PoisonedV said:
javaJake said:
PoisonedV said:
Glenn: maybe you could say something insightful instead of quoting half assed articles and blog posts?
If you have something against the articles he wrote, you should specifically point them out instead of just throwing insults at it. This sort of talk can easily anger someone.
Edit: Though I agree that the list of links look like something he just Googled up without reading. None of us have the time to read it, so it'd be much better if he could sum them up instead.
i read most of them. it was almost all bunk, aimless lectures about "single sign" THEORY. none of it really proves that its secure or that it would work well for the forums and wiki. just people trying to get money for their grant.
My experience is that SSO is much better from a security point, because you can demand a better password policy centrally, instead of easy guessable junk password.
With non-SSO, users seldom change password because you use a lot of energy to change them. If one of the systems are down, that password can not be changed on that system. Then the user need to remember two passwords - and which system that is lacking password change. :wacko:
The user also need to know which username goes with which system. :wacko:
Again - from a security point of view it is a disaster, because users WILL use easy guessable passwords.
(It is simply incredible that I need to point this out. :huh: )
More info:
White paper:
SSO Over the Internet:
The CISO’s Misperceptions and Realities:
http://download.101com.com/pub/spo/file ... ePaper.pdf
"...What we learned was surprising: many of the survey participants share three common misperceptions about secure Internet single sign-on (SSO). This paper identifies those misperceptions and provides clarifications to help readers understand the realities of delivering secure Internet SSO by deploying federated identity management.
...
Misperception #2: Internet SSO Is Not Secure
...
Reality #2: Standards-based Internet SSO is Secure
From an identity management perspective, the most cost-effective way to increase security is to centrally manage credentials, add strong authentication and provide SSO that leverages that strong authentication mechanism both internally, for legacy applications, and externally over the Internet.
Although a centralized point of access can be a point of attack, the truth is that today users have many passwords to access different applications, and each is vulnerable to attack. SSO eliminates the requirement for a login page for every application, thus reducing the login frequency and opportunity to expose usernames and passwords.
Internet SSO software that leverages proven standards, such as SAML and WS-Federation, relies on mature security and peer-reviewed standards.
..."
PvIB Expert Letter – March 2007
ISSN 1872-4884, Volume 3 – No. 1
March 2007
Single Sign-On for Organisations:
https://www.pvib.nl/download/?id=6259832
Quote: "...
Each of these problems is an argument in favour of SSO. Despite these serious disadvantages, the old situation also has a few advantages:
...
Although these disadvantages generally do not outweigh the advantages of SSO, they are important points for any SSO project.
..."
RSA, the RSA logo, SecurID, Confidence Inspired, IntelliAccess and ClearTrust are either registered trademarks or trademarks of RSA Security Inc. in the United States and/or other countries. All other products and services mentioned are trademarks of their respective companies.
© 2005 RSA Security Inc. All rights reserved.
SSO WP 0505.
Single Sign-on: Putting an End to the Password Management Nightmare:
http://www.imerja.com/files/file/White% ... n%20On.pdf
Quote: "...
I. BUSINESS CHALLENGES: THE MULTIPLE PITFALLS OF MULTIPLE PASSWORDS.
While password usage and multiple password management are widespread in organizations today, there are several drawbacks associated with this scenario. Repeated studies show that being burdened with managing several passwords for several applications, with intermittent password changes needed for each application, inevitably lead to high help desk costs, end-user frustration, poor compliance, lower security and a myriad of other repercussions that are not conducive to good business performance.
...
Compromised Security
Organizations supporting dozens of distributed password systems find that it is not only costly to administer this infrastructure, but that it is also a significant security threat.
...
II. SINGLE SIGN-ON: A DRIVER FOR BUSINESS EFFICIENCY AND GROWTH
...
Enhanced Security
SSO solutions can greatly reduce the number of passwords that an end-user has to remember, thereby enabling the use of one strong (and complex) password that is difficult to guess and increases the level of security for critical business information and corporate identities. When an end user has to remember several passwords (often more than 20 !), they usually pick simple, obvious ones that can easily be guessed by an attacker.
..."
Single Sign-On
http://www.terena.org/activities/euroca ... ilmore.ppt
)
