You know you're late when...

Earlier this week, a computer glitch in United's sysytem caused hundreds of flights to be delayed or canceled. As my luck would have it, I was caught up in the delays. My flight was one of the last flights from San Francisco to Portland and was supposed to arrive at 11:59 that night. The arrival was delayed until around 2:15 AM and I didn't arrive at my hotel until after 3AM.

This was made worse by the fact that the previous night, my flight from Dulles to San Francisco was delayed by close to 3 1/2 hours by thunderstorms in the Dulles area (causing that 5 hour flight to be 8 1/2 hours as they didn't start the ground hold until we were already loaded onto the plane). Luckily, it was an internationally configured 777 and I had upgraded into business class, so at least it was comfortable.

I really knew I was late getting to my room at the hotel when I found that my USA Today for the next day was already delivered to the room.

Tags : travel / UAL / United / dulles / IAD / SFO / PDX

Updated Liberty Open Source

I've updated my Liberty ID-WSF Open Source implementation for both the server side and client side to include support for much of the the Advanced Client Provisioning Service specification.

The Advanced Client Technologies Overview is a good starting point for understanding what we're trying to do with the advanced client specs.

This release also includes some updates/fixes in the basis ID-WSF support.

Have fun!

Tags : identity / liberty / Liberty Alliance / Open Source / ID-WSF / Provisioning / Advanced Client

Concordia Schmordia

Next week, I will sit on a panel with Mike Jones of Microsoft and David Recordon of VeriSign. This panel will be a part of day spent on the subject of the Concordia Project.

One might ask, "What's Concordia?" and I, of course, would respond that that's a good question. My recollection (questionable, I know) of the sequence of how we got to where we are is as follows: The name originated in an earlier internal project at the Liberty Alliance where a number of us were examining potential paths towards convergence with the other technologies/protocols in the identity and web services space. Eve Maler can be blamed for the name as she brought it up given that Concordia was the Roman goddess of agreement, understanding, and marital harmony (not that any of us were getting married to each other) -- which, theoretically, is what convergence is about.

Anyway, as we moved forward on the project we eventually figured out that doing this ourselves would likely be a waste of time (why would anyone else listen to us). If we really wanted to talk about convergence we needed to bring the other players to the table. That led to more deep thinking (and perhaps a few visits to the neighborhood psychologist) and the eventual realization that many of the differences in the current approaches had to do with different use cases and with looking at the problem from different points of view.

So, here we are. Trying to organize an effort to bring together people interested in this space so that we can discuss our respective use cases and understand the problems that need to be solved. Liberty has tried to be very careful and very clear that this isn't a Liberty effort, but an industry effort (which Liberty supports). My hope is that we can use this common understanding to drive towards common protocols, features and capabilities so that those trying to use our stuff will have an easier time integrating with the rest of the world.

So come join us for the Concordia day at the Burton Catalyst Conference. At the minimum, it should be fun (though without Dick Hardt on the panel, I won't have someone to pick on :-)). The Concordia sessions are free, you just need to register here.

I look forward to seeing you all there!

Tags : identity / Liberty / Liberty Alliance / Microsoft / Verisign / Burton Catalyst / Concordia

Business traveler Magazine

Partly from some of my writings here about my frequent trips on United, I was interviewed for this article in Business Traveler Magazine. Of course, the picture in the article was not a picture of me -- I think it might be Britta, there's some resemblance or, perhaps, that's just wishful thinking :-).

I should also point out that I wasn't the one to find the article. My sister, Theresa, was looking for our family web page (where I put up family photos) on google and she found the article and told me about it. Yes, I knew it might be coming at some point, but wasn't aware it was published. Now if I could only get a print copy to hang onto :-).

Tags : United / travel / Global Services / Business Traveler

Annual Credit Reports

Not sure what brought this up now, but for some reason I thought to go get the "free" annual credit reports that we are entitled to here in the US at least once every year. I started with AnnualCreditReport.com (the central clearing house setup by the 3 major credit reporting agencies) which asked me for the standard credit information (name, ssan, address, dob, etc.).

Once I entered that information they prompted me to select which of the 3 agencies I would like to review the report at (yes, you can select multiple). I selected all 3, but now, after thinking about it, perhaps I should have selected one only and rotated around the 3 agences throughout the year -- that way I can get a new checkup every 4 months rather than only one per year -- Oh well).

