Authorising #oAuth in Widar

Tools like AutoList and Reasonator get a boost from their ability to apply changes to Wikidata. Reasonator shows labels in the languages you know and missing labels in your language can be added. AutoList enables you to add multiple statements to items that it shows in a list.

This is powerful stuff. It helps when you understand how it works. Widar is the tool that does handle the authorisation for oAuth. It remembers the authorisation by using cookies. These cookies are associated with your browser. When you use multiple browsers, you have to authorise multiple times.

As Reasonator is used everywhere, people will authorise often. As the cookies persist, it is important to end the authorisation for Widar. The functionality to do so has been added recently.
Thanks,
     GerardM

Improving #privacy and #security

There is little privacy left and there is a lot of FUD about the extend our privacy and security has been compromised. On a mailing list there is even talk about the possibility that the Wikimedia Foundation may be forced to divulge information to one of the American Secret Security organisations.

The good news is that the security and privacy for most users of any of the projects has been improved substantially. As our commitment is first and foremost to bring knowledge to all the people of the world, the only exceptions have been made for people accessing our projects from China and Iran.

There is talk about implementing OpenID for use at the Wikimedia Foundation. Making OpenID available for all of our users would be really welcome given that the use of single sign-on has been largely usurped by companies like Google and Facebook. The Wikimedia Foundation is probably the only organisation that is not commercial that has a fighting chance to be accepted as a provider of single sign-on.

myOpenID.com announced that it will end its services in 2014. I would dearly love to have a replacement in the Wikimedia Foundation as my provider of a single sign-on service.
Thanks,
     GerardM

The need for both #OpenID and #OAuth

Many words have been used on the merits of OpenID and OAuth. There are many misconceptions and many of those have everything to do with perspective. In order to get a better understanding I asked on the Wikitech mailinglist a use case for OAuth. The answer I received helps.

OpenID is an identity management system. It allows users to authenticate to one site using another site as their identity. A use case for this is, for example, using your Facebook account to log in to Wikipedia. This may be useful, as it would allow users to more easily register for Wikipedia

OAuth is a third-party authentication and authorization system that allows outside applications to do stuff on behalf of a user. The reason for this is because currently toolserver applications, etc. authenticate to Wikipedia using a plaintext username and password, which is extremely insecure for a number of reasons I will not elaborate on here.

When you read the answer, there are some observations to make. The most obvious is how do you assure that the software that is to use OAuth will be secure. Given the power of many Toolserver tools how do you make sure that only trusted people make use of the Toolserver functionality.

Enter OpenID, it does provide identity management. OpenID is able to provide more information than just "this is indeed the indicated identity" as part of the "OpenID Attribute Exchange". When the Wikimedia Foundation implements OpenID as a service, it will be possible to identify the users that have a "bot flag" on the user profile. 

As it is, the Toolserver tools are not necessarily secure. With OAuth it will become even less secure to run the software because it will be the software itself that includes the authorisation to run, never mind its configuration, never mind how it is used or by whom. When OpenID authenticates users, it becomes possible to ensure that only people with a bot flag can run Toolserver software on the production Wikimedia projects.

To make the use of the Toolserver tools secure, it is necessary to complement OAuth with OpenID. Oauth in isolation will make the Toolserver tools easier to use but it does not make them more secure to run.
Thanks,
      GerardM

a #threat assessment for #Wikipedia

The people who take care of mail send to Wikipedia are often informed that Wikipedia is not secure; "everybody can edit Wikipedia". This is actually intentional because Wikipedia is the encyclopaedia that everybody can edit. The real risk is when people do not recognise they are invited to edit. This is a genuine issue and it is something that receives a lot of attention.

When you consider security for Wikipedia, the people most at risk are its editors. There are several threats they are exposed to. Several of these are issues computer security can deal with.

