Forgot your password?
typodupeerror
Privacy Your Rights Online

Microsoft Defends Passport To Privacy Group 250

Posted by timothy
from the just-look-at-that-shine dept.
securitas writes: "CNET reports that Microsoft is defending Passport as safe and secure in a presentation to the Center for Democracy and Technology. Other organizations such as the Electronic Privacy Information Center, Junkbusters and even the U.S. government may be lobbied by MS this week to fend off a Federal Trade Commission complaint filed by 15 consumer and privacy groups that charges unfair and deceptive practices."
This discussion has been archived. No new comments can be posted.

Microsoft Defends Passport To Privacy Group

Comments Filter:
  • Well... (Score:2, Funny)

    by Heph_Smith (513724)
    Well I feel safer....
  • Microsoft accused of unfair practices and deceptive techniques!?! I must say that I am shocked, schocked I tell you!

    Unfortunatly I am uneligable for any such legal action against them as I think I gave them my soul in the last click thruogh agreement I did...
  • by Ghoser777 (113623) <fahrenba AT mac DOT com> on Sunday September 02, 2001 @11:16PM (#2247149) Homepage
    This says it all:

    "One of Passport's greatest security weaknesses may be the single sign-on process, analysts said. The single point of entry could also be a single point of failure. Since the ID is always an e-mail address, someone looking to break into an account might easily obtain half the information needed to do so."

    Because people usually don't pick very secure passwords, it's better to have multiple passwords so that an evesdropper or other malicious person can't crack into all yur accounts. U of I just made people intentionally set all their 3 or 4 passwords instead of just giving them one the applied to all 4 (although most people tend to choose the same password for all their online services anyway)

    Also, because Passport's trying to incorporate a lot of information in one place that used to be distrubuted in many different places, if some one hacks into Passport, there goes all your privacy.

    F-bacher
    • by sfe_software (220870) on Sunday September 02, 2001 @11:46PM (#2247221) Homepage
      If I'm not mistaken, it's worse than that.

      Scenerio 1: User always uses the same login/password everywhere they go.

      If you obtained that username and password, you'd be able to log into any service *that you know they use*. You would not be able to log into any random service unless that user happened to have been there before.

      Scenerio 2: Passport.

      If you obtain their Passport login and password, you could log into services *the user has never logged into before*. I'll admit I don't know much about how Passport works, but it seems that you'd be able to use their credit cards and other personal information at any Passport-enabled site...

      So even though users may choose non-secure passwords and use the same info at many sites, you still would have to know what services the user has signed up with. Passport eliminates that obstacle.
      • And of course, when it does get hacked (I'm sorry, we're talking about M$ here, someone will hack it just because of that) and J. Random User ends up with thousands of $ worth of porn site use, or eBay charges, or whatever, what will be the reaction from M$?

        A service pack? Abject denial?

        It's simple... if you're providing an online service, you need to supply the best protection possible to your clients. And there is no indication that M$ has the slightest clue on how to do this.

        Kierthos
      • The only information you have to give to get a passport is an email address, (it dosn't even have to be valid) a password and an answer to a stupid "what's your favorite pet?" question. I uggest you go get one [passport.com] yourself, then you might appreciate the risks a little more.
        • Yup, I just got me postmaster@fbi.gov and postmaster@usdoj.gov (all of the system_accounts@microsoft.com have already gone). I bet we can think of a few more good ones for when they start spamming their victims and/or sending out the "Nobody panic, but there is a tiny chance that your account may have been compromised..." shrieks.

    • by Anonymous Brave Guy (457657) on Monday September 03, 2001 @07:26AM (#2247734)
      Because people usually don't pick very secure passwords, it's better to have multiple passwords so that an evesdropper or other malicious person can't crack into all yur accounts.

      Unfortunately, that's just not true. Usability research has shown certain facts about passwords again and again. In particular, as soon as you start forcing users to remember several passwords, they immediately start using obvious and easy to remember passwords, or writing them down in a readily accessible location. Clearly, this does not improve security.

      Having a single sign-in, with a single, genuinely cryptic ID and password, is far more secure than twenty different authentication schemes for different facilities. Of course you rely on the keeper of that information to keep your data in a trustworthy fashion, but you have that problem anyway. At least with a single secure sign-in the average five year old can't guess everyone's ludicrously simple password.

  • A web-wide identification service would literally be the best thing to happen to the web. Think about it. When you visit a new site, it will simply prompt you for your desired username, and then gets your info from some central source. Imagine not having to remember passwords for a million sites. The key here though is that the central source must be a trustworthy one. Microsoft does NOT fit that criteria. Personally, I think the ideal administrative body would be Verisign, or somebody like that. Someone already in the online security business, or racket if you prefer.
    • by Anonymous Coward
      NIS, NIS+ Kerberos, others.


      And if the single source happens to run an insecure operating system from Microsoft, then there will be disaster.


      Microsoft fell to Code Red like everyone else who ran a Microsoft operating system. Far too much responsibility for Microsoft to handle. ANd that doesn't even factor in the matter of whether or not they can be trusted to act ethically.

    • That isn't the greatest idea. What if your password was leaked/someone figured it out? Then would they automatically have access to your account on millions of websites? That doesn't sound like good security to me. (No pun intended ;x)
    • Yep Verisign.

      Because web certificate authentication is so wonderful as it is today. :-)
    • It's not just the central source that needs to be trustworthy. Everyone that gets permission to access that info from the source needs to trustworthy too.

      In a perfect world businesses would never sell information about their customers, but we all know it happens occasionally. What if a supposedly legitimate business with access to Passport decides they can make good bucks selling user information to a 3rd party that can't get it legitimately? Not to mention the fact that Passport may give this rude business more info about me than I would normally need to give them during the course of doing business with them.

      The fact that businesses, for the most part, only have information that they need about their own clients is a level of security in itself.

      Does anyone know more about how MS plans to allow 3rd parties access to Passport authentication?
    • by Anonymous Coward

      Its not just a world wide identification system... passport is the first installment of Hailstorm [microsoft.com] its not just a common identification service its the first step towards common data storage that may be shared between web sites...

      This is a good idea... all of you who contend otherwise are speaking purely out of emotion.

      It's very clear that one of the biggest reasons for the success of windows desktop platform has been the interopability of windows applications.

      It's very clear why this is a good thing for the user, what is not clear is how it might be implemented on the web whilst safe guarding peoples very basic human rights such as liberty and privacy.