The web site then forwards you to each of the agencies where you will go through a different process at each of them to further verify your identity and get access to your credit report. My experience at each of them:

• The first agency I was sent to was TransUnion where I had to create an account in order to get my report. I was then prompted for 2 account numbers (which I had to go find) and then the tried to upsell me a copy of my credit score for $7.95 before they would let me see my credit report. When I was done, the process had taken so $#@%ing long that my session at AnnualCreditReport.com had expired and I had to start all over for the remaining two agencies.
• On to Equifax, where they wanted to know which provider I opened an account with in 2005 and what was the payment (much easier to deal with), then they too wanted to upsell me my credit score for $7.95. No need to create an account. Got my report and printed it.
• And, finally, Experian ((the last of the 3). This time, I went back to AnnualCreditReport.com fairly quickly, so no need to re-enter all of my information. Experian started with verification of my ssan (last 4 digits), then they asked for verification of 2 accounts (who gave me a mortgage at a particular time and who gave me an auto loan at a different particular time) as well as the name of the county in which I live. Poof. I got to see my credit report. No need to create an account, no attempt to upsell me with the credit score (at least not as an intrusive click-through step -- it may have been there somewhere else on the page that I just ignored).

Moral of the story.... be tenacious and make them give you a copy of your report -- it IS free (as long as you don't fall for the upsell). Unless you think you have been a victim of identity theft, I would stagger the reports from each agency as many of them carry the same information as the others and this kind of gives you better coverage over the year (there's a lot someone can do in the 12 months between your annual reviews if you do all 3 at the same time).

Tags : identity theft / credit report / free credit report / Experian / TransUnion / Eqiuifax / AnnualCreditReport.com

The Combo

Paul must be getting a little hard up for cash nowadays as he seems to be out moonlighting.

Dick and Conor

Today, at the European Identity Conference, Dick Hardt and I (as well as several others) participated in a panel on user centric identity in the enterprise. As I had suspected it was a fun session with lots of back and forth and a very interested audience.

What amazed most people who know us was that we actually agreed on several issues and Dick was quoted at least twice as saying something along the lines of "As amazing as it seems, I agree with Conor on this" and we even shook hands once (luckily no one in the audience had their camera ready for the historic moment).

The kinds of things we agreed on included:

• Users should be able to control the use and dissemination of their data.
• Users should be able to allow an agent (local or perhaps in the cloud) that can interact on their behalf in between authoritative issuers of attributes and relying parties.
• Users should be able to allow direct access from some relying parties to some issuing authorities (specific example discussed was around someone accessing my calendar service to add an appointment).
• Strong authentication is separate and distinct from strong identification.

We only had an hour on the panel and could have easily gone on for another hour or two with a very participatory audience.

Tags : identity / user centric / federation / eic2007 / enterprise

April... an unusually quiet month...

I just noticed that last month, I only wrote 6 blog entries (Paul frequently hits that number in a day)... My slowest month in a long time.

This wasn't about a lack of things to write about -- there's more than enough stuff going on out there that is clearly calling out for my essential input :-). My lack of posting has been because my free time (what little there is) has been taken up by the updating of my Open Source Liberty ID-WSF implementation to have some of the functionality documented in the new Advanced Client specifications.

No, it isn't done yet, but I just had to take a breather and do something fun like post a blog article about not blogging. I'm sure Paul will find some higher meaning in my doing so :-).

But, no worries, the interoperability event is scheduled for the first week of June in Dulles, Virginia (yeah, that's a real place, not just an airport -- although the airport was first). I should have my head above water by then.

In the meantime, I'm off to Munich to participate in the European Identity Conference hosted by Kuppinger Cole. I'll be in 3 sessions there:

• A panel (Identity Federation and User-Centric Identity – How will it affect Business and IT Infrastructures) with Dick Hardt, André Durand (Ping Identity), and Jörg Heuer (Deutch Telecom). I don't think I know Jörg, but there's usually lots of fun when Dick and I are in the same room at the same time :-).
• A presetnation session (Identity Capable Platform) where I will talk about some of the research work done in the area of client based identity, a joint POC between Intel, British Telecom, and HP, and the latest Liberty Alliance Advanced Client specifications.
• A tutorial session (Implementing Secure Liberty Alliance Web Services)with John Kemp (Nokia) and Sampo Kellomäki (Symlabs) talking about developing secure web services.

