[ISN] Commentary: The Threat Of Microsofts .Net

[InfoSec News]

http://www.kingpublishing.com/fc/new_technology/commentary.htm

BY WHITFIELD DIFFIE AND SUSAN LANDAU

For more than two centuries Americans have prided themselves on
protecting their freedom by limiting the concentration of power. With
its famous balance of power, the U.S. Constitution divides federal
power among the three branches of government, while the Bill of Rights
provides other checks all of which have served the country well.

With new threats have come new protections. In the nineteenth century,
corporations grew and multiplied, and some amassed the kind of power
we had always sought to limit in our own government. Anti-trust laws
were passed to guarantee that commercial power would be distributed
among competing companies in every sector of business.

These protections have also served us well.

But now a new threat has arisen that may be less obvious but more
dangerous.

While computer and communication technology have enhanced our lives in
many ways, they have also caused fundamental changes that make
protecting ourselves from the concentration of power more
difficult--in part because these technologies have made it feasible to
build organizations that are larger and more globally-distributed than
ever before. The result: we need to be more alert to potential abuses
of power.

The fact that everything is interconnected makes it possible to
concentrate power in a new way. A business that holds a monopoly in
one area may be able to use its influence to extend its monopoly in
entirely new ways. This is what is happening as Microsoft attempts to
extend its monopoly over personal computer operating systems into the
Internet world.

Microsoft .NET (pronounced dot net') is a far-reaching project to
channel the personal information of all customers who browse, shop,
and congregate on the Internet into Microsoft or Microsoft-controlled
companies. It is made up of components: Passport establishes an
individual's identity on the Internet .NET My Services collects

various pieces of private information--including .NET Contacts, .NET
Location, .NET Inbox, .NET Documents, .NET Devices, and .NET Wallet.

The control over computer software that Microsoft has achieved through
its dominance of operating systems has limited competition and
innovation throughout the computer field.  Through .NET, it is
attempting to exert the same control over all Internet commerce. Just
as kings got to grant or deny royal charters to businesses, the
Redmond giant, if successful, may be able to say who can do business
on the Net and who can't.

But there is another and more immediate problem with .NET--something
that could evolve from a problem to a national crisis even if
Microsoft is well behaved or well regulated in the use of its new
powers.  That is the problem of security, as opposed to privacy.

What is the difference? If Microsoft knows everything about
everyone--and the information being collected by Passport and My
Services make that look quite likely--the company could still be
constrained in how it uses that information by laws or corporate
privacy policies. That presupposes, however, that Microsoft is
actually in control of the information it has collected.

Microsofts security record is nothing to brag about. Windows is the
most widely used yet one of the least secure operating systems around.
Microsoft programs have shown themselves vulnerable to worms, viruses,
and break-ins, on Microsoft's own computers and on everybody else's.
The Melissa virus spread through Microsoft's word processing and
e-mail programs, sending itself to the first 50 people in each of the
infected machine's address lists. A year later the ILOVEYOU virus
infected the Web through a different part of Microsofts e-mail
package. More recently Microsoft's own internal systems were hacked,
and the intruders spent over a month accessing system source code,
likened to Microsoft's crown jewels, before their unlawful entry was
discovered.

Why should Passport be any different? Early security analyses show
that compromises made for the sake of universal availability make
Passport less secure than it might have been, less secure than it
should be, and perhaps just plain insecure. The My Services databases
will be a particularly ripe target for hackers. (Since all users of
Microsoft's free Hotmail service have Passports, many unknowingly,
there are already 160 million Passport users.)

Remember, Willie Sutton used to rob banks because that's where the
money is.

Suppose that in a year or two Microsoft has succeeded in funneling the
lion's share of information about people's identities, preferences,
financial assets, and shopping habits to itself and putting them all
in one big database. If Microsoft can't protect its own systems: what
hope is there for Microsoft databases that will contain the credit,
locations, and private files of millions upon millions of users?

Suppose somebody breaks in. Everyone's personal and financial
information would suddenly be in the hands of the intruders. Or
worse--they could be scattered about in a series of resulting
malfunctions. The extent of the financial, social, and political
disaster that could result is hard to imagine.

If history has shown us anything, it's that the best protection lies
in decentralizing power and promoting competition. We need to take the
same approach to our digital identities and make sure that who and
what we are is not held captive by a single entity.


Whitfield Diffie and Susan Landau are respectively distinguished
engineer and senior staff engineer at Sun Microsystems and co-authors
of Privacy on the Line: The Politics of Wiretapping and Encryption,
MIT Press, 1998. Diffie is also the co-inventor of public-key
cryptography.




-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo at attrition.org with 'unsubscribe isn' in the BODY
of the mail.

--- end forwarded text


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'



---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com