      I agree that this would be a huge step forward for the web, and is a step towards its ultimate evolution. Accordingly this should not be seen as something that should be crushed at all costs... it should be seen as something that needs to be debated, fleshed out and evolved. Taking a hostile approach against this is only going to see less public input put into it than might otherwise be acheived.

      • Nobody's saying it should be "crushed at all costs". I simply won't use it. And neither will, probably, all those who don't like the idea. For me at least, it's a little difficult to trust Microsoft with my personal data when I don't even trust them enough to have any of their software installed on my computers. It's not an emotional or religious issue: I just can't trust them.
  • by exceed (518714)
    I don't know about many other people, but I don't think too many people would have an e-mail account on a service such as Passport if it was going to contain highly sensitive material. I use services like this as "spam e-mails" so that I can sign up for things that require an e-mail address (but some websites won't even let you sign up with an e-mail like Passport or Hotmail, anyways).
    • Re:Hmm.. (Score:3, Insightful)

      by kilgore_47 (262118)
      I don't know about many other people, but I don't think too many people would have an e-mail account on a service such as Passport if it was going to contain highly sensitive material. I use services like this as "spam e-mails" so that I can sign up for things that require an e-mail address (but some websites won't even let you sign up with an e-mail like Passport or Hotmail, anyways).

      Sure, my current passport account is filled with bogus info and is mostly used for hotmail and sometimes msn communities. But the idea is that the passport login will be required for more legit/official uses such as the MSN HomeAdvisor, financial sites, and maybe even ecommerce. Sites that you'd ordinarily give real info to will soon be using passport. And that sucks.
  • by Proud Geek (260376) on Sunday September 02, 2001 @11:19PM (#2247164) Homepage Journal
    Passport is definitely an easier solution for consumers than any alternative yet presented. Having all your information stored in one central location is definitely better than having all your information stored all over the place. Microsoft also has a lot more motivation and resources to protect it than Joe Random Vendor.

    The problem is that they haven't had any success protecting it anyway. To be completely fair, neither has anyone else. The other difficulty is that although I would trust MS rather than JRV to protect my data, the necessity of distribution and interaction opens up a whole new class of security holes that no one has even thought of before.

    The unfortunate truth is that right now the only way to protect your privacy online is not to give out any information, and that Passport will do exactly nothing to remedy this situation.
    • Having all your information stored in one central location is definitely better than having all your information stored all over the place.

      I disagree.
      Just because I am truthfull when entering my age on one site doesn't mean I want to be on another site. If both ask for my age, and both use passport, I'd have to use two passport accounts to achive my age-deception! And that defeats the whole purpose.

      Age is just a trivial example. What info (and how much info) most people give out varies greatly between sites. How does it benefit me, the end user, to have all my info in one place? I can remember passwords, so that one-password argument is no good.

      And, even if I wanted one place for all my info, M$ would be the last company I would want to administer it.
      • by jonnosan (300963) on Sunday September 02, 2001 @11:36PM (#2247201)
        If you have a look at the passport SDK, you'll see that the affiliated sites don't have direct access to any of the user's data.

        A site that wants to use Passport for SSO generates an URL that redirects to the passport website. Then the user logs in, and passport redirects back to the original site. The original site can then access the authenticated username, but that's it.

        When the site wants to get some data from the user, say the user's age or address, they don't query passport directly. What they do is redirect back to passport, passport generates a form with the values prefilled in. Then the user can edit those values, or just click submit, and the values are posted back to the original site.

        So as a user you still get full control over what data a site you visit has. And you can tell a particular site info that is different to what is stored in passport. But it does save you typing in the same old boring gumpf into site after site.
        • When the site wants to get some data from the user, say the user's age or address, they don't query passport directly. What they do is redirect back to passport, passport generates a form with the values prefilled in. Then the user can edit those values, or just click submit, and the values are posted back to the original site.

          Or you can just use the very cool (and free) RoboForm [roboform.com] which sits in your toolbar and auto-fills forms that pop up in your browser (there are other form-fillers around but I haven't tried them).

          This kind of software doesn't require you to submit your personal information to a centralised authority (it's stored on your PC), and you can keep multiple 'identities' and choose which to use to fill in a form. I keep 'complete', 'partial', and 'anonymous' identities which I use to decide how much (and how truthful) information I want to give to a site.
        • This report [avirubin.com] provides a decent description of Passport's technical architecture and some of it's potential issues, and links to other referances.

          While it does confirm your statement that you can tailor and select what information you send from the "wallet" MS keeps for you, there are still problems. For one thing when you sign into Passport this is noted by use of encrypted (3 DES) cookies stored on your browser. The intent here is that you only need sign in once and all kinds of sites will be able to authenticate you. This part of the procedure happens transparently once you've signed into Passport.

          The vulnerability here should be obvious, if you don't at some point logout from Passport, then the next person who opens the browser will be recognized as you anywhere that uses Passport authentication. Furthermore those neatly prefilled out forms will then contain all your information which this imposter could simply read off. Of course, the cookies are set to expire after a while, but certainly that is a matter of hours if not days, since MS doesn't want to interrupt people and force them to relogin.

          This is only one of a number of problems and potential attacks outlined in the site I linked above. Good stuff, I suggest you check it out.

          So now on, forgetting to logout will be an internet wide catastrophe as opposed to a localized problem? Thank you, MS.
          • If your personal information is so valuable, don't leave it lying around. Logging out should be just as natural as putting your credit card back in your wallet when you're done with it, or not leaving your checkbook laying around. Surely we shouldn't all stop using credit cards just because people can exploit carelessness to commit fraud.
          • by sheldon (2322) on Monday September 03, 2001 @03:05AM (#2247498)
            When you sign-in to Passport there are two checkboxes...

            One says 'Sign me on Automatically'. If you check this, a cookie is stored that remembers to authenticate you from then on.

            If you don't check this box(which is the default condition), then a cookie is created and stored which remembers your username. But the authentication information is stored as a session cookie which disappears when you close the browser.

            There is a second checkbox. It says 'I'm using a public computer'. This stores a session cookie on your machine for both the username and authentication.

            Once you have closed the browser, the session cookie is gone and you no longer authenticate automatically, nor is your username auto entered for you.

            So while I understand your concern, Microsoft has provided two checkboxes which alleviate this concern. Neither checkbox is on by default which means the default behavior is to remember your username only.

            If you have a better solution to this problem, I'm sure we'd all appreciate hearing about it.