It should be a fun week! I hope to see many friends there.

Tags : blogging / identity / Liberty / ID-WSF / Liberty Alliance / SXIP / BT / HP / Nokia / Symlabs / Advanced Client / Ping Identity

Anonymous identity

Paul writes in "Identity as Relationship Precursor":

This is interesting because it seems the exact opposite of most use cases in which identity attributes are shared (and those that Liberty ID-WSF has historically focused on). In these use cases, interaction comes first. The user shows up at a service provider and, in order to provide some enhanced level of customization, the service provider seeks to obtain identity. The model is

Interaction --------------> Identity Sharing

I'll argue that current identity systems (OpenID to a lesser extent, albeit not spec'd out) are geared to the latter model, what are the implications of the former?

Au contraire Monsieur Madsoooooon, we considered the both use cases and specifically designed the anonymous release of attributes around the case where the user gave away some bits of information in order to get a better experience at a target entity without giving away their identity nor creating a federation to their identity (which they could, of course, do later if desired).

The common discussion around anonymous identity was, for example, releasing your zip code out of your personal profile to anybody so that when you showed up at a movie web site, they could automatically display the movies that are showing in theaters in your area.

Tags : identity / liberty / Liberty Alliance / anonymous

A knife... a real knife... like the metal kind

Last night, on my United flight from Dulles to Portland, with the 1st class dinner, I was given the typical cloth napkin with the cutlery rolled up inside. When I unrolled it, I found the normal 2 metal forks and a metal spool as usual. However, instead of getting the little silver plastic knife that I've gotten since 9/11, I was given a real, metal knife (pictured, quite badly, to the left).

I looked to the left and right to see if the other passengers were also getting a metal knife -- they were, so it wasn't some accidental fluke.

I presume the FAA has removed the restriction on metal knives -- something long past due as they airlines have had bulletproof (not just knife-proof) doors on the cockpit.

Tags : travel / faa / united

When is a rebate not a rebate?

When I purchased my cool Samsung Blackjack phone, Cingular had a rebate program in place offering a $100 rebate if you bought the phone and signed up for the data package.

I took them up on the offer, followed all the directions and sent in my rebate form the next day. This is the step that the cynical Conor (me) believes they hope you won't do (so they get the benefit of offering the rebate without having to give you the cash -- and it's your fault since you didn't follow through). Of course, being the pedantic person that I am, I *always* fill in the form and send it in just to make sure they pay up.

Well, today -- approx 6 weeks later, I receive the "the rebate". I was expecting to receive a check like any other rebate program that I've ever participated in. A check that I could exchange for cash at my local bank, or just deposit into my account.

However, that wasn't to be. Cingular sent me a "Rewards Card". This is a Visa debit card that supposedly carries the value of my rebate.

Perhaps I'm over-reacting, but I'm not at all happy with this. In fact, I'm downright pissed. This is some form of bait-and-switch that should be illegal. When you offer a rebate to your customer, you should provide them with a CASH rebate, not a debit account that they somehow have to figure out how to use.

For the smart ones out there who were thinking, just use the card to get cash -- no dice. I thought the same thing, but alas the rules include:

Your card is valid only in the U.S. and may not be used for cash withdrawals or at any cash dispensing machine.

It's even invalid at the gas pump. If you want to use it to pay for gas, you have to go inside the station and wait in line.

And, of course, it expires in a relatively short period of time.

What are the problems with this debit card model?

• Cingular hopes that this is another deterrent for the user getting the full value of the rebate. At the minimum, it will slow down the transfer to cash to the user as the user finds ways to make use of the debit card until it is used up.
• Most facilities are not setup to allow you to mix multiple payment methods, especially online merchants. This means that to get the full value, you have to find a collection of things that add up to the exact amount of $$ on the card (the card even prohibits you from adding $$ to increase it's value up to a value you would want to spend.
• Cingular hopes that nobody will be able to use up the exact amount ($100 in my case) and so they will profit from the remaining cents left on the card. The only way to totally use it up is to find a friendly merchant who will let you use multiple cards on the same purchase).
• I'm sure there's some slice of the transaction fee paid by the merchant that somehow makes it into Cingular's pocket (yes, cynical Conor strikes again).

