Thursday May 24, 2012 4:08 PM AEST

Microsoft hoping to make Passport universal with maimed Kerberos

By Staff Writers
00:00 Jan 1, 1900
Tags: Microsoft | hoping | to | make | Passport | universal | with | maimed | Kerberos

In a move aimed at helping MS Passport become a universal verification service, Microsoft has announced that it will be expanding the Passport sign-in service to be interoperable with company intranets, websites and other networks, in order to

In a move aimed at helping MS Passport become a universal verification service, Microsoft has announced that it will be expanding the Passport sign-in service to be interoperable with company intranets, websites and other networks, in order to 'deliver trusted, universal single sign-in spanning multiple organizations and services.'

In a press release sent out yesterday, Microsoft's group VP of .NET Services, Bob Muglia, said "We invite the industry to participate in this federated model that bridges today's islands of authentication into a trusted network for users, Web site operators, wireline and wireless carriers, and corporations that will unlock the power of Web services, which is the foundation of our .NET vision."

As part of Microsoft's new strategy, Passport will be modified to support Kerberos tickets, a widely used method of authentication. However, according to El Reg , Microsoft's implementation of Kerberos does not adhere to the Kerberos standard.

Kerberos is an authentication service. Users present Kerberos servers with a username and password, and they receive a 'ticket' that verifies their identity. This ticket can then be presented to any properly configured authorisation server, which will decide how and what you can access, based upon your ticket. The reason that the Kerberos server cannot perform both authentication and authorisation itself is because no one can agree on the best way of implementing authorisation into the Kerberos protocol. Realising this, all players involved in Kerberos have agreed to not pollute the existing Kerberos authentication ticket with extra information. Well, all involved players with the exception Microsoft.

Microsoft's implementation of Kerberos actually includes an authorisation in the Kerberos ticket. This means that the only Kerberos tickets a Microsoft OS will recognise and validate, are tickets generated by other Microsoft based Kerberos servers.

The downside here should be obvious. If you want to use Kerberos in conjunction with Passport, you must be using a Microsoft OS. Normally this would not be a problem, as non-Microsoft customers would simply use a normal Kerberos server. The real problem comes when websites and online businesses (Amazon for example) decide to use Passport for their user authentication. If this happens, non-Microsoft OS users will be locked out of using these services.

We are all familiar with Microsoft's 'Embrace and Extend' philosophy. However, when that philosophy starts to affect who can use online services and how they can use them, based solely on what operating system you have chosen, it begs the question; Do we really want a proprietary technology from any vendor being used so widely, that it is capable of controlling our online experience?
 
 
Aliens: Colonial Marines in depth; Z-77 Motherboard round-up; strategy gaming special; Home Server tutorial. PLUS MUCH MORE - ON SALE NOW!
 
Atomic Magazine

Issue: 137 | June, 2012

Atomic is a magazine aimed squarely at computer enthusiasts, gamers, and serious PC upgraders.

Every month we bring you the latest reviews of new technology and PC components, in depth features on everything from overclocking to console hacking, and gaming previews and interviews.
 
Latest Comments
 
Latest User Reviews
Battlefield 3 is the new benchmark online FPS
90%
A very fun and realistic multiplayer ride.
 
Antec Kuhler 920 - liquid cool
90%
Antec Kuhler 920 silent but effientive out of the box no maintence water cooling kit
 
Antec's Lanboy Air - our new favourite case
90%
Antec Lan boy Air in red a very cool design
 
Antec's Lanboy Air - our new favourite case
90%
This product overall is awesome.
 
MSI's GT780 laptop as fast as it gets
90%
Nice laptop