            BTW, the paper you linked to has much better explanations of problems Passport might have then what you wrote about. Man in the middle type attacks that involve redirecting DNS, etc.

            • I'll admit, I've never used Passport. In choosing to highlight one issue, I picked what seemed most dangerous to me (eg. forgetful people accidently leaving their online lives wide open to attack). It appears that my criticism was greatly overstated due to poor understanding. I'm sorry, and thanks for the explanation. I hope people will go ahead and follow that link since those guys certainly know more about the issues that I do.

              For simplicity, I'm restating the link here [avirubin.com].
    • The problem with placing all your information in one place is that it provides a very lucrative target for script kiddies and the like. How much effort is someone going to put into cracking JRV's user DB as opposed to MS Passport? The presence of such a high profile single point of failure is going to attract crackers like moths to a lamp.
    • by coyote-san (38515) on Monday September 03, 2001 @12:01AM (#2247255)
      Information leaking from one site is annoying, esp. if it's something like a credit card number, but it's nothing compared to aggregated information being leaked.

      As a silly example, let's say you buy rat poison. No big thing, people buy it all the time.

      Let's say you buy a book about "perfect murders... and how they were caught." No big deal, people buy true crime books all the time.

      Now let's say you recently bought a bunch of lingerie. And had it delivered. But not to your home address. You're having an affair, sleazy, but not unheard of.

      Now finally let's toss in the fact that you just consulted a lawyer. A divorce lawyer. One who specializes in breaking prenuptial agreements.

      Suddenly things are much more interesting.

      Most of us aren't planning to murder our spouse, or even to look like we're thinking about it. But it's certainly possible for mindless data aggregation to cause people to jump to the wrong conclusion. E.g., you bought a couple books on alcoholism, and a few cases of wine? You obviously have a problem, don't you. (Nope, the wnie is a gift to newlyweds and the book is to help me understand if my nephew needs help.) Etc and so forth.

      Even with all of this information centralized with Microsoft (and make no mistake that the Passport/Hailstorm system will not collect this information), my biggest concern isn't that it will be leaked. My concern is that it will have bogus information feed into it. There's a nice market opportunity for nasty companies to put bad information into these records, then offer to clean it up for you. For a modest price, of course. All of the potential damage of a credit report, but with none of the legal safeguards.

      Of course, that same problem exists today with the aggregated data provided by from credit card companies, but again it isn't a *single* point of failure. Even if you crack Citibank (still the largest CC issuer?), it does nothing about the hundreds of millions of people who don't have Citibank cards. But crack Hailstorm and you'll have information on almost everyone online.
      • Passport doesn't collect transactions from affiliated sites.

        There is no way that MS will know that you bought Rat Poison from one passport using site, and Lingerie from another.

        Well, let me rephrase that. There are plenty of ways that that kind of information can be collected (i.e. through doubleclick and similar user-info-swapping deals) but Passport doesn't alter the equation.

        There is a common misunderstanding here, passport is not the sole repository of all data for all sites who want to use passport. Each site collects and maintains it's own info.
        • Actually I changed my mind - Passport does change things slightly.

          The problem with aggregagating user transactions across multiple sites is matching up user accounts on one site with user accounts on another. DoubleClick solved this by using cookies, but (at least on single user Win9x boxen) identify a machine only, not a user, i.e. they can't detect multiple users of one machine or someone who uses lots of machines.

          What passport does is make people use the same account ID at all sites (i.e. their email address).

          Passport sites aren't the only sites that do this, e.g. safari.oreilly.com uses your email address as the login, as does amazon. So if Oreilly and Amazon wanted to match up the userbase to see what other books safari users purchased, they could quite easily. It would be a bit harder for Oreilly and SlashDot to match users however, since the login on slashdot is NOT your email address. But slashdot, like most sites, does still collect an email so matching would still be possible.

          They way passport changes things a little is that people with multiple emails are more likely to use the same address on all sites, and less likely to give bodgey email addresses. So matching will be (a little bit) more reliable.
        • But crack Hailstorm and you'll have information on almost everyone online.

        But not on me or thee, I assume. So, why do we care? Let the Microserfs sign up and get raped, let M$ take the flak, then once the principle is in place, we develop an open source (security through transparency) alternative and (here's the good bit) lobby for a consortium of Big Businesses to get together and themselves lobby for the gubmint (any gubmint, heck, pick a sensible one that everybody likes like New Zealand) to take it and administrate it.

    • To be completely fair, neither has anyone else.

      I already replied to your post, but I forgot to address the above sentence.
      Yahoo has already done it! A "Yahoo ID" can be used in as many places as a M$ passport, if not more.

      For instance, if you setup a "Yahoo Wallet" with your yahoo id, that info (name, creditcard, and billing info) can be used on any of the thousands of independent e-stores that run their backend through store.yahoo.com. The same login/pass also works on any of the yahoo sites (stocks, chat, mail, myYahoo portal, travel, the list goes on).

      I still don't think this is a good idea, but I'd rather give my info to Yahoo than M$. And no, I'm not just saying that because I hate bill gates; I've dealt with Yahoo Inc quite a bit (namely from running one of said store sites) and rather like the company.
    • "Having all your information stored in one central location is definitely better than having all your information stored all over the place."

      Oh man where to start.

      First of all all having all your information stored in passport does not mean it's not also stored in a thousand other places. Every web site will still store all kinds of information about you. That will never go away. What passport does is to present a very attractive target. Instead of hacking into a thousand places you just hack into passport and voila you have the information of everybody who has windows (which is pretty much everybody).

      Even if your contention is valid and it is better to have all your info in one place why should that be controlled by MS. You may trust MS but others of us who are accutely aware of the track record of MS when it comes to security are scared witless. Combine that with the unethical and sleazy characters who are in charge of MS and you have a recipe for disaster. Have you ever heard Ballmer, Gates, Allchin, or Mundy make a public statement that did not contain at least one lie? I haven't. Why should I trust these people?

      It would be better to store the information on my PC not on some public server. If it has to be stored on some public server I would rather it be held jointly by competing companies or by a non profit organization. I certainly would prefer that it be open source.