• threat to the anonymity of a registered user
• threat to user credentials

When the potential threats are evaluated, it is important to realise that the severity of these threats is not obvious. It matters considerably where you reside, what your ethnicity is or what your belief system is. It is important to minimise any threats because once people no longer feel free to contribute it will damage the "neutral point of view" that gives Wikipedia much of its relevance.

With the implementation of SSH it has become considerably more difficult to learn what a person is doing when working on Wikipedia. This has been a real improvement. However, user credentials and particularly passwords are considered not really secure. Read for instance what Wired had to say about them. It is explained that improvements can only be expected when changing the infrastructure of online security. This will probably do a whole lot more good than lecturing people about how they should change their behaviour.

The question is if the WMF is open for such considerations. So far the talk is about "Nascar" ?!?! to me this sounds remarkably like bikeshedding and is very much beside the point.

Thanks,

     GerardM

#OpenID for the USERS of #Wikipedia, PLEASE

Again a discussion about the use of OpenID for the Wikimedia projects flared up. From my perspective the one perspective missing is the one of a computer user who is fed up with the failed security that is provided by passwords.

The problem is that systemmanagers only consider security in isolation. It is the solution that is to be adopted for their system or systems. Obviously in a perfect world, a user will have a separate password for each website or program. The world is not perfect and most people use one or a few passwords for everything. The world is not perfect and passwords of many big websites have been uncovered by hackers. Consequently many passwords used by Wikimedia contributors can easily be guessed by the bad guy who are in the know.

The problem with passwords for a user is that they are unmanageable. Too many systems and websites, too many interfaces seriously impact the security wherever passwords are implemented to provide security. It is theatre and the fool is the part you have to play.

OpenID provides a serious alternative. It allows for a single place with a single password that authenticates to any and all websites and services that accept security in this way.  It is a serious alternative as long as any and all accept other OpenID. It will be really welcome when the WMF considers security for its 456 M users. It is obvious that a large percentage also frequent websites like LinkedIn and solidify the argument to implement OpenID.
Thanks,
     Gerard

The use case for #OpenID indicated by the #LinkedIn hack

LinkedIn was hacked; all the passwords in use a few days ago are no longer secret. The advice people get is to change their password everywhere where they use the same password.

This blog post is not about LinkedIn. It is about the lack of security provided by passwords as seen from a user point of view. Any organisation that thinks it can not happen to them is delusional. From a user point of view, any website that wants you to create a user with a password that is maintained on that website is a potential security risk. A risk you are exposed to because any site can be hacked and, you do not remember passwords that are unique to each website.

For a user, it is more secure to rely on one place where all the authentication to any website is done. The advantage becomes clear when a website is hacked; there is no password for you to abuse. When the authentication server is hacked, all that is required is to change the password at that central server.

LinkedIn was compromised and as a result many people with a Wikimedia account have an account that is compromised as well. Many of these people will not change their password because they cannot be bothered or because they are not aware of the risk.

As a consequence disruption by "trusted users" is a potential and realistic scenario. This risk can be mitigated by accepting the use of authentication through an OpenID service.
Thanks,
     GerardM

#WMDEVDAYS - Single signon

One of the #Wikidata presentations posed a question: "We need a much improved single signon". For Wikidata it is important to be able to edit Wikidata itself while working at the same time on a Wikidata client. The presenter wanted to understand if this is an issue that needs to be addressed soon.

When you will be using Wikidata on one of the Wikimedia projects, you will typically use one user on all projects. This user is authenticated once when he signs on with his global user account and, this authentication serves him well when he works on other projects.

This will work well for Wikidata. The only issue left is that they also want to be usable and editable for users who use Wikidata from their own server. This however is an issue that they do not have to solve immediately.

There is existing functionality like OpenID that may provide a solution for this. It is great that the Wikidata people consider how the data can be used from outside the Wikimedia Foundation. It is wonderful that they provide a use case that makes a case for implementing OpenID.
Thanks,
     GerardM

The #OpenID challenge

At #Translatewiki.net a request was made to support OpenID. The beauty of OpenID is that it reduces the number of websites that store your password. This makes browsing the Internet arguably safer.