In fact, as I was writing this blog entry, I went to Amazon to try to use up the entire value of the card right away. However, I ran into that "single card" problem for a purchase (so my $100.75 purchase wouldn't work as it was 75 cents over the value of the card). I ended up spending $92.86 of it (just couldn't find something worthwhile to purchase for $7.14 and so I have to remember the card and the amount so that if I do end up making a purchase again, I can use up the rest of it... Perhaps some candy at the local grocery store).

Can you tell that I really hate the idea of this bait-and-switch reward card vs getting the rebate check? Cingular you should listen up -- this is the kind of thing that Elliot Spitzer likes to go after.

Tags : Cingular / rebate / ripoff / Visa / Samsung / BlackJack / Spitzer

Gadget of the week #11

I've finally upgraded my "old" Motorola Razr (which I had been pretty happy with) and found the first Windows Mobile based phone that I actually like. I've tried several other WM phones including the Motorola MPx200 and MPx220, as well as an iPAQ H6315, but my new phone puts them to shame.

So, what did I buy? The Samsung Blackjack.

It took me a while to decide on which phone... I've looked at a number of them over the past few months and decided on the Blackjack for several reasons including:

• It's on my provider (Cingular) so I don't have to pay the premium for an unlocked phone without subsidy.
• Its small and light, but still has a full qwerty keyboard (though my big fat thumbs are still getting used to it).
• It has data push available for email so I can set it up to get email from work (haven't done so yet, but one of my compatriots at Intel has gotten this done).
• It felt nice in my hands.
• I got it for a good price!

I've been very happy with it since I bought it. It's worked pretty much anywhere I've tried even internationally (though there's an update for it that I've yet to load that is supposed to fix problems with some international access).

Of course, once I bought it I had to go and get the typical set of accessories. I started with a belt clip leather case. I bought the one from Cingular since I wanted one right away (though since it had a plastic clip, I knew it wouldn't last long) -- then when I got home ordered a good one. My case of choice for any device is the case made by Nutshell. They claim their cases are "tough as nuts" and they are. I've had several for different devices and they have never broken in any way -- meanwhile the Motorola case from Cingular broke within 4 days (the clip broke off). See the pics below for the case.

Of course, I had to get my Gadget-of-the-Week-#5 Gomadic power/sync tip:

Which works like a charm, of course.

My other modifications include:

• A replacement home screen. I didn't like the options that I had built in, nor was I able to find any that I liked that I could download, so I bought a copy of Home Screen Designer 2.0 and made my own. You can see it pictured above (although pictures of the phone screen just don't seem to come out very well). If you like it and want to use it yourself, you can download it from here. I will not support it, I will not provide you with any form of help installing it, and I will not provide any form of renumeration if, when you install it, it causes your phone to go up in flames (in other words, you're on your own).
• I installed a good Irish ringtone -- a midi rendition of "The Sally Gardens" (an Irish Reel).
• I figured out (with the help of the web, but I can't find the link anymore) how to configure it to work as a data modem for my PC (and so far Cingular does not charge me for the data minutes). The one sad thing there is that I was unable to get it to work via bluetooth. I was only able to get it to work via the USB cable and I guess I can live with that. I've used it a few times with decent success.
• I figured out (again with the help of the web) how to substantially lengthen the battery life at the cost of slower connectivity. I'm not sure if I'll keep it that way once I get email push enabled (if I do), but for now, my battery can last several days without a problem -- before this fix, even the extended battery was wearing down by the end of a day.

I'm very happy with the phone -- been using it for a month or so at this point and it's held up great. I'll probably try to install the upgrade at some point soon as I have a trip to Brussels scheduled for next week.

Tags : gadget / Samsung / BlackJack / Motorola / razr / mpx200 / mpx220 / h6315 / Windows Mobile / Smartphone / Cingular / Nutshell

Bizarre Circumstances

Clearly the boy has missed his calling (or at least he can give up his day job anytime).

Tags : identity / humor

A useless process

A few weeks ago, Microsoft, IBM and a number of their closest friends started the Technical Committee (TC) creation process within OASIS for the WS-Federation specification. As has been typical with the submission of the various WS-* specs to OASIS and the W3C, they proposed a charter that was an extremely ratcheted down requirement to publish the input document as close as possible to its current state (and they've gotten better with the ratcheting with each subsequent submission).

