The Single sign on universal login security debate
So how could you go about reducing this number while at the same time increasing the security? OneID is one company I�ve been researching recently. They provide a Single-Sign-On (SSO) service and form filler. The SSO component is loosely based on the OpenID Foundation open authentication standard.
OneID�s architecture is actually very simple. You verify your digital identity with a password via an active device and a control device i.e. browser, app or physical device. The active physical device in this example would be the PC. A verification is then sent to your mobile* for user verification. This works on the principle that if someone has stolen your mobile they will need your PC to access your OneID network. Call it two-step verification, if you want. Users also don�t need to remember credit card numbers as this data is encrypted and isn�t stored on a central server, it�s stored in the cloud but the key isn�t. More on the signature keys in the next paragraph.
*Think Over-the-Air (OTA) and One-Time-Password (OTP) here.
There is also the option of using a one-time pin (known as an �out-of-band� service) to verify your digital identity. This acts like a signature verification system rather than a password. This means if the system is hacked, only the pin is exposed, not the passwords. The keys that are used for the signatures would need to agree with those stored when the user first authenticated to OneID. If someone other than the OneID user attempts to replace the stored keys, the authentication will fail. Equally important the pins are not stored on the centrally stored database as they can only be used once � hence �One-Time-Pins�.
The idea is that users can manage all their devices and data through OneID, but the major drawback here is websites adopting the system in the first place. I�ve already seen similar services fail to attract mass market adoption, which in my mind is a shame. There is also the small issue of privacy. Universal login (SSO) provides companies with access to user profile, demographic, surfing behaviour, usernames/ID and other data, so I�m not entirely sure users will adopt this on mass.
Also, I believe these types of SSO need full support from Capitol Hill in the US and other governments and maybe say Facebook or Twitter. The current thinking is all about shared secret authentication, which isn�t the answer. Right now OneID and OpenID remain committed to providing universal login security but something tells me it might be an uphill struggle given OpenID to date hasn�t been that successful with market adoption. Ok readers, let me know your thoughts!
download file now
