Feeds

Microsoft integrates OAuth 2.0 in play for Facebook goodness

Single sign-on trend hooks up Windows Live dev platform

Security for virtualized datacentres

Will short term gain lead to future pain?

However, one of the editors of the original OAuth protocol has previously expressed security concerns about version 2.0 of the open authorisation standard.

"As long as a site offers both an OAuth API and a human web interface (i.e. a website), the overall service will only be as secure as its weakest part - the cookie-based authentication system," wrote Hammer-Lahav on his blog last September.

Fujitsu's social robot teddy bears

Cuddle time

"The problem with this argument is not today, but five years from now. When trying to propose a new cookie protocol, developers will make the same argument, only this time pointing the finger at OAuth 2.0 as the weakest link.

"Removing signatures and relying solely on a secure channel solves the immediate problem, and maintain the same existing level of security. But it lacks any kind of forward looking responsibility, and the drive to make the web more secure. It’s a copout."

Meanwhile, Cameron - who left Microsoft's cryptography team last month - has similarly aired concerns about current industry trends on ID.

He has called for an advocate to champion his "user-centric identity" approach, which is about keeping various bits of an individual's online life totally separated.

"[That model] can be much more effective than shotgun splattering of ads or profiling that alienates us and makes us feel like robots are ruling our lives. Lots of people are upset about this," said Cameron in May. He used Microsoft, Google and Facebook as examples of companies pursuing those strategies.

Perhaps worryingly for some privacy activists, that trend doesn't appear to lie simply within the corporate sphere.

As we revealed last week, the UK government's Cabinet Office has been in talks with various social networks about the possibility of allowing British citizens to sign into public services online in an effort to simplify the process, by farming out the logon authentication process to a third party partner such as a bank or, more surprisingly, Facebook. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.