Text 2061, 476 rader
Skriven 2005-01-18 19:52:02 av Geo (1:379/45)
Kommentar till text 2040 av Rich (1:379/45)
Ärende: Re: Usage history
=========================
From: "Geo" <georger@nls.net>
This is a multi-part message in MIME format.
------=_NextPart_000_00C2_01C4FD97.2DA00F90
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
You know, that's an interesting point. With single signon the sites = don't
have your password so what's more secure, one single login site or = 20
different web sites where each stores your password. Seems to me the = single
signon would be more secure. (this assumes you use the same = password for your
bank and your credit card company site which both = Ellen and I don't)
OTOH, if you don't care about the sites such as the NYT where you only = have a
login so they can track your ass, who cares if it's secure or = not? Personally
I take great satisfaction in sharing the barkto login = for sites like NYT so
that what they end up tracking is a bunch of users = which then messes up their
per user statistics. In a case like that a = single signon feature would be
counter productive.
Geo.
"Rich" <@> wrote in message news:41ecadcb@w3.nls.net...
I believe what you describe is very typical except that most folks =
do not use strong passwords so special characters are not an issue. = This
creates a far greater vulnerability than single sign-on because not = only does
a single password work at many sites, each and every one of = these many sites
knows your password and you are vulnerable not just to = someone stealing your
password from you by some means but also your = password being stolen from any
one of the sites with which you have an = account. With single sign-on, the
individual sites to not have your = password.
Rich
"John Oellrich" <john@oellrich.us> wrote in message =
news:41ec8b51@w3.nls.net...
Ellen,
Can you keep all these usernames and passwords combos memorized? I =
know I couldn't. And a lot of sites I buy from require the username to = be my
e-mail address, so there goes the username option. I just choose = to go with
essentially a single very strong password (have to do some = variations because
many sites will not allow special characters in = passwords).
--=20
john
john@oellrich.us
"Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote in =
message news:18jlu09b16c03vh74i1nv0aa30fsdt9p5i@4ax.com...
The reason I brought up the optional wallet service was that a =
couple of
messages upthread the discussion was about credit card numbers.
To answer your question, yes, I have a unique username and =
password for
any site where I care about the privacy and security of my =
information.
For example I have different usernames and passwords for Schwab,
e*Trade, the outfit that manages my company's 401(k) plan, and the
credit card issuer whose bills I pay online. At work my username =
is
the same for logon and email because with Novell it has to be, but =
the
passwords are different, and both the username and password for =
the pcAW
host object on my desktop are different from the other two.
On the other hand, I don't care if my password for the NYTimes is =
the
same as my password to the LATimes. But even that isn't the same =
as
single sign-in because there isn't a common manager that looks at =
what I
read in both places, which with single sign-in would be at least
theoretically possible.
On Sat, 15 Jan 2005 21:08:17 -0800, "Rich" <@> wrote in message
<41e9f6c1@w3.nls.net>:
> There was an optional wallet service and you are right, this =
additional optional service could not be anonymous. You aren't = comparing
apples to apples if you include the people that made a choice = to use this.
Folks that wanted to be anonymous would not choose this.
>
> Really, this argument is silly. I don't know you but too many =
people I know use the same password on the many sites that require them = to
register, whether they lie or not. Their intent is to have something = that
acts like single sign-in. Now I'm sure the people arguing against =
single sign-in here are not hypocrits and all use distinct unique = usernames,
email addresses, passwords, etc for each and every account = they have. Don't
you?
>
>Rich
>
> "Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote in =
message news:ldqju0pdbclq8l54fbhi21220l86uibp28@4ax.com...
> Well, if you only use Passport as a signin, yes. But there was =
a piece
> to it where it would know your credit card information so when =
you used
> it to log on to a site where you wanted to buy stuff you =
wouldn't have
> to enter the credit card information. It would be impossible =
to use
> that part and be anonymous.
