Analyst: MS Passport Flaws Hurt Single-ID Services

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

For the second time in as many months, Microsoft has fixed a security hole in its .NET Passport single-ID application after details were posted to a public mailing list.

In published reports, Microsoft confirmed the latest vulnerability could have compromised some older Hotmail accounts but said there was no indication that any accounts were hijacked. The news comes after it plugged a password stealing hole in Passport in May.

The latest hole only affected users who maintained active Hotmail accounts for more than four years. It allowed an attacker to manipulate the “Secret Question” security feature to change passwords in Passport.

The news arrives as Microsoft works to build more trust in its Passport service, which it bills as a one-stop-shop where personal information is stored and used for online activity such as shopping and accessing content.

Security analysts at technology research firm Gartner have already urged financial institutions and other enterprises to stop using the Passport service immediately, asserting in a report that the identity of users cannot be trusted.

Gartner’s John Pescatore said that news of another password-stealing hole in Passport comes as no surprise. “I’m sure there’s more to be found. We expected this to happen,” Pescatore said, reiterating a call for financial institutions, credit card issuers, retailers and other enterprises to break all Passport connection until November or until Microsoft can prove that its security is adequate.

Pescatore said Microsoft’s lax security in the Passport service has shattered public confidence in e-commerce identity services. “Everytime these vulnerabilities are found, it causes enterprises to step back and get nervous. It erodes confidence in the sector. People see these identity theft stories all the time and when they hear about another flaw in Passport, it makes things worse,” Pescatore said in an interview.

The Gartner analyst said Microsoft can reduce the impact and regain market confidence by submitting Passport’s code to a full open-source review.

He said Microsoft’s Trustworthy Computing initiative focused heavily on the 2003 Server and SQL Server products, at the expense of consumer-focused services like Passport. “Passport was never high on Microsoft’s security checklist and that’s why we are now seeing these flaws. I think businesses should cut off all connections to Passport for at least six months until we can wring out all these holes,” he added.

“When we told clients to wait for six months to make sure everything was secure, we knew more bugs were bound to be found. We always knew there would be more,” he added.

Messages seeking comment from Microsoft were not returned by presstime. However, when Pescatore’s research report was issued in May, a spokesman for Microsoft said the recommendations from Gartner were not constructive for customers. “We take all security issues very seriously. In this case, we were able to deal with the issue in hours, and have no evidence at all of any misuse of accounts. The ability to respond to issues in such a quick and efficient manner helps ensure that should a vulnerability exist, that users can be protected from impact,” Microsoft said.

A spokesman also insisted Microsoft used “a solid set of processes and procedures” to run Passport as a trusted service.

Still, Pescatore argued that the Passport accounts simply “cannot be trusted.”

“It will probably be about six months before they can fix it and test all the fixes and convince everyone that it’s secure. Until then, we are standing by our advice to clients to avoid using Passport,” Pescatore said.