      Thank god for proxies and ipchains. In the end Passport will be just another example of a "stupid tax". The people who are illiterate will blindly give away all their privacy and the rest of us will drop passport packets at the firewall.
    • If all the information has to be held in one place (as in Passport), why not store it on the local computer? Mozilla will remember passwords and certificates for you, all being protected by the master password. Is it not better to have all the information stored on your system and for you (the user) to decide who is allowed to access what information? So that in order for a site to acccess any particular information, a dialog box could be displayed which allows the user to select one of
      • Always reject the request (for this site)
      • Reject it this time but ask me again next time
      • Always grant the (particular) request
      • Grant it this time but ask me again next time.
      Also users could choose what information they want to store in their local (encrypted) database. This could include, usernames/passwords, credit card numbers, (snail mail) address details etc.
    • I'm sorry but you are very very wrong. Passport is not the simplest ever presented so far. over 2-3 years ago when the iButton came out it was offered. In fact it was offered as the ultimate solution, and it still is. the problem is that it costs money... $15.00 for the reader/writer and $10.00 for the crypto ibutton or $15.00 for the java/crypto ibutton. smartcard has a cost 10 times that for retrospect. the ibutton is indestructable, and keeps the data in the hands of the owner of that data. Microsoft's passport transferrs the ownership of that provate data to microsoft. (read the agreement, they take ownership of all data including transaction histories) and it's the only solution being jammed down everyone's throats.

      there has been many excellent hardware and client based solutions that are transparent to the user.. Corperations will not adopt them because it keeps control of the sensitive data in the users hands and not in the companies pcoketbooks.
  • Maryland... (Score:1, Redundant)

    by kilgore_47 (262118)
    They probably won't lobby any state reps from maryland!

    (for those who don't know - the passport eula says you can't use it in the state of maryland.)
    • Hmmm... didn't know that. And the reason for this is? (I might have to move to Maryland...)

      Kierthos
      • Re:Maryland... (Score:2, Interesting)

        by kilgore_47 (262118)
        The reasons are complicated, and IANAL.

        Its explained here [newsforge.com] to some extent. That story claims its because Maryland has a law (that microsoft helped to pass) which is incompatible with the passport legal B.S.
    • So does Microsoft really attempt to do location verification, though? We all know how well users respect EULAs, after all :) Sounds like more of a CYA solution to me.

  • by frleong (241095) on Sunday September 02, 2001 @11:28PM (#2247185)
    So these privacy groups get worried about Microsoft's Passport leaking information when the biggest leaks of personal info are from fallen dotcoms and stupid e-commerce web sites? People, when you are paranoid, at least be paranoid to everybody, not just to Microsoft.
    • by kilgore_47 (262118) <kilgore_47@nospaM.yahoo.com> on Sunday September 02, 2001 @11:39PM (#2247210) Homepage Journal
      So these privacy groups get worried about Microsoft's Passport leaking information when the biggest leaks of personal info are from fallen dotcoms and stupid e-commerce web sites? People, when you are paranoid, at least be paranoid to everybody, not just to Microsoft.

      "fallen" dotcoms are, by definition, no longer in bussiness. Complaining about them won't do any good. Microsoft, on the other hand, is very much in bussiness. Their passport service has a bad track record. There is no indication that microsoft has made any major changes in response to the barrage of criticism it has received. It's growing, and in the future you will undoubtedly see more sites where a passport login is required for certain features. That is why its important to be paranoid about this threat now.
      • "fallen" dotcoms are, by definition, no longer in bussiness. Complaining about them won't do any good.

        Although the companies may be out of business, their founders and owners are not yet dead. You can always sue them if they leak your personal info when they sell the dotcom assets.

        Their passport service has a bad track record.

        What kind of bad track record? Has it leaked any private info? You have to separate the security problems of Hotmail (which is a Passport client) from the Passport service.

        • ? You have to separate the security problems of Hotmail (which is a Passport client) from the Passport service.

          I don't see it that way. If my hotmail password (passport password) is compromised due to hotmail's security issues, my passport account is essentially useless.
          • by frleong (241095)

            So far, I have not heard of any password being compromised due to Hotmail's security problems (you can only read mail, but the password is not revealed because of this).

            Of course, hackers can still use the old password guessing trick or social-engineering techniques, but this is not Passport's problem, nor Hotmail's.

        • by TheMidget (512188)
          Although the companies may be out of business, their founders and owners are not yet dead. You can always sue them if they leak your personal info when they sell the dotcom assets.

          Is this actually true? I always assumed that liquidation of assets (which unfortunately include "customer" lists) was handled by a bankruptcy court appointed "repo-man", and that the (former) owners of the company couldn't do anything at this point to decide which assets got sold to whom.

  • by alewando (854) on Sunday September 02, 2001 @11:33PM (#2247195)
    Just last month, Microsoft changed the service agreement [computerworld.com] for their passport system to require only an email address and password to sign up. Did Microsoft [adequacy.org] do this without any armtwisting? No. Did they do it, though? Yes.

    Just keep the pressure on them up. They're going to go ahead with some sort of service no matter what, but the amount of opposition they face now will determine how many of these concessions will be made "voluntarily". That way, even if the FTC doesn't come down with a favorable ruling, we won't be completely left out in the cold.

    Incidentally, msnbc also has some coverage [msnbc.com]. A disinterested and impartial news source if there ever were one... or not, as it were.

  • by Mandelbrute (308591) on Sunday September 02, 2001 @11:45PM (#2247218)
    If you are going to trust a business enough to allow it to have access to your finances, then it should be a business that you can physically reach, so that if something goes seriously wrong you can call the police in your own country or go bang on their door yourself without getting a visa. If nameless employee #6363666 gets up to a bit of embezzlement, and they are in another country, it's likely that you'll never see the money again and the offender will never get extridited.


    "I'm calling at international rates from Outthebackofstan, I've been on hold for three hours, and why don't you ^%#$%#^ read your email?"
    "Oh, I'm sorry, you have the wrong department, this is the Pacific USA only support line. Please dial this number again in another eleven hours and the people supporting your region will be here. Have a nice day" (To co-worker: "Another commie towelhead") click."

  • by bergeron76 (176351) on Sunday September 02, 2001 @11:51PM (#2247231)
    Like this one. [gridforge.com] They won't allow users to use Passport authentication to buy thier goods, and they posted info about why. What better way to prevent users from using MSPassport, than to send consumers mixed signals about being able to use it.

    • you have to click on the info [gridforge.com] link. I should've mentioned that.

      Disclaimer: I [bergeron.com] own the company.

    • hmmm, now that's really interesting. So it would seem that maybe the indirect approach would work...

      Instead of sending hate mail to MS, send emails to potential licensors of Passport authentication and suggest to them that they will be losing your business if they require the Passport login.

