|
Be on the wave or under it™
The News – 08/21/01
May I See Your Passport,
Please?
Regular readers know I am not a fan
of Microsoft’s monopoly tactics, although I am a fan of some of their
software, and certainly appreciative of their leadership in creating the desktop
revolution. But even died-in-the-wool Microsofties should be concerned
about Microsoft’s Passport service and the company’s plans to make it
ubiquitous.
The idea behind Passport is simple.
It’s the idea behind a lot of Microsoft’s software, and it’s at the root of
most of Microsoft’s security problems: Convenience. If you’re like me, you’ve
created accounts at all sorts of Web sites. There are email accounts, discussion
groups, white paper download registrations, eCommerce accounts – you name
it. If you’re like most people, you have a problem remembering passwords.
In fact, you may use names of family members or pets as your passwords
(which is a really bad idea). Chances are, very few of your
passwords are secure, meaning a cracker could guess them or use software to
discover them quite easily. You may even use the same password for all your
accounts (also a really bad idea; for more information on creating secure
passwords, check this
out).
Microsoft, to their credit, have
offered to solve this problem with Passport. But there are some very
disturbing aspects to the service. Basically, when you create a Passport
account, which you must do, for example, to use MSN Messenger, HotMail, or
Microsoft Support, you store lots of personal information on Microsoft’s
servers. Already I have a problem with this. We trust all kinds of companies
with intimate details of our lives and selves. MasterCard knows a lot about
my purchasing habits. ATT knows a lot about my calling habits. Northwest
Airlines knows a lot about my traveling habits. Having this sort of
information in the hands of commercial interests is a necessary evil. Where
the problem comes in is when this information is combined. For example,
suppose thieves could access my electric bill, my Northwest account, and my
MasterCard account. They could tell when I’m on vacation and come and steal
the new TV I just bought. (Notice to thieves: This is a hypothetical
scenario; I’m waiting for the HDTVs to come down in price before buying
another.)
Using Passport, Microsoft becomes
aware of a lot of your personal information as well as a lot of your
behavior. The way the service works is, when you visit a site that uses
Passport, Microsoft forwards your credentials to that site, and obviously
knows what site it is. So if I have a yen for Japanese porno sites, Microsoft
knows. If I purchase Viagra online, Microsoft knows. In fact, anything I do
online, Microsoft knows. It’s a marketer’s dream, and a law enforcement
dream. That’s problem number 1.
Another problem involves
the way Passport actually works. There are two main concerning areas:
·
First, Passport is being built in to
Windows XP, Microsoft’s next operating system. Thus XP users will use the
same password to log in to their system each morning as they use with the
Passport system. Since people rarely use secure passwords on their personal
systems, this is a problem. Also, if crackers compromise the Passport
password, which is bad, they also have access to your computer, which is
worse.
·
Second, and more important, when you
visit a Web site that uses Passport, a cookie containing your credential is
placed on your hard drive. A cookie is a plain text file that contains
information regarding a Web transaction. Cookies are normally used for
things like identifying you by name when you return to a site, or saving
the status of a transaction so it can be recovered if the connection is
broken. By placing the credential in an insecure, easily readable file on
your computer, you are left wide open to identity theft. It is quite easy
to steal a cookie, and thus quite easy to masquerade as another user.
Finally, Microsoft has a children’s
service called Kids’ Passport which many privacy advocates feel collects
more information than necessary from this vulnerable group.
The issue is complex, and I
encourage you to read the C|Net article linked below and view the video
from the article to get up to speed on some of the issues. Businesses
especially need to be aware of the possible impact of a Microsoft hegemony
on authentication. If their scheme plays out, you may be forced to use them
for all Web site authentication simply because they’ve established yet
another monopoly. Given Microsoft’s dismal security record, that could be a
problem.
C|Net
Briefly Noted
- Shameless Self-Promotion Dept.: My speech at the
Minnesota Entrepreneurs Club pre-meeting workshop on Tuesday, “Will
You Have to Have It? What You Need to Know About Future Tech and Your
Business,” is now available.
