Universal Login Idea.

[Skybuck Flying]

Hello,

A member of the dutch goverment had an interesting idea:

"He wants to create a universal login" meaning: "People can login at
different companies, goverment sites, services/whatever, so that they don't
have to remember all kinds of different logins/passwords". Furthermore he
says it's becoming a problem... it's like digital equivalent of having a
"big bundle of keys".

I was wondering how such a system could be implemented without actually
revealing my password. Me having a littttle bit of experience with
encryption one idea which somebody else once told me... I think it was Tom
said to do the following:

Simply add some extra information to the key and then hash it. I think this
could be a good idea... it might made the key a little bit less strong.. but
so far it's the best I can quickly think of.

So this basic idea can be further expanded into the following idea:

Each company/goverment/services/whatever adds it's own text to the key. This
would need to be done at the user side. The user then supplies his key...
adds the necessary text... and hash it... this hash is given to the
goverment/company/service... each time they need it...

So from the user perspective the idea looks as follows:

User Side = Goverment/Company/Service Side:

Hash( "User password" + "Company Name" ) = Stored Hash.

Now for a real world example:
(I would prefer the tiger hash but ok maybe stronger hashes out there ;))

User Side = Goverment/Company/Service Side:

SomeHash ( "MyGreatPassword" + "DutchGoverment" ) = 46546465khgkwhertgkwherk
SomeHash ( "MyGreatPassword" + "GreatCompany" ) = hfhertyertyer45678901234
SomeHash ( "MyGreatPassword" + "GreatService" ) = dhh465herh4747herht47546

This way only I know the real password... the goverment/companies and
services only know the hashes that come out of it...

So they can compare that against what I supply... if it matches they know
it's me/the real thing !

Seems like pretty good idea to me...

What you encryption and/or hashing experts think of it ? ;) :)

This idea could also be expanded to websites and e-mail and simply
everything... but then I would become a little bit worried about what
happens if somebody gets hold of all/many of the hashes... then maybe it
could become a little bit more easy to reverse the hash and discover the
password + text ?!?

So far I already like this idea better then just providing a real password
to a website... since that might leak information about my kind of
passwords... and maybe even other information... ;)

Also let me/us (:)) know if you have any other much better idea's for a
universal login ! ;)

Bye,
Skybuck.

[Skybuck Flying]

To implement this in reality a little protocol could be
established/implemented.

It could work as follows:

All websites that require a universal login could implement the following
"keywords"/"html"/"xml"-like text:

<UniversalLoginInformation>
<UniversalPasswordExtraText>GreatCompany</UniversalPasswordExtraText>
<UniversalPasswordHashMethod>Tiger192</UniversalPasswordHashMethod>
</UniversalLoginInformation>

This text would be embedded into the website/html.

Then when the user wants to login... this information is used by the browser
to perform the hashing of the "universal password" of the user.

So first the browser asks the user for his/her "universal password" which in
my case was my fictional example:

"MyGreatPassword".

The browser then checks the "Universal Password Hash Method" to see if
"Tiger192" is still considered a safe and secure hash method.

If so then the browser simply performs the hash:

TigerHash( "MyGreatPassword" + "GreatCompany" ) = UniversalLoginHash

(without the "")

The UniversalLoginHash is what is sent back to the
webserver/company/goverment which they can/have store/stored in their
databases... to compare against...

If required this "sending back" could again be done via html/xml-like text:

<UniversalLogin>
<UniversalLoginUsername>Skybuck</UniversalLoginUsername>
<UniversalLoginHash>hfhertyertyer45678901234</UniversalLoginHash>
<UniversalLogin>

Optionally the UniversalLoginInformation could be sent back as well for
extra verifications or to support multi-service logins...

So the company or service can check to what service the user wanted to login
to....

If the "universal login hash" matches the one stored in the database then
the user is considered to have logged in successfully.

Bye,
Skybuck.

