{"id":790,"date":"2009-10-11T19:41:43","date_gmt":"2009-10-11T17:41:43","guid":{"rendered":"http:\/\/www.ofcourseimright.com\/?p=790"},"modified":"2009-10-11T19:41:43","modified_gmt":"2009-10-11T17:41:43","slug":"a-lesson-in-transitive-trust","status":"publish","type":"post","link":"https:\/\/ofcourseimright.com\/?p=790","title":{"rendered":"A lesson in transitive trust"},"content":{"rendered":"

\"Cybercrime\"Growing up in the New York area in the 1970s, one never really paid attention to all the crime that occurred.\u00a0 There just was so much of it.\u00a0 Even when I lived in California, while a murder would make the local news, it wasn’t something that would shake the community.\u00a0 A murder in the Z\u00fcrich area, however, is rare.\u00a0 Maybe it’s because everyone has a gun, as my friend Neal might say.\u00a0 Who knows?\u00a0 The point is that people here are not inured to that level of violence.<\/p>\n

Now we are discovering the online version of that.\u00a0 When last we left our situation, we were trying to figure out how best to protect ourselves from evil bad guys by limiting the damage dumb passwords can do.\u00a0 Since then, it has been widely reported that 10,000 Hotmail account passwords were stolen<\/a>.\u00a0 But they weren’t the only ones.\u00a0 Many of the people who use Hotmail<\/a> accounts also have GMail<\/a> and Yahoo!<\/a> accounts, and many of those passwords are the same.\u00a0 Why?\u00a0 Because humans don’t like having to remember lots and lots of passwords.\u00a0 And of course, if you were one of those people who used the same password between both and<\/em> linked your Yahoo or GMail account to Facebook, that means that your Facebook account could have been compromised as well.\u00a0 And that means that your friends may have been attacked, as we previously discussed<\/a>.<\/p>\n

How could this be worse?\u00a0 Let’s add Paypal into the mix.\u00a0 If you use the same password for eBay as you used for Yahoo!, now all of a sudden, you have invited someone to empty your bank account.\u00a0 Had Paypal<\/a> implemented an OpenID consumer for login, an attacker wouldn’t even need your password.<\/p>\n

Now let’s aggregate all of the people who do that.\u00a0 The popular OpenID providers include Google, Yahoo, and Verisign.\u00a0 As the number of providers increases, the concentration of risk of any one single failure decreases.\u00a0 Concentration of risk is a fancy way of saying that one is putting all of one’s egg in one basket.\u00a0 On the other hand, from the perspective of a web site that uses OpenID or some other federated mechanism such as SAML, the information received from any random Identity Provider (IdP) could reasonably be considered suspect.<\/p>\n

This leads to a few conclusions:<\/p>\n