EDUCAUSE | Contributed by Organizations or Campuses; Articles, Papers, and Reports; and Authentication

OpenID: Decentralised Single Sign-on for the Web

ckeller — Fri, 07 Sep 2007 15:57:18 -0500

"OpenID is a single sign-on system for the Internet which puts people in charge. OpenID is a user-centric technology which allows a person to have control over how their Identity is both managed and used online. By being decentralised there is no single server with which every OpenID-enabled service and every user must register. Rather, people make their own choice of OpenID Provider, the service that manages their OpenID. "

Unauthenticated Authentication: Null Bytes and the Affect on Web-based

drupal — Tue, 20 Mar 2007 10:55:27 -0500

This paper describes a vulnerability that may affect web-based applications that insecurely implement LDAP simple binds for the authentication of users. Web-based applications that fail to properly sanitize a user-submitted username and password may be vulnerable. Successful exploitation may allow for a remote anonymous user to authenticate to the web-based application as any existing user. The exploits described in this paper are most closely related to the Poison NULL byte attacks described in 1999 by Rain Forest Puppy, although utilized for a new purpose [1].

Setting the foundation for identity management

drupal — Tue, 18 Apr 2006 11:19:54 -0500

New Data Center security projects increasingly center on building a strong identity-management base.

Sun pairing tools for physical, logical access

drupal — Tue, 18 Apr 2006 11:26:55 -0500

Sun this week plans to add management and other software to its identity platform so that users can converge access to physical and logical resources onto a single smart card.

The hidden challenges of federated identity

drupal — Thu, 30 Mar 2006 11:14:10 -0600

Federation is the logical goal of identity infrastructures, but achieving it takes more than just technology. For years, companies have kept stores of identity information about employees, customers, and partners. These databases and directories are critical components of a company's identity infrastructure. But as businesses push to create new products and increase productivity, they have discovered that they often must cooperate to provide the services their customers and employees demand.

Universal Authentication

drupal — Mon, 27 Mar 2006 10:17:28 -0600

Leading the development of a privacy-protecting online ID system, Scott Cantor is hoping for a safer Internet.

Three Ways To Authenticate E-Mail And Stop Spam

drupal — Mon, 13 Mar 2006 13:25:23 -0600

Don't stop at filtering software. Sender authentication provides another defense against spam--but you'll have to choose from three methods.

Schooled in Security

drupal — Thu, 18 Aug 2005 10:24:22 -0500

"For universities, network security is a tricky balancing act."

Authentication: The Power of Who

drupal — Mon, 07 Mar 2005 17:03:01 -0600

"As colleges and universities continue to sharpen identity management applications, next-generation technologies are closer than ever before."

Giving E-mail back to the users: Using digital signatures to solve the spam problem

drupal — Fri, 03 Oct 2003 12:22:24 -0500

This paper argues that current legislative and private attempts to stop spam are either ineffective, or involve unacceptable tradeoffs. The key to solving the spam problem is recognizing the importance of e-mail authentication and the granting of permissions. Properly used, digital signatures can easily authenticate e-mail for effective spam control. The ability to manage public keys for verifying digital signatures provides each e-mail user the individual power to control who communicates with her and can therefore completely eliminate the practice of spamming. Finally, we recommend that software developers build the requisite capabilities for managing public keys into their e-mail programs. We argue for a technological solution as opposed to government legislation.