[David E. Ross]

Post by Skybuck Flying
To implement this in reality a little protocol could be
established/implemented.
All websites that require a universal login could implement the following
<UniversalLoginInformation>
<UniversalPasswordExtraText>GreatCompany</UniversalPasswordExtraText>
<UniversalPasswordHashMethod>Tiger192</UniversalPasswordHashMethod>
</UniversalLoginInformation>
This text would be embedded into the website/html.
Then when the user wants to login... this information is used by the browser
to perform the hashing of the "universal password" of the user.
So first the browser asks the user for his/her "universal password" which in
"MyGreatPassword".
The browser then checks the "Universal Password Hash Method" to see if
"Tiger192" is still considered a safe and secure hash method.
TigerHash( "MyGreatPassword" + "GreatCompany" ) = UniversalLoginHash
(without the "")
The UniversalLoginHash is what is sent back to the
webserver/company/goverment which they can/have store/stored in their
databases... to compare against...
<UniversalLogin>
<UniversalLoginUsername>Skybuck</UniversalLoginUsername>
<UniversalLoginHash>hfhertyertyer45678901234</UniversalLoginHash>
<UniversalLogin>
Optionally the UniversalLoginInformation could be sent back as well for
extra verifications or to support multi-service logins...
So the company or service can check to what service the user wanted to login
to....
If the "universal login hash" matches the one stored in the database then
the user is considered to have logged in successfully.
Bye,
Skybuck.

Something like this is already implemented in Gecko-based browsers
(e.g., Firefox, SeaMonkey, Camino).

Gecko-based browsers have a Password Manager that stores user IDs and
passwords in an encrypted file. The encryption is symmetric; the same
key encrypts and decrypts. For the Password Manager, the key is called
the "master password"; however, a passphrase (with spaces, punctuation,
etc, as used for PGP) can be used. While the user IDs and passwords are
encrypted and saved on my computer, the master password is recorded only
in my brain.

When I use an ID and password for the first time, the Password Manager
asks if I want to save it. If so, I must first enter the master
password. The password manager then saves the user ID and password with
the domain of the Web site requiring a logon. The next time I go to
that site, the Password Manager request the master password and then
enters my ID and password in the appropriate input areas. (A few Web
sites have been coded to block this automatic entry.) If I have more
than one account at a Web site, the Password Manager gives me a
selection list of IDs (not passwords); when I select an ID, it and its
related password are then entered in the input areas of the Web page.

I can display a list of Web sites and my user IDs, but I must first
enter my master password. If I also want to see my passwords, I must
enter my master password a second time. I can delete entries from the
list, but I cannot edit any entries.

Thus, I generally need only to remember my master password while having
a different password for each Web site login.

[Skybuck Flying]

The problem goes beyond the local/computer webbrowser.

The guy from the goverment also wants to be able to login from mobile
phones, laptops and any other device.

So the firefox solution doesn't solve this problem.

Furthermore what happens if the computer is formatted then firefox would
loose all passwords.

So the firefox solution is a bad solution !

Bye,
Skybuck.

[Gordon Burditt]

Post by Skybuck Flying
"He wants to create a universal login" meaning: "People can login at
different companies, goverment sites, services/whatever, so that they don't
have to remember all kinds of different logins/passwords". Furthermore he
says it's becoming a problem... it's like digital equivalent of having a
"big bundle of keys".

I don't WANT a universal login. Using it often means you have to use
it all the time, and this makes the chances of an over-the-shoulder
compromise more likely. And if it is compromised, it turns a serious
situation into the ultimate disaster. That goes especially if the
shoulder-surfer can change the password once and it's made effective
EVERYWHERE, locking you out of your entire life all at once.

Although it's ill-advised anyway, it also lets out (or makes much
more dangerous) emergency password sharing. In an emergency, I
*might* give a trusted relative the keys to my bank account for the
purpose of bailing me out of jail or handling things while I recover
from an accident in the hospital. Or perhaps I'd hand a co-worker
a credit card to get his car fixed. Then I change the password
later. It would be *MOST* dangerous if that had to give access to
*ALL* of my bank accounts, government tax returns and benefits
accounts, etc. (Ever hear of people living with a corpse for 10
years because they can and did continue to collect that person's
pension?) I might trust relatives, but it's not an unlimited trust.

Post by Skybuck Flying
I was wondering how such a system could be implemented without actually
revealing my password.

The reality of this is that you are revealing your password by
entering it into a piece of equipment you do not own, say, one of
those swipe card terminals at a store, or a public computer at a
library or airport, and you've got no idea whether it is rigged to
log passwords, by either the company that owns the thing or some
identity thief that tampered with it. (Rigged ATMs that log PINs
have been discovered.) *IF* it's properly implemented your password
won't be recorded. You don't know that. And a universal login is
a *BIG* target.