      As long as you have a choice, that should be good enough. Let the suckers who want to give away their credit card info go ahead and use Passport- let everyone who knows better choose not to do so.

      After the first couple of major cracks where CC #'s are lost, maybe people will see the error of MS's ways and look elsewhere.
  • by dragons_flight (515217) on Sunday September 02, 2001 @11:53PM (#2247235) Homepage
    For those that are interested here are links to the:

    Passport EULA [passport.com]

    Passport Privacy Policy [passport.com]
  • Just imagine being the poor sap trying to defend Passport to privacy groups:

    Privacy advocate: "So, you are trying to set yourself up as the one definitive source for our personal information online. Let's talk about your record: Hotmail backdoors, Code Red, Melissa, IIS, and Kournikova, among others, are horrible things which have been influenced by your poor implementations of products. And you want to have even more power?"

    Microsoft PR guy: "Try to think of those as valuable lessons we have learned to make Passport more secure...

  • by bcrowell (177657) on Monday September 03, 2001 @12:00AM (#2247251) Homepage
    The whole thing is a great idea, but only for less valuable passwords. I'd love to have a service like Passport to keep track of all my passwords for mailing lists, etc. I'd even use it for online businesses that have my credit card info, since the credit card company cancels the charges in cases of fraud.

    But no way would I use a single password for important stuff. And there's the problem: MS obviously wants to force you to use it for /everything/. So then you can have your whole identity stolen by the first criminal who watches over your shoulder while you type in your password.


    It's also scary to ponder that next they'd probably force you to use it with ENUM [cconvergence.com], a new scheme we're going to have shoved down our throats, which involves linking the DNS database to the database of phone numbers.

  • I'm not terribly worried by any "unfair and deceptive practices" that may ensue with regard to privacy. Any information given to Microsoft is done so in a completely voluntary manner: any leak of that information would certainly become well-known in a very short amount of time.

    The success of the passport system, and quite possibly their .NET "architecture", relies in significant part on the confidentiality of any personal information stored. As the system aspires to collect an amount of personal info I've never seen one company (truthfully) attempt to aquire, I would expect consumers to be very wary. If any of this personal data should be stolen, the repercussions for their entire system could be enormous. In short, I think the market will sort this problem out. Though, given the track record of Microsoft, I certainly don't want to be a test subject while it does.

    What's even more interesting, to me, is the fact Microsoft is using it's very large distribution channel to advertise and promote services in which it's competing against non-monopolistic companies. Messenger vs. ICQ (and others), Hotmail vs. many free email services, etc. I can't help but wonder if the FTC will look into this, rather than just the special interest groups concern.
  • great idea(l)s (Score:4, Insightful)

    by seanw (45548) on Monday September 03, 2001 @12:02AM (#2247257)
    this is such a classic microsoft-ism: thinking up a really good idea, and totally fucking up the implementation ([d]com, ole, activex, etc).

    what I can't figure out is why this company, which is supposedly on the brink of launching this massive, multi-tiered platform that is .NET has shackled it to possibly the worst authentication possible.

    I mean, come on, the username/password combo was maybe reasonable in the days when everyone had exactly one shell account. but today when everyone is expected to remember a user/pass combo for every one of a dozen or so websites they want to log into, the weakness of this paradigm has hit pretty hard. simply put: people can't remember them all, which means they either write them down lots of places (prett damn insecure) or use the same username/password for each account (even worse).

    and MS has made THIS the lynchpin of their security model?

    why couldn't MS use some of their much vaunted "monopoly power" to "leverage" an authentication system that actually matched the sophistication of the rest of .NET?

    my suggestion: the medium which most people are accustomed to carrying that is intimately tied to their financial and personal data is the credit card. my MS "Passport" could be a physical smartcard that held authentication data, encryption keys...hell, anything. each copy of XP (and each bundled OEM copy) would include a small USB device that could read this card, maybe that was designed to mount onto the side of the monitor so it would stay out of the way.

    YES this would be a major move, and it would stir things up a little. but when it is clearly called for, WHY NOT? people would just carry another little card in their wallet, the reader device would be small and dirt cheap (in that volume, most anything is) and in a year we would forget what we did without them. we have calling cards, and credit cards,and ATM cards...where is my computer card?

    in any case, tying their much-heralded .NET platform to the username/password "security system" is about as intelligent as locking your car with duct tape, and will probably be about as effective.
    • Using smart cards for ID is an interesting idea, and one I believe even MS have mentioned considering before. It's important to remember that such a mechanism brings its own problems, however.

      The logistical problem is the Big One, I suppose. You need smart card readers to become more ubiquitous even than CD drives today. Every machine that'll use Passport-subscribing services will need one. Someone's going to have to make an awful lot of readers, and someone else is going to have to pay for it.

      On top of that, smart cards are not a silver bullet for security problems anyway. What happens when the card gets stolen? If it's my credit card, I call the bank, get it cancelled, and have a new one sent to me in the post. In the meantime, I can always visit a branch to take out cash if I need to.

      What do we do when our smart card is nicked? Call MS to cancel it? How do we then reidentify ourselves to them to get a new one with the same access? They need... wait for it... more personal information about us to identify us. And surely I can't just use the card without any additional security -- if anyone does nick it, they can do anything until I realise and get it stopped. Suddenly, we're back to needing IDs, passwords and PIN numbers all over again, and now the whole point of using a smart card has been compromised.

      So, while I agree that smart cards or some other more original technological solution may be the answer to Swordfish Syndrome, I don't think we should be too hasty to criticise a long-standing, tried and tested approach until we know the alternative is genuinely better.

      • as for your "Big Problem": my point was that MS has the clout to SOLVE this big problem. MS could single-handedly cause the entire MS-using world (which constitutes a sizable chunk of the REAL world) to swich to these devices. and I'm saying they would be doing us a favor, for once.

        the cost and distribution problems solve themselves, because they're shipping millions of these things (did you, umm, read my actual post?). in such volume, the device wouldn't be any more expensive than the cardboard WinXP box it shipped in. then every user has one, voila.

        now the getting stolen problem is a little thornier...but I think you answered it yourself. so you say when you lose a credit card you call the bank and have them send you a new one. but surely you have to answer a few questions to their satisfaction before they mail you a new card? credit cards companies have already invented the answers to all your questions, and tested them also. there are already working protocols in place to implement such a system.

        you don't think we should be "too hasty to criticise a long-standing, tried and tested approach." when it simply doesn't work that well, why not? smartcards are an evolutionary extension to credit cards and phone cards, and would work much the same way. I'm still not sure why we're not doing it already.

        sean
        • as for your "Big Problem": my point was that MS has the clout to SOLVE this big problem. MS could single-handedly cause the entire MS-using world (which constitutes a sizable chunk of the REAL world) to swich to these devices. and I'm saying they would be doing us a favor, for once.


