Same account for pandora forum, wiki,... (Single-sign on?)


glenn

Still Fresh
Joined
Jun 19, 2006
Messages
20
Hi!

Could you please make a single pandora-account, when somebody creates an account on either the forum, wiki... and the same account name lay dormant on the other web-services until(if) enabled by the account name holder.

It is embarrassing for anyone to see that the same account name has already been taken on the other web-service.

Anytime a new web-service is enabled for general use, all the existant users at once has a dormant user account, that just waits to be enabled.

The users (and administrators) might see some additional benefits:
*Only need to confirm your e-mail account once (wow!)
*Only need to remember one account name (more wow!)
*Could even use the same cookie if the domain is the same.
*The user might need to log-in only one time (some call such a service http://en.wikipedia.org/wiki/Single_sign-on :D )
*Want to change password (e.g. for security reasons) - only need to change it in one place! If you miss one password change for one service - can not remember my previous password...
 
phpBB and mediawiki have wildly different databases and in the end it would be a total disaster. it works to link a forum account and an account on a custom site, but not two different established systems.
 
too much trouble to set up, they're not on the same servers or run by the same people
 
if they were, it would mean completely nuking one user database
 
PoisonedV said:
phpBB and mediawiki have wildly different databases and in the end it would be a total disaster. it works to link a forum account and an account on a custom site, but not two different established systems.

How about this?:

http://en.wikipedia.org/wiki/OpenID
Quote: "...Using OpenID-enabled sites, web users do not need to remember traditional items of identity such as username and password. Instead, they only need to be registered with any OpenID "identity provider" (IdP). Since OpenID is decentralized, any website can use OpenID as a way for users to sign in; OpenID does not require a centralized authority to confirm a user's digital identity...OpenID is increasingly gaining adoption among large sites, with organizations like AOL, BBC, Google,[1] IBM, Microsoft,[2] MySpace, Orange, VeriSign, Yandex and Yahoo! acting as providers.[3][4][5] In addition, OpenID can be used with Windows CardSpace.[2]..."

More info is here:
http://en.wikipedia.org/wiki/Category:I ... nt_systems
 
Kyosys said:
if they were, it would mean completely nuking one user database

How aboout renaming all existing account to <username>-non-openid (or some other suffix)?

You could send the users an e-mail that the account has been changed and the reason is to improve service?
 
PoisonedV said:
OpenID is a giant security hole waiting to be exploited.

Please read on:

Open-source Single Sign-On with CAS (Central Authentication Service):
http://www.esup-portail.org/download/at ... tation.ppt
Quote: "...Do not transmit passwords to applications...Opaque tickets are used...Open source..."

http://en.wikipedia.org/wiki/Central_Au ... on_Service
http://en.wikipedia.org/wiki/Shibboleth_(Internet2)

09/17/07 issue, GCN: The power of one password.
Single sign-on systems can tighten security, cut help-desk costs and keep users happy :D :
http://www.gcn.com/print/26_24/45041-1.html
Quote: "...“It’s a relatively easy way to roll out the product and then to scale it,” Gebel said...OneSign, a hardened appliance with a Linux-based operating system, also integrates nicely with the city’s Windows applications and minimizes their security risks..."

Single Sign-on for SAP: Increase the Security, Privacy and Compliance of Your SAP Data:
http://www.quest.com/Quest_Site_Assets/ ... 100407.pdf

http://www.ebusiness-security.com/FAQs/ ... O_faqs.htm
Quote: "...A wide range of credentials is offered including passwords [<-just need to avoid using this on openid enabled non-openid services!], tickets, and one-time passwords and digital certificates..."
 
PoisonedV said:
phpBB and mediawiki have wildly different databases and in the end it would be a total disaster. it works to link a forum account and an account on a custom site, but not two different established systems.

http://www.google.dk/search?hl=da&q=phpBB+cas+module

phpBB AuthCAS authentication module:
http://www.dustin.li/Publish/Software/E ... beach.html

-

http://www.google.dk/search?hl=da&q=med ... cas+module
http://www.google.dk/search?hl=da&q=med ... entication

http://www.ja-sig.org/wiki/display/CASC ... uth+module
Quote: "...
Solving the CAS client problem at the Apache layer has many advantages, as once you solve it you pick up Auth (and often auto-registration/login) virtually for free on many popular applications, such as Wordpress and MediaWiki.
..."

http://wiki.case.edu/CaseWiki:External_Authentication
Quote: "...This script could also be modified so that the user is obtained during execution of the script. This would be useful for a single sign-on service, such as CAS or Shibboleth. The important part about this script is it can somehow obtain the username of the person you wish to log in....Case's CAS SSO service stores a domain-wide cookie that can be used as a helper to tell if a user is probably logged in to the SSO service...Since we only want users to log in through our special script, Special:Userlogin is no longer needed. The following mod_rewrite rule intercepts calls to this page and redirects the user to our login script..."

http://code.google.com/p/mediawiki-cas/
Citat: "...This is an extension for MediaWiki to allow authentication via JA-SIG's Central Authentication Service (CAS) single sign-on..."
 
Glenn said:
PoisonedV said:
OpenID is a giant security hole waiting to be exploited.
blah blah blah...

The power of one password.

...blah blah blah
One password to rule them all.

May your god help your when it goes wrong.

Nice shiny new avatar PoisonedV.
 