Post by Skybuck Flying
Me having a littttle bit of experience with
encryption one idea which somebody else once told me... I think it was Tom
Simply add some extra information to the key and then hash it. I think this
could be a good idea... it might made the key a little bit less strong.. but
so far it's the best I can quickly think of.
Each company/goverment/services/whatever adds it's own text to the key.

A dishonest company might choose its text to be 0 length.

Post by Skybuck Flying
This
would need to be done at the user side.

The boundary between the user and everything else is between the
user's fingertips or hand and the keyboard or mouse.

Post by Skybuck Flying
The user then supplies his key...
adds the necessary text... and hash it... this hash is given to the
goverment/company/service... each time they need it...

Now please explain how a password is changed. Do you change it
everywhere in one shot? How? This might risk revealing where all
your accounts are. Government tax authorities would love that.

Post by Skybuck Flying
Hash( "User password" + "Company Name" ) = Stored Hash.

Users don't hash passwords, computers made by potentially evil
corporations possibly infected by evil viruses hash passwords with
software written by potentially evil corporations or corrupted by
evil viruses or evil governments.

Post by Skybuck Flying
(I would prefer the tiger hash but ok maybe stronger hashes out there ;))
SomeHash ( "MyGreatPassword" + "DutchGoverment" ) = 46546465khgkwhertgkwherk
SomeHash ( "MyGreatPassword" + "GreatCompany" ) = hfhertyertyer45678901234
SomeHash ( "MyGreatPassword" + "GreatService" ) = dhh465herh4747herht47546

I'd like to suggest that the passwords be much longer and that the
hashes be much, much longer. You haven't said anything about "user
names" to go with passwords. If the passwords stand alone for
authentication *AND* identifying an account, a collision is a
disaster, so I suggest the hashes be at least a few megabytes.
(Someone please calculate how big a hash has to be to have
one-in-a-billion probability of *any* collision between any two of
{population-of-the-earth} hashes. Now extend this to the number of
people expected to be alive at any point in the next 100 years.

Post by Skybuck Flying
This way only I know the real password... the goverment/companies and
services only know the hashes that come out of it...

Please explain how you are sure of that. If you computed the hash with
pencil and paper, entered the hash, and disposed of the paper properly,
maybe you're OK. If you didn't make a mistake and lock yourself out.

Post by Skybuck Flying
So they can compare that against what I supply... if it matches they know
it's me/the real thing !
Seems like pretty good idea to me...

Does "don't put all your egg(head)s in one basket" suggest a problem with this?
There are reasons why people like to carry at least two independent
credit cards with them when on a long trip, plus maybe a checkbook and
some cash.

Post by Skybuck Flying
What you encryption and/or hashing experts think of it ? ;) :)
This idea could also be expanded to websites and e-mail and simply
everything... but then I would become a little bit worried about what
happens if somebody gets hold of all/many of the hashes... then maybe it
could become a little bit more easy to reverse the hash and discover the
password + text ?!?
So far I already like this idea better then just providing a real password
to a website... since that might leak information about my kind of
passwords... and maybe even other information... ;)
Also let me/us (:)) know if you have any other much better idea's for a
universal login ! ;)

Universal identity theft?

[Xavier Roche]

Post by Gordon Burditt
The reality of this is that you are revealing your password by
entering it into a piece of equipment you do not own, say, one of
those swipe card terminals at a store, or a public computer at a
library or airport, and you've got no idea whether it is rigged to
log passwords, by either the company that owns the thing or some
identity thief that tampered with it. (Rigged ATMs that log PINs
have been discovered.) *IF* it's properly implemented your password
won't be recorded. You don't know that. And a universal login is
a *BIG* target.

A possible solution which was tested in some places is to authenticate
using a small device you always carry, and delivering a certificate to
devices requesting authenticating. Hence whether the device is
trustworthy or not, it does not matter.

The "small" device can be a piece of mini-keyboard and mini-screen with
minimalistic cryptographic processing on it, exchanging the
request/response using IR or radio. -- A GSM phone is a good example
(cryptographic features, that can be secured on a SIM card with a PIN
number or equivalent, a screen/keyboard, and IR/radio/bluetooth feature
to exchange data -- _AND_ something you always carry with you anyway).