So much for the cooperative standardization process

This time, what was somewhat different than many of the previous WS-* submissions is that the functionality proposed in WS-Federation has substantial overlap with an existing standard specification which was approved as a standard more than two years ago -- SAML 2.0.

OASIS's TC creation includes a comment period which, in this case, was used by a number of OASIS participants including the likes of Nokia, France Telecom, Sun, Fujitsu, Oracle, and Neustar.

Many of the comments questioned the overlap in functionality between the 2-years-ago-standardized SAML 2.0 and the proposal.

The response to this input is recorded here. If you want the cliff notes version all you need is:

No changes to the proposed WSFED TC charter are required.

The only winning comment was Frederick Hirsch's comment about spurious characters in the charter -- this resulted in an agreement to remove them from the final charter document.

So, while there is a comment period, the proposers for the TC don't have any obligation to accept, listen to, or even pay attention to any such comments. In the session in which the comments are discussed, only the proposers can provide input, the commenters can't argue their case, nor can they do anything to impact the outcome of the treatment of their comments, even if they are being totally ignored.

OASIS and its members would be better served by a process that has some useful purpose. Asking people to provide comments and input that can be out-of-hand totally ignored is wasting their time in putting the input together, wasting the proposers time in having to organize and participate in the review meeting where they can simply ignore all input, and wasting the rest of our time in un-beleivably reading the out-of-hand dismissal 31 separate times.

So the official call for participation has been released now. The WS-Federation TC is forming under what many view as a flawed charter and a flawed standards process. Perhaps the not-so-nice response to this not-so-nice process would be to join the TC and to simply vote to block forward movement of the spec until these issues are resolved. Yeah, that's the nuclear option, but perhaps it's time to throw down the gauntlet and somehow drive some convergence in this market rather than continuing to drive separation.

Clearly I'm speaking, even more so than normal, from my non-PC personal point of view.

Tags : identity / WS-Federation / OASIS / Microsoft / IBM / Nokia / Oracle / FT

Making an MP3 CD...

I was on a long trip this past weekend through the mountains of Pennsylvania where there was little to no radio station coverage and it kept changing as I drove through one location to another. I had made a similar trip a week ago with a rental car from Hertz which was configured with a Sirius satellite radio receiver and it was one of the first times I really appreciated the benefit of such a device. However, I don't make this trip all that often to justify the cost of subscribing to the service.

My car, a Chevy Colorado pick-up truck, has a 6 disc CD player so I could, and did, use some audio CDs to fill in with some music, but the number of tracks is quite limited even with 6 potential discs (although I only had one disc with me).

I tried using my FM transmitter for my iRiver Clix, but depending upon where I was, the chosen frequency kept getting overridden by an outside transmitter and I had to keep moving the frequency around -- not a good thing to do driving along at 70-75MPH.

My car's CD player does support the ability to play MP3 data CDs, giving me a 10x improvement in audio quantity, so I set out to create a disc that I could use in the car with my best music. Of course, it can only play MP3 formatted files, not WMA formatted files.

My media player of choice in my computer is Windows Media Player (WMP) and I rip my CDs in 160kbps Windows Media Audio (WMA) format. I have taken great pains to go through my entire collection of music and rate each song and wanted to use some automatic playlists to select the best of the best music for my new CDs (e.g. all 4 or 5 star rated songs). That's where the problem started.

First off, WMP seems to only want to create discs that are either an audio CD (with the standard audio format and thus about 80 minutes of music on a 700MB disc) or it can create a WMA format data disc which has good compression (close to 800 minutes) but unfortunately can't play in my car. I was unable to find a way to get WMP to burn a CD in MP3 format, nor a way to get WMP to generate a directory of MP3s from one of my playlists. Some research on the web indicated that I may have gotten this capability if I purchased the Windows XP Plus! Superpack, but I didn't have that nor did I want to purchase that.

I have Roxio Easy Media Creator 7.5 (yeah, I probably should upgrade to version 9, but they ticked me off when I bought version 7 less than a month before 7.5 came out and they didn't want to give me a free upgrade to 7.5) installed and tried to use that (which does have the ability to create an "MP3 disc" -- which I'm pretty sure is exactly what I'm looking for. However, it was unable to take WMA formated files as input nor was it able to use one of the WMP playlists.

