ever been there - looks to me like they're putting that site together but put it live before they finished it yet. The best link to follow is the Getting started [netservicesmanager.com] link on the passport front page.
The Passport docs have been stal
lets see (Score:2, Funny)
does that sound like a good idea to you???
it would be a really really cold day in hell before i let the likes of a greedy corporation such as M$FT have any of my personal info...
MSDN subscribers required to use Passport (Score:3, Interesting)
I've got a Passport because of my MSDN subscripton, and it's the only reason why I've got Microsoft Instant Messenger running on my system. But, it NEVER WORKS-- IE is supposed to realize you're signed in with your passport, and let you right on through to subscriber downloads, but that never happens. Everytime, I'm forced to sign in, and then hit the "I Agree" button to the MSDN Subscriber Agreement each time, as if I'm signing in for the very first time, every time.
Sure, that might be lazy to not want to be hassled by those few key/mouse clicks, but if you're going to implement a feature and then require your subscribers to use that feature, at least make the feature work. After all, that was supposed to be the reason for Passport integration into XP, right? Just sign into Messenger, and then you'll be recognized at any
I read the title of the article totally wrong (Score:2)
I almost messed in my tighty whiteys!!!
Federated identity more complex but a better idea (Score:2)
They (and the rest of the industry) are headed more towards a federated security world, where you have a myriad of stores with your identity, and realms of trust between servers. So it would enable single sign-on between your bank and other partners they worked with, but not necessarily have the same data that your favorite blogs or what have you would use.
One example of a federated identity system is the Liberty All [projectliberty.org]
Emperor Bill's 19th bid for world rule fails... (Score:3, Funny)
So, what's he going to do next? Build ShortHorn into every telephone?
They are bad (Score:2, Insightful)
Why should Ebay play along? (Score:2)
'Course, say Ebay did dominate this field...would Microsoft play their game?
Bizarre side-effect (Score:3, Funny)
Much of my office communicates using MSN Messenger. I don't like it but never mind... I had never signed up for an account because, with Passport around, I didn't want to provide them with the slightest additional encouragement and blip in their userbase statistics that might help persuade another site to join their unholy alliance. Now that possibility appears thoroughly dead, I can sign up for one in peace and be able to send quick messages to colleagues more efficiently than through e-mail.
Only 200 comments on this article (Score:3, Funny)
Does anyone understand Passport? (Score:4, Interesting)
Once you understand how Passport works and would work in the future, it is so clearly a horrible idea that it is not funny. People often only think of it as a central repository for storing their passwords. Some like this idea for its convenience but the Passport model is so half-baked it is not even funny.
If you want to understand how a truly well-designed system will work, take a look at the Liberty Alliance. Instead of the central repository method, it uses a federated approach to the problem.
For example, if you have a bank account, a utility provider, and your employer, there is no need for those three entities to share all information about you. It should be up to you to define which information is shared, but you should only have to maintain it in one place.
If your employer knows your home address, why not allow this data to be shared automatically to the other entities? Don't want to? Then you don't have to. You employer may know your bank account number to deposit your salary. Your utility provider may know your bank account number to deduct your monthly bill. Why not tell your bank to share this information with your employer and utility provider? If you change your bank, then your new bank will automatically update this information.
Of course all of this has to be done in a secure way. But it is more likely that your bank will have secure connections to other entities than the layer where you inform those entities yourself.
Best of all, the approach from the Liberty Alliance does not leave one vendor with the master key. The keys are still with you, you just might give certain keys to some of your vendors.
Re:Does anyone understand Passport? (Score:3, Interesting)
I did not say that Passport sent passwords to the third party sites. I said that people think of Passport as a central repository for storing their passwords. By implication, I was pointing out that this is incorrect.
Yes, Passport authenticates you by sending a secure token to the third party and the third party trusts Passport.
My point was that the Passport architecture is inherently flawed because it allows an independent source (the Passport system) to authenticate y
Re:FYI (Score:5, Informative)
Re:Partially on topic to MSN / Hotmail (Score:2)
It is a bit of a bitch tho, as you do need to start a new MSN account based off your gmail, you can use it as your
Hope that helps.
Re:Partially on topic to MSN / Hotmail (Score:2)
Bobs your uncle, all that is needed then for your contacts to each individually say 'yes', which really isn't much of an imposition.
Re:Partially on topic to MSN / Hotmail (Score:2)
Re:May I be the first to say... (Score:2)
And i'm only saying good riddance instead of something else because this is a family site
Re:May I be the first to say... (Score:2, Insightful)
Re:Good... (Score:2)
-psy
Re:Oblivion? (Score:2)
I think they should have taken advantage of the recent remake of "Around The World in 80 Days" and released a new version of the service called "Passport Two", in honor of the Jackie Chan's character "Passpartou."
Re:Oblivion? (Score:2)
i'll give you this bit: it was meant for kids under 5 years old
Re:Oblivion? (Score:2)