>
> On Mon, 10 Jan 2005 15:09:44 -0800, "Rich" <@> wrote in message
> <41e30b2c@w3.nls.net>:
>
> > I disagree. Passport is no less anonymous than other =
signin mechanisms. You are in control of the information you provide to =
create your signin. If you want to lie then lie.
> >
> >Rich
> >
> > "Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote =
in message news:c5h4u0p76hl80msc3pis0v1puf9k7erkpn@4ax.com...
> > I think he wasn't addressing services claiming they don't =
disclose...
> > his message gave examples of people trying to be =
anonymous... but
> > someone trying to be anonymous wouldn't use Passport (unless =
they were
> > REALLY stupid) so I'm not quite following the logic either.
> >
> > On Sun, 9 Jan 2005 10:04:25 -0800, "Rich" <@> wrote in =
message
> > <41e1720a@w3.nls.net>:
> >
> > > The fragment you chose to quote is interesting. How =
many services claim that they do not disclose info as required by law?
> > >
> > > The rest is garbage.
> > >
> > >Rich
> > >
> > > "Mike N." <mike@u-spam-u-die.net> wrote in message =
news:e8b2u0hias1bdkdgbe34mf26snbcna0ov4@4ax.com...
> > > On Sun, 9 Jan 2005 01:48:12 -0800, "Rich" <@> wrote:
> > >
> > > > If you mean to question what Passport is to Microsoft =
you should use Microsoft's claims about the service
> > >
> > > =
http://www.passport.net/Consumer/PrivacyPolicy.asp?lc=3D1033
> > >
> > > "NET Passport may disclose personal information if =
required to do so by law
> > > or in the good-faith belief that such action is necessary =
to: (a) conform
> > > to legal requirements or comply with legal process served =
on Microsoft;"
> > >
> > > This confirms the information I already had. A single =
signon is for
> > > convenience, not security. Sure your ISP can see what =
you're doing. They
> > > can initiate a wiretap when served by a subpoena. =
However there are many
> > > people for which this won't suffice -
> > > o terrorists who jump from Cafe to Cafe.
> > > o commuters who use wireless internet services from =
Starbucks, at work,
> > > airports, etc.
> > > o Those who attempt to escape identity by wardriving =
from open wireless
> > > to open wireless LAN.
> > > Investigators would need to obtain subpoenas from =
thousands of ISPs to
> > > cover all activities of a person. Alternatively, =
assuming that .NET is in
> > > widespread use, they would just need to subpoena =
Microsoft to get a
> > > complete profile of sites where a signon was used, and =
the IP
> > > address/date/time they were accessed from.
> > >
> > > It still appears that if anyone gets your passport =
login, they can
> > > assume your signon, just as if they are you.
------=_NextPart_000_00C2_01C4FD97.2DA00F90
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1479" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>You know, that's an interesting point. =
With single=20
signon the sites don't have your password so what's more secure, one =
single=20
login site or 20 different web sites where each stores your password. = Seems
to=20
me the single signon would be more secure. (this assumes you use the = same=20
password for your bank and your credit card company site which both = Ellen and
I=20
don't)</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>OTOH, if you don't care about the sites =
such as the=20
NYT where you only have a login so they can track your ass, who cares if =
it's=20
secure or not? Personally I take great satisfaction in sharing the = barkto
login=20
for sites like NYT so that what they end up tracking is a bunch of users =
which=20
then messes up their per user statistics. In a case like that a single =
signon=20
feature would be counter productive.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:41ecadcb@w3.nls.net">news:41ecadcb@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> I believe what you =
describe is very=20