The translatewiki staff is hesitant to support yet another nice to have extension. It has been burned by accepting LiquidThreads in the past. LiquidThreads is a great idea and it provides a much better user experience but it has not been properly supported. There is a promise for a release somewhere in an unspecified future.

Wikinaut did take over the OpenID extension support. He provided patches updated the documentation and equally important, he runs it on his own MediaWiki wikis. The need for support seems to be fulfilled, the question is not only if translatewiki is interested but also if the WMF is interested in providing improved security.
Thanks,
     GerardM

#NPOV and information warfare

#Wikipedia has the neutral point of view (NPOV) as one of its core principles. Wikipedia finds its public all over the world and consequently sources that are to establish facts are from all over the world.

Information warfare is practised by many opposing parties, companies and countries. One of its aspects is to "spreading of propaganda or disinformation to demoralize or manipulate^[1] the enemy and the public, undermining the quality of opposing force information and denial of information-collection opportunities to opposing forces."

When information provided by sources is tainted by premeditated lies, when this is an established fact, the question of a notion of a neutral point of view is no longer about different view points but about different fabrications. Wikipedia frowns about when some sources are used. Maybe even more sources need to be considered to be for what they are, the conduit of fabrications and not as sources of facts.
Thanks,
      GerardM


PS inspired as often by Bruce Schneier ..

#Facebook, we ARE your partner .. trust us, trust #Wikipedia

#McAfee scans links from Facebook. This would be a good idea when done right. As it is, links to Wikipedia are flagged on Facebook as "potentially unsafe by our trusted partner".

This is rather silly because the Wikimedia Foundation has been a partner of Facebook longer then this new "trusted partner". Facebook, I trust that you can agree that you have got it wrong. It is "wonderful" to have trusted partners who talk on your behalf and get it so magnificently wrong.

As a long time partner we do trust you to do good..
Thanks,
     GerardM

#Chrome #security is a bit too much

The logo for the Hindi #Wikipedia is used as an illustration on a previous post. Illustrations like this can be saved from the "page view info" that is available by right clicking a web page.

Chrome apparently does not like the Hindi Wikipedia; it does not only prevent me from accessing the page view info, the information is incorrect as well.

I did use Chrome before today. I am quite happy for Chrome to provide me with a security warning; I hate it when it prevents me to do my job.

Particularly nasty is the warning:

The site uses SSL, but Google Chrome has detected either high-risk insecure content on the page or problems with the site’s certificate. Don’t enter sensitive information on this page. Invalid certificate or other serious https issues could indicate that someone is attempting to tamper with your connection to the site.

Such warnings should be taken seriously and reported but I am quite happy to use Firefox in stead.
Thanks,
       GerardM

I have not been in #China

#Google takes privacy serious. One of the ways they help ensure that it is only you who use your account is by recording the locations an account is accessed from. Google just asked me if it was likely that I had used my Gmail from China.

I have not been in mainland China ever except for transferring to another plane. This stop over was a few years ago and lasted for 30 minutes. I have now changed my password and I signed out of all other sessions.

I have no clue who could be interested in me or my mail account or why. What I do know is that I am annoyed. Enough to write about it.
Thanks,
     GerardM

Where have you been lately

#Privacy is elusive. When you use a mobile phone and some cars it is obvious where your car or phone has been. Both can make their position known to a service provider. By triangulation the positions can be and often are recorded.

There is a lot to do about the registration of positions on Apple mobiles. Because of this registration all kinds of applications are enabled that rely on localisation.

This data is now openly available as it is located on the “User Data Partition”. This data used to be available hidden in the Apple Property List format..