The concept of openID itself is horrible as well, and I tell you this has a hobby-webapp security guy
 
Glenn: maybe you could say something insightful instead of quoting half assed articles and blog posts?
 
PoisonedV said:
Glenn: maybe you could say something insightful instead of quoting half assed articles and blog posts?

If you have something against the articles he wrote, you should specifically point them out instead of just throwing insults at it. This sort of talk can easily anger someone.

Edit: Though I agree that the list of links look like something he just Googled up without reading. None of us have the time to read it, so it'd be much better if he could sum them up instead.
 
javaJake said:
PoisonedV said:
Glenn: maybe you could say something insightful instead of quoting half assed articles and blog posts?

If you have something against the articles he wrote, you should specifically point them out instead of just throwing insults at it. This sort of talk can easily anger someone.

Edit: Though I agree that the list of links look like something he just Googled up without reading. None of us have the time to read it, so it'd be much better if he could sum them up instead.
i read most of them. it was almost all bunk, aimless lectures about "single sign" THEORY. none of it really proves that its secure or that it would work well for the forums and wiki. just people trying to get money for their grant.
 
PoisonedV said:
javaJake said:
PoisonedV said:
Glenn: maybe you could say something insightful instead of quoting half assed articles and blog posts?

If you have something against the articles he wrote, you should specifically point them out instead of just throwing insults at it. This sort of talk can easily anger someone.

Edit: Though I agree that the list of links look like something he just Googled up without reading. None of us have the time to read it, so it'd be much better if he could sum them up instead.
i read most of them. it was almost all bunk, aimless lectures about "single sign" THEORY. none of it really proves that its secure or that it would work well for the forums and wiki. just people trying to get money for their grant.

My experience is that SSO is much better from a security point, because you can demand a better password policy centrally, instead of easy guessable junk password.

With non-SSO, users seldom change password because you use a lot of energy to change them. If one of the systems are down, that password can not be changed on that system. Then the user need to remember two passwords - and which system that is lacking password change. :wacko:

The user also need to know which username goes with which system. :wacko:

Again - from a security point of view it is a disaster, because users WILL use easy guessable passwords.

(It is simply incredible that I need to point this out. :huh: )


More info:


White paper:
SSO Over the Internet:
The CISO’s Misperceptions and Realities:
http://download.101com.com/pub/spo/file ... ePaper.pdf
"...What we learned was surprising: many of the survey participants share three common misperceptions about secure Internet single sign-on (SSO). This paper identifies those misperceptions and provides clarifications to help readers understand the realities of delivering secure Internet SSO by deploying federated identity management.
...
Misperception #2: Internet SSO Is Not Secure
...
Reality #2: Standards-based Internet SSO is Secure
From an identity management perspective, the most cost-effective way to increase security is to centrally manage credentials, add strong authentication and provide SSO that leverages that strong authentication mechanism both internally, for legacy applications, and externally over the Internet.
Although a centralized point of access can be a point of attack, the truth is that today users have many passwords to access different applications, and each is vulnerable to attack. SSO eliminates the requirement for a login page for every application, thus reducing the login frequency and opportunity to expose usernames and passwords.
Internet SSO software that leverages proven standards, such as SAML and WS-Federation, relies on mature security and peer-reviewed standards.
..."


PvIB Expert Letter – March 2007
ISSN 1872-4884, Volume 3 – No. 1
March 2007
Single Sign-On for Organisations:
https://www.pvib.nl/download/?id=6259832
Quote: "...
Each of these problems is an argument in favour of SSO. Despite these serious disadvantages, the old situation also has a few advantages:
...
Although these disadvantages generally do not outweigh the advantages of SSO, they are important points for any SSO project.
..."

RSA, the RSA logo, SecurID, Confidence Inspired, IntelliAccess and ClearTrust are either registered trademarks or trademarks of RSA Security Inc. in the United States and/or other countries. All other products and services mentioned are trademarks of their respective companies.
© 2005 RSA Security Inc. All rights reserved.
SSO WP 0505.
Single Sign-on: Putting an End to the Password Management Nightmare:
http://www.imerja.com/files/file/White% ... n%20On.pdf
Quote: "...
I. BUSINESS CHALLENGES: THE MULTIPLE PITFALLS OF MULTIPLE PASSWORDS.
While password usage and multiple password management are widespread in organizations today, there are several drawbacks associated with this scenario. Repeated studies show that being burdened with managing several passwords for several applications, with intermittent password changes needed for each application, inevitably lead to high help desk costs, end-user frustration, poor compliance, lower security and a myriad of other repercussions that are not conducive to good business performance.
...
Compromised Security
Organizations supporting dozens of distributed password systems find that it is not only costly to administer this infrastructure, but that it is also a significant security threat.
...
II. SINGLE SIGN-ON: A DRIVER FOR BUSINESS EFFICIENCY AND GROWTH
...
Enhanced Security
SSO solutions can greatly reduce the number of passwords that an end-user has to remember, thereby enabling the use of one strong (and complex) password that is difficult to guess and increases the level of security for critical business information and corporate identities. When an end user has to remember several passwords (often more than 20 !), they usually pick simple, obvious ones that can easily be guessed by an attacker.
..."

Single Sign-On
http://www.terena.org/activities/euroca ... ilmore.ppt
 
You should have posted this on GP32X when it was up. Craig wanted a cure for insomnia. :twisted:
 
Back
Top