typical except that most folks do not use strong passwords so special=20
characters are not an issue. This creates a far greater =
vulnerability=20
than single sign-on because not only does a single password work at =
many=20
sites, each and every one of these many sites knows your password and =
you are=20
vulnerable not just to someone stealing your password from you by some =
means=20
but also your password being stolen from any one of the sites with =
which you=20
have an account. With single sign-on, the individual sites to =
not have=20
your password.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"John Oellrich" <<A=20
href=3D"mailto:john@oellrich.us">john@oellrich.us</A>> wrote in =
message <A=20
=
href=3D"news:41ec8b51@w3.nls.net">news:41ec8b51@w3.nls.net</A>...</DIV>
<DIV>Ellen,</DIV>
<DIV> </DIV>
<DIV>Can you keep all these usernames and passwords combos =
memorized? I know=20
I couldn't. And a lot of sites I buy from require the username to be =
my=20
e-mail address, so there goes the username option. I just choose to =
go with=20
essentially a single very strong password (have to do some =
variations=20
because many sites will not allow special characters in =
passwords).</DIV>
<DIV><BR>-- <BR>john</DIV>
<DIV> </DIV>
<DIV><A href=3D"mailto:john@oellrich.us">john@oellrich.us</A></DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Ellen K." <<A=20
=
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>>=20
wrote in message <A=20
=
href=3D"news:18jlu09b16c03vh74i1nv0aa30fsdt9p5i@4ax.com">news:18jlu09b16c=
03vh74i1nv0aa30fsdt9p5i@4ax.com</A>...</DIV>The=20
reason I brought up the optional wallet service was that a couple=20
of<BR>messages upthread the discussion was about credit card=20
numbers.<BR><BR>To answer your question, yes, I have a unique =
username and=20
password for<BR>any site where I care about the privacy and =
security of my=20
information.<BR>For example I have different usernames and =
passwords for=20
Schwab,<BR>e*Trade, the outfit that manages my company's 401(k) =
plan, and=20
the<BR>credit card issuer whose bills I pay online. At =
work my=20
username is<BR>the same for logon and email because with Novell it =
has to=20
be, but the<BR>passwords are different, and both the username and =
password=20
for the pcAW<BR>host object on my desktop are different from the =
other=20
two.<BR><BR>On the other hand, I don't care if my password for the =
NYTimes=20
is the<BR>same as my password to the LATimes. But even =
that=20
isn't the same as<BR>single sign-in because there isn't a common =
manager=20
that looks at what I<BR>read in both places, which with single =
sign-in=20
would be at least<BR>theoretically possible.<BR><BR>On Sat, 15 Jan =
2005=20
21:08:17 -0800, "Rich" <@> wrote in message<BR><<A=20
=
href=3D"mailto:41e9f6c1@w3.nls.net">41e9f6c1@w3.nls.net</A>>:<BR><BR>&=
gt; =20
There was an optional wallet service and you are right, this =
additional=20
optional service could not be anonymous. You aren't =
comparing apples=20
to apples if you include the people that made a choice to use =
this. =20
Folks that wanted to be anonymous would not choose=20
this.<BR>><BR>> Really, this argument is =
silly. I=20
don't know you but too many people I know use the same password on =
the=20
many sites that require them to register, whether they lie or =
not. =20
Their intent is to have something that acts like single=20
sign-in. Now I'm sure the people arguing against =
single=20
sign-in here are not hypocrits and all use distinct unique =
usernames,=20
email addresses, passwords, etc for each and every account they=20
have. Don't you?<BR>><BR>>Rich<BR>><BR>> =
"Ellen=20
K." <<A=20
=
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>>=20
wrote in message <A=20
=
href=3D"news:ldqju0pdbclq8l54fbhi21220l86uibp28@4ax.com">news:ldqju0pdbcl=
q8l54fbhi21220l86uibp28@4ax.com</A>...<BR>> =20