          How fast does the entire world (or perhaps the USA) upgrade their microsoft operating system? It's pretty safe to say that win 3.1 is nearly gone, but there are a lot of win 95 machines out there. Win 98 seems to be pretty common now, but judging from how 2000 and ME took the upgrade market by storm, it will be quite a long time until XP runs on the majority of PCs... not to mention the 80-90% needed to make smart cards "universal". Even 50-60% installed base on XP (vs earlier MS systems AND non-MS systems) is going to take quite a while.

  • My favorite part of the article is the quote from the M$ exec stating that you don't have to sign up for passport to use xp.

    If you have to sign up for it to use some parts of the os than yes, you do have to sign up for passport to use xp.
  • From this article it seems that some partner websites will require an additional 4 digit PIN in order to access services on that sites (such as banks etc)...

    This is insane! If only *some* of the sites require the 4 digit PIN, and all the passwords and email addresses for the passport sites are the same (through passport itself), then what on earth is stopping someone who obtained your password (through brute force or whatever) from trying any site that requires a PIN as well with a simple 10,000 step PIN cracker??? Cracking a 4 digit PIN at internet speed is TRIVIAL!

    Adding that 4 digit PIN is like adding a knot in the sticky tape holding your bicycle to the post.. It's just one more easily circumventable step in a flawed access-restriction service.
  • One of Passport's greatest security weaknesses may be the single sign-on process,....Microsoft is addressing this by offering additional security features for partner Web sites, such as banks, asking for additional information or a four-digit PIN (personal identification number) as a second level of authentication.

    Microsoft addressed this problem long time ago! People have been using MID(Message ID Number) [slashdot.org] for reading hotmail [hotmail.com].

    So stop questioning their security awareness.
  • Ok MS has passport and would like it if you used it. They have Windows Messenger and MSN Explorer on XP.... Does that mean you have to use them... NO! There may be a few more things on XP that can use the passport... but again.. do you have to use them... NO!.. Unless you have to use them I don't think there is anything wrong.
  • Probably US government make some compromise for the conflicting parties:

    1. Microsoft must be held liable for any information misuse and any leakage or possible exploit regarding on Passport. If any of such happens, Microsoft must pay proportional damage for each of its clients, both corporate and individual.
    2. Microsoft may not include indemnification clause on their Passport TOS.

    These two things make Passport as unfair. You cannot do anything to Microsoft if someone cracked Passport and poked into your account, use your credit card, SMS your cell phone, etc. Probably the implication is worse for corporations: If someone cracked Passport, he/she can get their customer data, their trade secrets, and mocked them for their inability to put their utmost effort to protect customer's private data.

    This must be stopped. I'm sure that a sheer amount of litigations would be tossed against Microsoft. Or probably went bankrupt just to recompensate their customer's punitive damage. :-)

  • by Anonymous Coward
    On this computer, I have MSN Messenger installed (Win98), and the default setting start it at boot up. Now, in order to change the default settings, You have to sign on, which means you have to have a passport account. And deleting it isnt an option, as the owner of this computer uses it.
  • by Anonymous Coward
    There's a fundamental dichotomy forming here as to how to handle personal information. It is being driven by the need/desire to be able to access your personal information wherever you are. Microsoft wants to centralise your information*, via Passport, .NET etc, so that all your data is all in one place that you can always access. That's nice, but worrying from a security point of view.

    The alternative way of doing things is a distributed model. With PDAs becoming more widespread, and more powerful it won't be long before you can store most or all of your personal data/files on a single small portable device. Now, providing some decent interfaces are written, this offers the same ease of accessibility as Microsotfs centralised solution, with the benefit of increased security - YOU are responsible for YOUR OWN data.

    I know which I prefer. I'll always trust my own abilities to secure my own data more than I trust Microsoft to secure it for me.

    Roll on with the distributed model I say!

    * By information/data I'm not just talking about street address, credit card number etc., I'm talking about all your work/code/data/etc.

    Jedidiah
  • by tshak (173364) on Monday September 03, 2001 @12:53AM (#2247338) Homepage
    Passport, or a similar concept, is still needed. Customers want it. If a user has to have 10 different logins, they may:

    1. Use the same password on all 10 anyway

    2. Use grossly easy passwords so that they can remember them

    3. A combo of 1 and 2.

    With a Passport like concept, there's only one account to remember. Maybe then consumers will find it reasonable to memorize a secure password. Either way, a centralized system is needed for identification. As a web developer for 5+ years, customers don't want to fill out the same crap each time they visit a site, and if they could just type in their passport info to authorize access to certain private information, they'd do it. Now, it's up to us to come do the social and technological engineering to make this happen safely, and securely.
    • as the article says, banks (and other partners) have the option of popping up their own authentication, to make sure Joe Blow is really who he says he is.

      kinda blows the whole single point of authentication out of the picture.
    • As a web developer for 5+ years, customers don't want to fill out the same crap each time they visit a site

      So you're telling me, that you'd be willing to render control of your very private data to one single company, located in a country with probably the piss-porest privacy protection laws in the Western hemisphere, just for the sake of convenience ?

      We're not talking about CC # here, but about everything surrounding your person, including potentially medical data.

      Now, it's up to us to come do the social and technological engineering to make this happen safely, and securely.

      See, I agree that it's up to society to define the sidelines. It's however not society that controls Passport. It's the Microsoft Corporation, which I personally woudn't entrust with my cell phone number.

      • What? This is anti-US/M$ trolling. I have a passport account and I hardly had to give ANY private information. Name/Address/Email. That's it. Medical information? You can't be serious? And yes, our privacy laws need work, but "piss-porest"? Unsubstantied uneducated hogwash.
    • >Either way, a centralized system is needed for identification.

      Um, NO.

      In fact, HELL NO.

      Apple's got something called the "Key Ring", which keeps all of your passwords in a strongly-encrypted file, on your OWN machine.

      Not only that, every time an app (such as a web browser) wants one of your passwords, the Keyring, NOT the app, ASKS you if it can release it. (This is subject to a user preference, of course.)