But still, if someone steal this device, and its associated password,
you're screwed. OTOH, you may quickly release a pre-built revocation key
stored elsewhere, but anyway the risks are probably too high.

[Skybuck Flying]

Ok,

I am going to sum up your critique here for overview:

1. Over-the-shoulder-compromise.
2. One compromise could mean everything compromised.
3. Once compromised changing your password would look you out of everything.
4. Emergency password sharing becomes much more dangerous.
5. Entering password on untrusted devices could lead to compromise.
6. Universal login is a big target.

(Text length 0 would not really be a problem because it only affects that
company and any other companies which choses to do so, which is mostly there
problem... it will not reveal the hashes of the other companies which use
longer text lengths.)

However I shall add some of my own critique at point 7:

7. The extra text could be spoofed to get the hash.

8. Changing password would go as it normally goes, you will need to change
the password at each site... to inform them of the new hashes.

9. User names could be added to the hash calculation to make it more unique
like so:

Hash( Username + Password + Extra Text ) = UniversalLoginHash

Example:

Hash( "Skybuck" + "GreatPassword" + "Usenet" ) = ke7495jgufo4023896kdmvj2

10. Calculations need to be done how likely a collision would be. Collisions
are probably not really a problem, the username field can be used to
identify between users, unless a hacker starts to brute force every possibly
combination then collisions might be found so it's important question ;)

11. Hashes of at least a few megabytes would be inpractical and probably
unnecessary.

12. Websites could set the hashes themselfes when you try to create an
account and thereby lock you out from the start ? (Spoofing)

13. Universal identity theft.

Ok now I shall try to address some of these for solutions but ofcourse not
all can be solved.

1. A digital key device could be used to prevent over the shoulder looking.
2. Remains a problem.
3. Remains a problem.
4. Remains a problem.
5. Could be solved by digital key device.
6. Remains a problem.
7. Remains a problem.
8. Solved.
9. Wasn't really a problem.
10. Unanswered.
11. Unnecessary.
12. Could be a problem.
13. Big problem.

There are clearly many problems with the Universal Login Idea.

For now I am conviced it is a bad idea. But for what it's worth here is one
more idea for the digital key device idea:

The hash itself could be used as the symetric encryption key between the
website and the digital key device.

Therefore the communication with the digital key device does not have to be
secure. Because the symetric encryption will take care of that...

However if the symetric encryption is weak or gets broken then this could
become a problem as well.

I would like to thank "Gordon Burditt" for shining his light over this and
taking the time and energy to examine this idea ;)

Also a little thanks goes out to Xavier Roche for mentioning the external
device idea.

And also the other little critters in this usenet thread for mentioning "The
Big Brother" is watching you threat :)

Bye,
Skybuck.

[P.]

On Sun, 17 May 2009 02:19:47 +0200, "Skybuck Flying"

Post by Skybuck Flying
Hello,
"He wants to create a universal login" meaning: "People can login at
different companies, goverment sites, services/whatever, so that they don't
have to remember all kinds of different logins/passwords". Furthermore he
says it's becoming a problem... it's like digital equivalent of having a
"big bundle of keys".

Yes, I think that this is a GREAT idea. This makes it possible to
regulate everything. And we can check everybody, and see all
information of everybody.

So this really is needed.

And oh yeah, I see that your forgot to pay the parking ticket of last
month, please do that now. And you have taken more showers than
avarage. And I would suggest an alternative for those erection pills
you take. They are not good for you because your blood pressure is too
high. No, not now, but it will soon be after we implemented your login
system.

Thank you for your coorporation,
your good friend Big Brother.

[Solbu]

Post by Skybuck Flying
"He wants to create a universal login" meaning: "People can login at
different companies, goverment sites, services/whatever, so that they don't
have to remember all kinds of different logins/passwords".

This already exists, OpenID.
It was invented in 2005 and already have over 500 million users.

http://en.wikipedia.org/wiki/OpenID
http://openid.net/

- --
Solbu - http://www.solbu.net
Remove 'ugyldig.' for email
PGP key ID: 0xFA687324