Well, if you only use Passport as a signin, yes. But there =
was a=20
piece<BR>> to it where it would know your credit card =
information=20
so when you used<BR>> it to log on to a site where you =
wanted to=20
buy stuff you wouldn't have<BR>> to enter the credit card =
information. It would be impossible to =
use<BR>> that=20
part and be anonymous.<BR>><BR>> On Mon, 10 Jan 2005 =
15:09:44=20
-0800, "Rich" <@> wrote in message<BR>> <<A=20
=
href=3D"mailto:41e30b2c@w3.nls.net">41e30b2c@w3.nls.net</A>>:<BR>><=
BR>> =20
> I disagree. Passport is no less anonymous =
than=20
other signin mechanisms. You are in control of the =
information you=20
provide to create your signin. If you want to lie then=20
lie.<BR>> ><BR>> >Rich<BR>> =20
><BR>> > "Ellen K." <<A=20
=
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>>=20
wrote in message <A=20
=
href=3D"news:c5h4u0p76hl80msc3pis0v1puf9k7erkpn@4ax.com">news:c5h4u0p76hl=
80msc3pis0v1puf9k7erkpn@4ax.com</A>...<BR>> =20
> I think he wasn't addressing services claiming they =
don't=20
disclose...<BR>> > his message gave examples of =
people=20
trying to be anonymous... but<BR>> > someone =
trying to=20
be anonymous wouldn't use Passport (unless they were<BR>> =
> REALLY stupid) so I'm not quite following the logic=20
either.<BR>> ><BR>> > On Sun, 9 Jan =
2005=20
10:04:25 -0800, "Rich" <@> wrote in message<BR>> =
> =20
<<A=20
=
href=3D"mailto:41e1720a@w3.nls.net">41e1720a@w3.nls.net</A>>:<BR>>&=
nbsp;=20
><BR>> > > The fragment you =
chose to=20
quote is interesting. How many services claim that they do =
not=20
disclose info as required by law?<BR>> > =20
><BR>> > > The rest is=20
garbage.<BR>> > ><BR>> > =20
>Rich<BR>> > ><BR>> > =
> =20
"Mike N." <<A=20
=
href=3D"mailto:mike@u-spam-u-die.net">mike@u-spam-u-die.net</A>> = wrote
in=20
message <A=20
=
href=3D"news:e8b2u0hias1bdkdgbe34mf26snbcna0ov4@4ax.com">news:e8b2u0hias1=
bdkdgbe34mf26snbcna0ov4@4ax.com</A>...<BR>> =20
> > On Sun, 9 Jan 2005 01:48:12 -0800, "Rich" =
<@>=20
wrote:<BR>> > ><BR>> > =
> =20
> If you mean to question what Passport is to Microsoft you =
should use=20
Microsoft's claims about the service<BR>> > =20
><BR>> > > <A=20
=
href=3D"http://www.passport.net/Consumer/PrivacyPolicy.asp?lc=3D1033">htt=
p://www.passport.net/Consumer/PrivacyPolicy.asp?lc=3D1033</A><BR>>&nbs=
p;=20
> ><BR>> > > "NET Passport =
may=20
disclose personal information if required to do so by =
law<BR>> =20
> > or in the good-faith belief that such action =
is=20
necessary to: (a) conform<BR>> > > to =
legal=20
requirements or comply with legal process served on=20
Microsoft;"<BR>> > ><BR>> > =
> This confirms the information I =
already=20
had. A single signon is for<BR>> > =
> =20
convenience, not security. Sure your ISP can see what you're =
doing. They<BR>> > > can initiate =
a=20
wiretap when served by a subpoena. However there are=20
many<BR>> > > people for which this =
won't=20
suffice -<BR>> > > o=20
terrorists who jump from Cafe to Cafe.<BR>> > =20
> o commuters who use wireless internet =
services from Starbucks, at work,<BR>> > =
> =20
airports, etc.<BR>> > > o =
Those who=20
attempt to escape identity by wardriving from open =
wireless<BR>> =20
> > to open wireless LAN.<BR>> =
> =20
> Investigators would need to =
obtain=20
subpoenas from thousands of ISPs to<BR>> > =
> =20
cover all activities of a person. Alternatively, =
assuming that=20
.NET is in<BR>> > > widespread use, =
they would=20
just need to subpoena Microsoft to get a<BR>> > =20
> complete profile of sites where a signon was used, and =
the=20
IP<BR>> > > address/date/time they were =
accessed from.<BR>> > ><BR>> =
> =20
> It still appears that if anyone gets =
your=20
passport login, they can<BR>> > > =
assume=20
your signon, just as if they are=20
you.<BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_00C2_01C4FD97.2DA00F90--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|