      You get the benefit of single sign-on (i.e, you only need to remember the passphrase to your keyring), and you can also use *truly* random passwords on all of the sites/services out there. If your login is B1378gHz##/74u9%z, it's a whole lot less likely to fall to a dictionary attack.

      Single sign-on is a good idea. MicroSquish passport is just about the worst way I can think of to implement it.

      -jcr
      • Passport, or a similar concept, is still needed. Customers want it.

      Those two statements are unconnected. Jane AOLuser wants free access, free stuff, 20% off of everything that isn't free, and she also wants for her computer to "just know what she wants to do" without her having to go through all that pesky remembering where to click. In other words, she doesn't want to take responsibility for paying for her usage, or for learning how to use her machine, and (most importantly) she doesn't want to take any responsibility whatsoever for her own security.

      Let's be careful about giving Jane everything she wants, huh?

    • I agree that a password store/person profile store is very useful... but why does it have to be online?

      Why couldn't you store the required info in an (encrypted) store on your machine and use that to answer the types of requests you are talking about. Same result to the end user without having all this information in some remote store.

      You could go further and set the system to autmoatically answer requests in some cases (perhaps in cases where the site has a P3P policy meeting certain conditions, etc.) and you could have every response be part of a digitally signed package that provided a "paper-trail" of exactly what you shared with that site and what purpose they claimed they would use it for.

      Much better solution, without MS holding all my data.
  • Can someone explain to me what possible advantages this silly, centralized, Microsoft-as-Big-Brother scheme has over keeping the information locally?

    I mean, keep it in some nice standardized XML in encrypted form and require a passphrase for each decryption/use of the information.

    Why would anyone in their right mind use this?
  • by Kazymyr (190114) on Monday September 03, 2001 @01:51AM (#2247414) Journal
    ...unless they specifically address the bullying issues they have towards the consumer.

    I used to have a Hotmail account, for several years (even before they were bought by MS). I was only logging in every 3-4 months, mostly to keep it active, because it wasn't my main email address.

    One day I found in it a message informing me that I had been automatically issued a passport. Without my consent. They had just taken the info in my hotmail registration and created a passport for me, without asking my permission. I got very angry, and asked that the "passport" be removed, because I didn't want it. The reply was "it cannot be removed, once you got one, you're stuck with it forever". It seems that, by logging into my hotmail account after they had sent me the info, I had "automatically given them permission to activate the passport". But nowhere on the login page was there any information about this!

    I eventually let the hotmail account expire, but AFAIK the passport account they crammed down my throat is still there. There is no option to delete it.
    • In the UK we have "The data protection act" which allows anyone over the age of 18 to demand a printed copy of all personal information stored about them online (and now, I understand, offline, for example printed) records. The glitch is that a "reasonable search fee" is acceptable (about which I'm annoyed) but the company is required to amend any inaccurate or unnecessary records.

      Doesn't America have one of these? Has anyone actually challenged MS to provide a printed breakdown?
      • In the UK we have "The data protection act" which allows anyone over the age of 18 to demand a printed copy of all personal information stored about them online (and now, I understand, offline, for example printed) records.

        It's more than just one piece of law these days, and gives you quite a few more rights than that, too; see the link in my other reply on this subthread for more information (in a pleasantly readable form, BTW -- well done the UK government).

        The glitch is that a "reasonable search fee" is acceptable (about which I'm annoyed)

        It is a reasonable thing to do, though. Otherwise, companies could be subjected to arbitrary time and money wasting searches on the whim of anyone who wanted to make trouble. I think the fee should be refunded if any problems are uncovered by the search that would not otherwise have been found, but that's a different thing to not having the fee at all.

    • One day I found in it a message informing me that I had been automatically issued a passport. Without my consent. They had just taken the info in my hotmail registration and created a passport for me, without asking my permission. I got very angry, and asked that the "passport" be removed, because I didn't want it. The reply was "it cannot be removed, once you got one, you're stuck with it forever". It seems that, by logging into my hotmail account after they had sent me the info, I had "automatically given them permission to activate the passport". But nowhere on the login page was there any information about this!

      IANAL, but looking at some information about UK data protection law [homeoffice.gov.uk], it would seem that Microsoft's behaviour here might be illegal on several counts. Oops. :-)

  • As someone who works for an e-commerce company I am irritated when I see what appears to be half-assed security on high profile websites. When a site run by a company like Microsoft is hacked, it becomes more difficult to convice my clients they can conduct business with us in confidence.

    I make my living because people visit our website and conduct online transactions. I know how much thought goes into security issues for our site. If we were to be hacked, it would reflect negatively the site and all other aspects of our business, as well as fail to serve the trust of our users.

    Microsoft does not appear to share these same concerns. Time and again they have a cavalier attitude towards very public attacks on their websites. Hotmail was hacked, so what, someone read your email. It was just porn, right? If Code Red turns IIS into a zombie it's your fault you didn't patch your server.

    Microsoft has not solved the security concerns that have plagued IIS, but that won't stop them from pushing forward with .net. If there were a massive hole found in this new web platform, I fear it what fallout may ultimately come of it. At some point the damage to the online economy will push lawmakers into imposing regulations. These regulations will become huge hurdles for the publishers of OSs, software, and websites.

    I have always felt that if there is one entity I trust less with my computer than MS it is the US Government. There is nothing worse than a cogressman or senator who doesn't understand computers making laws that effect them.

  • once was. >:)

    It's probably supported by M$ on all currently supported processors: Intel and AMD chips and any in that family...

    ...for now.

    On Paper and Online, News Publishers Rapidly Adopting Microsoft BackOffice Technologies [microsoft.com]

    The Center for Democracy and Technology? When the hell did M$'s business goal coalesce with Democracy as Franklin, Jefferson and co. enacted it?

    This friendly public service announcement posted from:
    vanboers@tempe:~$ uname -a
    Linux tempe 2.4.9-ac1 #2 Sun Sep 2 22:20:55 MST 2001 alpha unknown


    Nope, not even a Linus Torvalds kernel. Alan Cox rocks, too.

    Choice is.
  • by jsse (254124)
    I've seen a lot of posts bashing on Micosoft. I don't like passport not because I don't like everything from Microsoft, but Microsoft PR tends to boast passport system's security level in such a way that general public wouldn't aware of its risks.

    (of course, the fact that these people are unaccountable is one of the major factor; but this just FUD in some people's eyes)

    The amount of your personal information to give to passport system depends on the degree of trust you have on a username/password security system over the Internet.