Also, my white paper, Taking Control of the B2B Exchange: What's
Next in the Supply Chain Evolution, is now available on Manyworlds and is rated four
stars. I am honored to share the page with eCommerce expert Mohanbir
Sawhney.
- Planet of the Apps: There’s a tremendously funny video you’ll never see on
World’s Funniest Videos but which has caused a bit of a stir in
software circles. It seems Steve Ballmer, excitable head of the World’s
Funniest Monopoly, Microsoft, got a little pumped up at the beginning
of his keynote at a recent internal conference. Many wry commentators
have suggested his antics confirmed the origin of the human species
with the apes. You be the judge.
Jump Jive and
Wail (You’ll need a media player that can
handle MPEG files like, say, Apple’s QuickTime)
- Let Be Be Finale of Seem:You probably never heard of Be, but they created BEOS, a
wonderful operating system, and were run by Jean-Louis Gassée of Apple
fame. I’m not really sure what Palm’s
got in mind here, but the acquisition, for $11 million in stock,
sparked this wonderful quote from US Bancorp Piper Jaffray analyst
William Crawford: “Where they have to go, Be already is.” Is you is or
is you ain't my OS?
C|Net
- Jargon
Watch:This is a bit old, but I’ve just run across a new “C-level”
title that made me laugh. Back in April, troubled
Internet Service Provider (ISP) PSINet, in an effort to show exactly
how serious they were about returning to profitability and surviving
NASDAQ delisting, appointed Lawrence Hyatt, their chief financial
officer, to the newly created position of Chief Restructuring Officer
(CRO). Must not have worked. PSINet filed for Chapter 11 protection in
early June, and then promptly contributed to a major Internet outage
when ISP Cable & Wireless intentionally stopped peering with it.
(Peering is the practice of swapping traffic and is part of what makes
the Internet work.) When C&W quit peering, every PSINet customer
could not longer see sites on C&W networks, and vice versa. Since
smaller ISPs buy connectivity from larger ones like C&W and
PSINet, this affected whole sections of the country. Nice
restructuring, guys! Hyatt has returned to his old title, CFO.
C|Net
- Nothing To Disclaim At This Time:
The UK site, The Register, which is a bit of a gadfly on the rump of
information technology, ran a contest back in May to find the most
outrageous disclaimers. You know disclaimers: that bunch of rubbish at
the end of a report or a post or an email that intends to absolve the
writer of everything short of being born. I particularly like the
winner of the Longest Disclaimer competition, which was won easily by
investment house UBS Warburg. This 1,081-word nauseous gasser ends
with a declaration that truly reflects the uncertainty and even the
futility of life: “E-mail transmission cannot be guaranteed to be
secure or error-free as information could be intercepted, corrupted,
lost, destroyed, arrive late or incomplete, or contain viruses. The
sender therefore does not accept liability for any errors or omissions
in the contents of this message which arise as a result of e-mail
transmission.” So if we gave you a virus, tough bounce. I think I’ve
lost the will to go on.
The
Register
- Things That Make You Go Hmmmm Dept.:
In April, Sony released a version of Linux for its PlayStation 2
console. What can they be thinking? PS2 already plays DVDs. Hmmmm.
Could it be the uber-consumer-device a-borning? Thanks to Alert SNS
Reader Todd Mortenson for the pointer.
DI
Wire
Can’t Get Enough of ME?
In the unlikely event
that you want more of my opinions, I’ve started a Weblog. It’s the
fashionable thing for pundits to do, and I’m doing it too. A Weblog is a
datestamped collection of somewhat random thoughts and ideas assembled on a
Web page. If you’d like to subject the world to your thoughts, as I do, you
can create your own Weblog. You need to have a Web site that allows you FTP
access, and the free software from www.blogger.com.
This allows you to right click on a Web page and append your pithy thoughts
to your Weblog.
I’ve dubbed my Weblog entries
“Stratlets”, and they are available at www.stratvantage.com/stratlets/.
Let me know what you think. Also check out the TrendSpot for ranking of
the latest emerging trends.
Return
to Mike’s Take
|
.