Microsoft: Passport ID Management Far from Dead
132460
Microsoft on Thursday rushed to put the kibosh on talk that it was abandoning the single sign-on Passport identity management service.
546149
UK.gov's own facebook The Passport Office has stopped 600 fraudulent passport applications using a facial recognition system it rolled out as a pilot across its fraud units last year.â¦
692221
Anyone for an iDcard? The Home Office has tried to frighten people into taking its identity plans seriously by publishing a marketing survey it said proved their passports were easy targets for ruthless criminals.â¦
623853
Microsoft Passport Dumped By Ebay  Microsoftâs technology for identity-management on the Internet in the form of Passport took another major beating today when eBay announced that they are discontinuing their support for it. Users of eBay would not be able to use their Passport Ids to login to eBay starting late ...
742072
Microsoft has given up on trying to hawk its controversial Passport sign-on service to other companies. Microsoft&#39;s decision to shut down its Passport partner program comes after one of its largest allies
602412
(InfoWorld) - A security expert has cracked one of the U.K.'s new biometric passports, which the British government hopes will cut down on cross-border crime and illegal immigration. The attack, which uses a common RFID (radio frequency identification) reader and customized code,Â siphoned data off an RFID chipÂ from a passport in a sealed envelope, said Adam Laurie, a security consultant who has worked with RFID and Bluetooth technology. The attack would be invisible to victims, he said. "That's the really scary thing," said Laurie, whose work was detailed in the Sunday edition of the Daily Mail newspaper. "There's no evidence of tampering. They're not going to report something has happened because they don't know." The British government, which began issuing RFID passports about a year ago, eventually wants to incorporate fingerprints and other biometric data on the chips, although privacy activists are concerned over how data will be stored and handled. Currently, the chip contains the printed details on the passports, the person's photograph, and security technology to detect if those files have been altered. The attack was executed while the passport was still in its original envelope used to send it from the passport service, since RFID chips can be read from a few inches away, Laurie said. He used a passport ordered by a woman affiliated with No2ID, a group that opposes the U.K.'s biometric passport and ID card programs. The data on the passport's chip is locked until an RFID reader provides the encryption key, Laurie said. The encryption key is calculated using a combination of the person's personal data, such as date of birth, and is contained in the "machine-readable zone" (MZR) -- the string of characters and digits on the bottom of the passport's first page. At an immigration desk, the optical character reader scans the MZR and gets the key. The RFID chip is unlocked, and the information on the chip is matched with that on the passport. However, Laurie was able to do this process himself. He analyzed ICAO 9303, the standard from the International Civil Aviation Organization that been adopted worldwide for machine-readable passports, to see how the MZR is organized. Laurie also knew some of the woman's personal details -- used to calculate her passport's key -- and found out more through Internet research. He then wrote what's known as a "brute force" program, which repeatedly tries different combinations of data to discover the key. After about 40,000 attempts by the program, he cracked the key. To scan the chip, he used a common RFID reader from ACG ID, now part of Assa Abloy Identification Technology of Germany. The attack could then let Laurie begin the process of making an exact copy of the woman's passport. "[The biometric passport] has been sold to us as something that increases the security of the passport, but so far I don't see anything about it that increases my security," Laurie said. The greatest weakness with the passports is using relatively easy-to-find data to compose the encrypted key, Laurie said. It would be better to include more random elements that would render brute-force style programs nearly useless, he said. Laurie's work spawned from concern over how users can know what's on their passport's chip. "At the moment, if you want to see what's in your own passport, you have to go to passport office," Laurie said. "With my code, you can do it at home." Laurie has published a library of open-source tools written in the Python programming language that will run on RFID readers made by ACG and by Frosch Electronics, based in Austria. Â
734036
Microsoft has taken the wraps off of a new line of keyboards and mice that feature built-in biometric fingerprint recognition technology. Fingerprint recognition permits users to replace Windows passwords, log into secure Web sites and enable fast user switching. The software giant has licensed technology from Digital Persona for use in its products.
200725
Second-gen documents also 'flawed' RFID passports from Belgium remained flawed almost three years into their introduction, according to a study by cryptographic researchers.â¦
198778
Microsoft joins Concordia Project to improve interoperability among identity management systems.
3092
NEW YORK -- EBay Inc. became the latest Web site to say it will stop using Microsoft Corp.&#39;s Passport user authentication system, as Microsoft continues to scale back the service.
557878
As RFID-chipped passports gain adoption around the world, successful attempts to crack them are on the rise as well. Germany, the Netherlands and the United Kingdom have already reported compromised data, while countries such as New Zealand remain sure it can't happen there. But what if the goal wasn't data theft but detonation?
648519
Microsoft throws its weight behind OpenID, an emerging Web authentication standard.
262417
Is Open ID the glue we need? Microsoft isn't the only one taking an interest in Open ID. AOL, Yahoo! and Digg have all announced they'll accept Open ID credentials as a way of identifying users online.â¦
319695
Microsoft Corp. said on Thursday that eBay Inc. will soon drop support for its Passport service, originally intended to make the world's biggest software maker the gatekeeper of Web identities.
143364
Microsoft&#39;s Passport authentication technology lost a prominent partner this week when eBay announced that it would stop supporting customer logins through Microsoft&#39;s Passport and .
315382
EBay Inc. became the latest Web site to say it will stop using Microsoft Corp.'s Passport user authentication system, as Microsoft continues to scale back the service.
459643
(InfoWorld) - Microsoft will participate in a meeting later this month with vendors and organizations that are backing several different identity management systems, an indication thatÂ cooperation between the software giant and its peersÂ is improving. The meeting, part of an initiative called the Concordia Project, strives to improve interoperability between Microsoft's CardSpace and OpenID, two identity management systems, and protocols for identity management supported by an industry trade group, the Liberty Alliance, said Roger Sullivan, president of its management board. Vendors will hear from companies such as General Motors, Boeing, and AOL about how they're trying to integrate various identity management systems into their operations, Sullivan said. "Many of these protocols today are very geek-centric," said Sullivan, who is also vice president of Oracle's identity management section. "They're not very people-friendy." A major issue is how vendors can use different authentication mechanisms in their operations. For example, a financial planning Web site could allow users to forecast how much their retirement fund may be worth in 30 years. Eventually, the user may want to buy a service from the financial planner and migrate that same data to an environment that uses stronger authentication, Sullivan said. This means there would need to be more interoperability between the protocols used by OpenID, CardSpace, and Liberty-enabled applications. "I would more expect that we will have nuanced changes or extensions to existing protocols to enable the interoperability," Sullivan said. The Concordia Project, set up by the Liberty Alliance, hopes to release its first set of open standards by the end of the year, Sullivan said Microsoft said in February at the RSA Conference it wouldÂ integrate CardSpace and OpenID, an open-source standard for logging into Web sites. The work would help mitigate potential security risks, such as so-called "man-in-the-middle" attacks, where a hacker can intercept identity information as it's in transit to a Web site, officials said. NovellÂ is also working with Microsoft on InfoCard Selector, a so-called "digital wallet" for handling identity information. Microsoft's commitment to the Concordia project shows it has realized the importance of interoperability, said Graham Titterington, principal analyst at Ovum. "Microsoft has already come a long way in terms of 12 months ago," Titterington said. "It's not a surprising development as a year ago I think it would have been." The meeting will take place on June 26 at Catalyst 2007, an enterprise IT conference in San Francisco. Â