    I think Passport is secure to some degree, but it's definitely not absolute secure(nothing is). However, I never hear a Microsoft PR would say 'but' in propaganding their passport system.

    E.g. when I apply for a personal certificate I was given a time limit for using it. Not because the certificate issuer is a greedy bastard, but they want me to know the encryption in it can be broken by known technology beyond this period(by brute force attack, computer tech advanced, etc.).

    Computer security is not absolute. The claims of its security level is part of the security system itself. No matter how well the Passport system is made, failure to give honest claim would render its useless.

    Just my opinion. You can start bashing me by clicking the reply below. Thanks.
  • That's right, if you follow this mantra then you must agree that ultimately all of your information will be free on the net...what sites you have visited recently, your credit card info, your sexual preferences, who you work for, your favorite sports team etc, will be public domain. However, there is a solution, I heard it in a speech by my favorite man!.....

    To quote J.Jackson

    "If you choose, to use, your paaaaspoorrt, .. you desseerve to looooose yo privacy! Ahmen Brotha.. If you chooooses, to usess, an Allllternatitivvvve oppperatin system, such as my dear brotha's-- Leeeenux, and Bee eSss Deee, (that stands fo Brotha's Standdd Dogetha), or my personal fave, Mac OS X (Staand togetha now!!!! Hear me clear?) then you have notttthing to fearrrrr!!! Ahhhmmeeeenn Brotttha!.... For We Maaaayyy be fewww (Yes!, Yesssss!) and we Maaayyy be poooorrr (praisse godddd!), but we are brotha's in arms, Hallejjjjulla Brottttha!, Praissee the Loooooooooorrrrrrdd! The Lorrrrd does not need a passport, NO!!!. The Lord does not need Micros$$$$$ft, NO!!! He praises each and every one of of you, who do not commit the siiiiiinns of the ignoorant! Yea! He praises and encourages alllllll thooose who strive for freedom and equalitya on the Woooorld Wiiiiide Weeebbbbbb! Yeaah Brotha!!!

    If you are stuuupid enough to paaaaayyy! for this craap! Then we are prayin for ya, yea , we prayin fo yo'soulll. For you have fallen inta the bad mannnss hannnds! Chill! I can save ya! Just say afta me..... haich tee tee peee colon slash shash, doubleya doubleya doubleya, dot, sourceforge, dot, net. Ahhhhhmmeeennnn and Hallelullghia Brotha! Peace be wit you!"

    That was the best speech I have ever heard!!!! Vote Jackson!

    Y
  • I work for a company, that among other things, buys computer equipment from failing companies to resell it. As a bonus for moving a bunch of equipment one day, my boss let me take home a dat tape drive, and about 80 2 gigabytes tapes from the site we were on, which happened to be an accountant. Well, turns out those dat tapes i got werent new, but were the financial records for every single one of their clients starting in 1996. I had complete records of all client data for a good 4 years just because they were lazy once the hammer fell on them. My point? You trust your stockbroker? Don't. You trust your accountant? Don't. You trust anyone with info you dont want others to see? Don't. It is a harsh world, and when a company goes belly up, whether it is a magazine, a stockbroker, or an accountant, there is a good chance your data could wind up in the hands of someone less scrupulous than me. btw, those dat tapes, I pulled the tape out of the cassettes and destroyed them. it may sound like overkill, but if anything happens to one of these companies down the line, I have no interest in owning a copy of their financial information.

    Moral to the story? Basically, watch your back. If you employ an accounting firm, and they go belly up, be sure you get your records back from them. This is just one shining example I gained from experience.
  • 'Passport' is something anyone with a Postgres or mySQL database, Apache, OpenSSL and Perl could write the functional equivalent in a day.

    Sure, it's obviously been written by a huge team of programmers, carefully screened for any possible security hole and tested on a massive scale at Microsoft's fortress in Redmond.

    It's just amusing how nobody really has any confidence that the largest software company in the world can write something so basic, and get it right.

  • Single signon/login is a great idea on a secure, managed corporate network where all the applications can be trusted and crackers don't have access.

    But what kind of moron says, this is a good idea for my corporation so it must be a good idea for the entire internet?

  • by magi (91730) on Monday September 03, 2001 @09:36AM (#2247877) Homepage Journal
    I guess there must be dozens of distributed alternatives to this centralized Passport system. It would be interesting to find a nice short overview about them.

    I think a nice solution would be a kind of "PassPouch", based on public-key crypto, etc. A pouch would contain arbitrary number of passwords. To authenticate a user, a service would need your pouch password to open the pouch, and then use its site-password to authenticate a security cookie in the pouch. Well, something like this. You could have multiple pouches, and a pouch could be stored in your personal computer, or in any "PouchServer", based on for example LDAP. There probably already are such systems, but I haven't noticed any so far (I don't know much about the topic).
  • by mindstrm (20013) on Monday September 03, 2001 @12:48PM (#2248266)
    Firstly, those who say that it's GOOD to have centralized authentication like this, because people tend to be sloppy with their passwords, etc.

    Okay. On a small scale, it might make sense. This is not a small scale. This is microsoft. The Internet was not built so one company could control it; it's independent. MS is doing this to corner the e-commerce market. I don't want to let them do that. They are already free to compete fairly with everyone else.

    Regarding the comment about Windows XP product activation containing a GUID (which should scare everyeone). I refuse to buy a product that requries me to 'authorize' it's use with the company I bought it from. It's wrong. I paid for it, like a product, at the store. It's mine to use. I should not in any way have to deal anymore with the creator unless I choose to.

    Regarding Passport in general... using it for hotmail? MSN messenger? Fine. That's great. But let's not get carried away. I won't give MS my financial information, ever.
    • "Regarding Passport in general... using it for hotmail? MSN messenger? Fine. That's great. But let's not get carried away. I won't give MS my financial information, ever. "

      That's not far off. If XP is a success, and MS gets WPA accepted by the masses, there is no limit to what info they can demand for the priviledge of using the product that you bought.

      Funny, the government defines driving on roads that are paid for by my taxes as a "priviledge", and so does MS, apparently, define using software I've paid for a "priviledge".

      The funny thing about a "piveledge" is that it can be revoked... For capricious reasons.
  • ... so it will defend (the value of) it. I explained lately [slashdot.org] how I got my Passport account. Not with my consent. This is the most anti-democratic construct I've ever seen grow in the U.S.

Don't sweat it -- it's only ones and zeros. -- P. Skelly

Working...