I also have iTunes installed which is able to import WMAs and is able to store files within it's library in MP3 format, but it too appeared to be unable to use a WMP playlist as input to specify the files to copy/convert, nor was I able to find a way to get it to generate an MP3 disc (audio disc yes, backup disc -- whatever that is -- yes, but MP3 disc apparently no).

However, this motley collection of tools, along with some shell scripting, was able to accomplish the task at hand. The steps are shown below:

1. Create a directory containing the WMA files that I want to have on the MP3 disc. This was necessary so that I didn't have to manually select each song that I wanted to import into iTunes, nor re-generate my ratings/playlists within iTunes because I imported the entire WMA collection. I saved a WMP playlist containing the files of interest and ran the following script within cygwin:
   

    grep "\.wma" "$OLDPWD/mylist4.wpl" \
            | sed -e 's;.*"M:.My Music.;;' \
                  -e 's;"/>;;' -e 's;\\;/;g' \
                  -e "s-'-'-g"          \
                  -e "s-&-\\&-g"         \
            | cpio -pdm /cygdrive/d/data/tmp/music
   

   This reads the specified WMP playlist (mylist4.wpl in this case), uses SED to convert the XML into a list of files (XSLT is probably the right way to do this as the file was XML, but a) I don't have XSLT installed and b) the XML was simple enough to do this all with the SED script), and uses CPIO to copy the WMA files to a temporary directory.

2. Import the files in the temp directory into iTunes. Be sure to change the preferences setting within iTunes to tell it to import the files in 128Kbps MP3 rather than the default AAC format.
3. Use Roxio's Creator Classic utility to burn an MP3 disc, selecting the iTunes collection as the source (I had no other music in my iTunes installation so this made it pretty easy -- I didn't have to go poking around selecting files to include on the disc.) The default iTunes music directory in my install was "My Documents\My Music\iTunes\iTunes Music".

I presume that someone, somewhere has an easier way to do this and I would love to hear about it as I presume I will need to do this again. It's a shame that WMP didn't offer this capability directly as it certainly has the necessary codecs and could have done so -- but I presume they are more interested in spending time on their hateful DRM stuff.

UPDATE - after all this, I find out that it is only the single-disc player for my car that includes the ability to play MP3s. The 6 disc changer does not have this capability. So it was all a waste!!!

Tags : windows media player / wma / mp3 / Roxio / iTunes / Hertz / Sirius / XSLT

Ad Blocking

I've known about the Firefox adblock plug-in for a long time, but have resisted installing it. For the most part, I think that sites I visit have a reasonable case for showing advertisements (to pay for the thing that I'm going to view or use). I don't mind that they make money. And, I don't mind getting ads that are related to what I'm doing, so it was sort of a win-win for everyone.

However that changed today... Over the past few weeks I've been poking around on my system when it would go slow. Of course, Outlook was frequently to blame. But there were times when I could not attribute the problem to Outlook and looking in my task manager, I found that it was Firefox that was using up the CPU -- 15 to 20% of it, even when I was doing nothing.

Some experimentation found that there were several adds running on different sites that were flash based and were eating away at my CPU.

So, I installed the plug in, restarted Firefox, and went to the pages that had the ads in question and easily blocked them. I'll continue to allow ads that aren't hungry consumers of my CPU (for the reasons I gave earlier), but nobody has the right to put an ad on my system that has a measurable impact on the performance. Ad writers, take this to note... Stop with the flashy, high load ads lest we block them all.

Anyway, thanks a bunch to the Adblock Crew and Michael McDonald for making this great plug-in available.

Tags : Firefox / Flash / ads / Adblock / Outlook

Planet Earth

The Discovery Channel has started running an 11 part miniseries titled "Planet Earth", narrated by Sigourney Weaver.

We enjoyed watching the first 3 episodes (thanks to Tivo!!!!) which aired on March 25th. The show will continue to air on Sundays through April 22nd.

It's a great show and I recommend it as breathtakingly entertaining (and even educational) for the entire family.