The relevancy is that governmental organisations increasingly claim the right to investigate computers and mobile phones without a warrant. As this data is now easily and obviously observable in sqlite3 there is not much stopping Big Brother from being a big nuisance.
Thanks,
       GerardM

Use #SourceForge with #OpenID

I received an e-mail that passwords at SourceForge may have been compromised. Adequate action was taken because everyone had to reset his or her password.

This little drama does not affect those people who use OpenID for their authentication. When a website's security is compromised, there are no passwords to sniff or find in files when OpenID is used.
Thanks,
      GerardM

I will not be advertising to my "friends" on #Facebook

At the celebratory #Wikipedia hackathon in Amsterdam we discussed using Facebook for the authenticating of people in a process that was not exclusively Wikimedia. To some this seems like an attractive idea because "everyone" is on Facebook.

In the past few days, new information became available that makes Facebook increasingly unpalatable.

• selling private information of the people who use Facebook like addresses to its clients
• Facebook "currency" to be used for any and all Facebook applications to start with games
• featuring you in targeted advertisements to your "Facebook friends"

True to form there has been a backlash against these modifications. It is however a matter of two steps forwards and a step back for now. It will hardly feature on Facebook's radar when I express my contempt on my blog. My hope is that while it may be convenient to use Facebook authentication, the unethical antics of Facebook demonstrate it to be spoiled goods. Something to stay away off.

In the final analysis Facebook is about making money for its investors. It does it by selling out the people who use Facebook to its customers.
Thanks,
      GerardM

#Wikipedia e-mail address confirmation

When you get a mail like this, receiving it from wiki@wikimedia.org, you do not necessarily want to reply. It is a spam attack, it may get you viagra or whatever..
Thanks,
     GerardM

Trusted identities on the Internet .. #NSTIC

On a White house blog the NSTIC or National Strategy for Trusted Identities in Cyberspace is announced. As I understand it, it is to help people manage their identities on the Internet. This first draft of NSTIC was developed in collaboration with key government agencies, business leaders and privacy advocates.

The need to manage your identities starts with being able to manage your password and being the owner of data about you. For me this means that I am the one who decides what information is given to whom.

Even though the need is obvious, I do not want to make Google, Facebook or any business leader the host of my data. At that I prefer for instance the Wikimedia Foundation.

The WMF hosts many international communities, it has policies that aim to protect its users. In many discussions there is talk of a Wiki movement, this is the time to quickly take the initiative and provide a socially acceptable service to manage our identities.
Thanks,
     GerardM

The White House supports OpenID

Techcrunch informed me with this news: "US Government To Embrace OpenID, Courtesy Of Google, Yahoo, PayPal Et Al."

I think it is brilliant news for OpenID and I expect it will help make the Internet a different place because your contributions are more likely to be attributed to you. I think this demonstrates that the US government understand what they are doing.

If there is one fly in the ointment, it is the OpenID providers are limited to big cooperations and I am not sure if I want to trust my data to Google, Yahoo, PayPal, AOL, VeriSign, Citi, Equifax, Acxiom, Privo or Wave Systems. I already have an OpenID and I would expect it to work as well.

At that, I would love the Wikimedia Foundation to adopt OpenID. We know it works and I would feel more comfortable when my identity on the Internet is not associated with commercial interests.
Thanks,
      GerardM

Hacking and security

When people think about security and hacking, they often think that hackers have to do incredible things to get access to systems and data. The truth is typically much more mundane. Many people and organisations do use software that is not secure. Many systems do not have all the latest patches. for all the "industry standard software" there are exploits. Typically hacking is using an exploit.

When software makes it hard to gain access to something, some people would call this a "security feature". But to make something truly secure, the software has to be written in such a way that it is designed to make it hard to get at the something.

The producer of "zoomify" explicitly says that their software should not be considered a security feature. That may make sense on several levels

• the software was not designed with security in mind
  
• the producer does not want to be liable for any exploits of the software
  

This does however not mean that exploiting this weakness is not as much a hack as abusing known exploits in "industry standard software".
Thanks,
      GerardM