Tags : Planet Earth / Discovery Channel

Free Software Update

Back in Dec, I wrote about the Almost Free Software offers that I kept receiving in the mail and how it clearly wasn't a smart or good deal. Since then, the parties pushing their "Downloadable Software" have gotten even more aggressive (I'm getting probably twice the number of offers today) and they have varied their approach considerably.

I still get the emails that have the list of software offers for like $79. I also get emails with images such as the one below:

Or

Or:

Or:

Office 2007 is available for enterprise users from November 30, 2006. The end user version is available from the beginning of 2007. The 2007 Microsoft Office System, also known as Microsoft Office 2007, is the most recent version of Microsoft's productivity suite. Formerly known as Office 12 in the initial stages of its beta cycle, it was scheduled to be made available to volume license customers on November 30, 2006, with general availability following in early 2007. Office 2007 contains a number of new features, the most notable of which is the entirely new graphical user interface called the Ribbon, replacing the menus and toolbars that have been the cornerstone of Office since its inception. Office 2007 also includes new applications and server-side tools. Chief amongst these is Groove, a collaboration and communication suite for smaller businesses which was originally developed by Groove Networks before being acquired by Microsoft in 2005. Also included is Office Sharepoint Server 2007, a major revision to the server platform for Office applications, which supports "Excel Services", a client-server architecture for supporting Excel workbooks that are shared in real time between multiple machines, and are also viewable and editable through a web page. While Office 2007 includes many new features, one has been removed entirely: Microsoft FrontPage is no longer being developed; its successor is the Microsoft Expression line of products. Microsoft Office 2007 Enterprise
Retail Price $899.00
Our Price $79.95
You save $819.05

Or:

Downloadable Software (DS) is a rapidly growing company with a high quality software. You've come to the right place if you need professionally implemented programming solutions for your usage. Thousands of contented customers have already benefited from our software and solutions. Hundreds are joining this community every day.
We deliver superior software products and services that empower our partners and customers to dramatically improve their development, deployment, integration and management of quality applications all over the world.

Most popular OEM products:

Microsoft Windows Vista Business
Retail Price $299.00
Our $79.95

Microsoft Office 2007 Enterprise
Retail Price $899.00
Our $79.95

....

These offers come from all kinds of people (most likely falsified) with subjects tell me that Carysoft, michelsoft, Jefferysoft, Jinnysoft, sanitysoft, etc., etc. have great "80% offers off MICROSOFT/ADOBE SOftware". I've even gotten some "sóftwáre dównIóád cóúpón" (again, the special characters are an attempt to squeeze by spam filters).

The domains/hosts where you are asked to go include:

• www.sobaka-oem.com (currently the most popular)
• daikal2.eu
• www.laga-soft.com
• cl.rmsofto.eu
• lloemd.eu
• buratinopedorino.eu
• nasdaqkrutchert.com
• kozel-oem.com
• ektroem.com
• kvaka-soft.com

What should you do?

Stay away from those sites. As Robert Heinlein often said: TANSTAAFL -- Their Ain't No Such Thing As A Free Lunch. If it sounds too good of a deal, it is too good of a deal.

I haven't dug deep enough into the site to figure out if they are just trying to steal your identity or to sell you bogus software, but I'm convinced that it's one or the other.

Tags : scam / spam / identity theft / rip off / tanstaafl / microsoft / adobe / vista

Liberty's Advanced Client Trusted Module

Last week, the Liberty Alliance announced the release of the initial draft of the Advanced Client Technologies (ACT) specification set. I mentioned it as well last week.

One component of the Advanced Client Technologies that may be less than obvious is the Trusted Module (TM). The TM should not be confused with the Trusted Platform Module (TPM) whose specifications have been released by the Trusted Computer Group -- the two modules do very different things, although I expect that some TM implementations will make use of a TPM to enable their trustedness.

The TM doesn't stand out so well since there is no "Trusted Module" specification in the specification set, although there is discussion about the TM in the Advanced Client Technologies Overview. That is, in part, because the TM isn't a service itself (although it does make use of other services such as the IdP service).

However, the TM is one of the more useful components included in the Advanced Client Technologies specs and was driven by a number of valuable (from a personal and a business sense) use cases which called for the following capabilities:

• The TM can act in the name of the (Identity Provider) IdP for SSO and Web Services transaction identity assertions.
• The TM can locally validate user credentials (username/password, smartcard, biometric, etc.) and assert the identity of the user based on the local validation (to the IdP and/or to relying parties (RPs)).
• The TM can perform these tasks when "offline" or otherwise disconnected from the IdP (sometimes out of a choice for privacy reasons).
• The solution must allow for, document, and support a model that does not inadvertently require the creation of a correlation handle for the user's identity across multiple providers. This requires interesting solutions when you take into account that an entity that is likely to be per-user will be participating in signed transactions.

Essentially in this model, the TM is a local beachhead for IdP delegated functionality. The reasons why an IdP might want to support this model include (in no special order, nor intended to be totally inclusive):

• Security - allowing verification of credentials locally, without the need for network transmission nor network storage of the credential verification data decreases the likelihood that such data will be stolen (especially an issue when considering biometric data given that the user typically can't change their biometric data).
• Load distribution - the identity related transactions are distributed out to end-user systems rather than having to rely on a central server for every transaction.
• Privacy - allowing the TM to perform SSO operations reduces the visibility of the IdP into exactly what the user did when since the TM can do so without involving the IdP (assuming, of course, that the IdP has allowed the TM to do so).
• Availability - the user is able to actively assert their identity, even when the IdP is not available (e.g. because of maintenance downtime, connectivity issues, or even remote site access).

All-in-all, this TM provides a substantial package of powerful technology that will improve the overall identity meta-system. I look forward to seeing some of this stuff hit the street.

Tags : identity / liberty / Liberty Alliance / Advanced Client / Trusted Module / delegation / TCG / TPM / TM / privacy

Keylogging & Security

In Identity X-File 0x01, Pam writes about a story in the UK where a 6 year old was able to bring in and install a hardware key logger on an MP's computer in the House of Commons (it was part of a BBC experiment).

I assume a physical keyboard logger like this could still be used to steal an IdP username & password, even with all the secure desktop stuff that the CardSpace client has built in…

Essentially what a key logger does is use a Man-In-The-Middle attack to capture all input to programs and applications (including login screens) on a computer. The captured data is then analyzed to pull out useful information such as login credentials, credit card numbers, and other such valuable information.

If the primary concern is login credentials, the "easy" answer is to move to some form of strong authentication that requires hardware assistance (such as a smart card or biometric reader). These usually have communications protections in them to protect against MITM attacks. This isn't so easy to implement across a number of vendors (especially if you try to do it without identity federation networks such as those discussed by the Liberty Alliance's ID-FF and OASIS's SAML 2.0) and, even if you were to do so, the non-credential data entered by the user would still be subject to loss (such as the content of all typed emails, documents, etc.).

I did stumble across one amusing way around loggers (but, IMHO, opens all kinds of other problems) which uses a screen based keyboard to enter your data by clicking on buttons -- theoretically this is less likely to be picked up by loggers. The problems with this model include:

• While you click on the keys, your credentials are displayed plain-text on the screen so anyone looking over your shoulder would get them.
• You are trusting that the party that manages that page is not going to add anything to that page to log your entries (and without looking at the code, there's no easy way to do so).
• The site is unencrypted, so anyone looking at your network traffic can get the data
• The way that you then copy the data to the appropriate application is via the Operating System's copy/paste routines, something that is frequently available to any application and so subject to attack.

I wouldn't recommend using such a solution. Just too many weaknesses for me.

The ultimate answer for key loggers is a Trusted Path (sometimes called "Secure Path"). The trusted path ensures that the user is talking to the application that they think they are talking to (i.e. that there's no MITM listening in). Microsoft talked about doing this in their Next Generation Secure Computing Base (NGSCB) (code-named Palladium), which, at one point was to be part of Vista. However, only a limited set of the NGSCB functionality made it into Vista - the BitLocker drive encryption component.

This problem isn't small and isn't easy to solve, especially when you consider the need for being able to replace keyboards (because they broke, because you want to try a more ergonomic version, etc.). If you make replacement easy, you make MITM easy. If you protect against MITM, you end up making it hard for your users to easily work with their systems (increasing IT maintenance cost).

Tags : key logger / Microsoft / Palladium / Vista / Trusted Path / Secure Path / MITM / NGSCB / SAML / Liberty / Liberty Alliance / ID-FF