Skip to main content

Some snippets about Verisign's Personal Identity Portal

Recently I stumbled upon Verisign's Personal Identity Portal - pip.verisignlabs.com. Though still in Beta, I found it immensely impressive as an all-in-one Personal Identity Management Service.
It has a cool feature named One-Click Sign In, which allows signing in to a host of websites including Google, Yahoo, Flickr, Youtube among many others. The login credentials for the respective sites are required to be submitted. These will be encrypted using the users passkey. The only caveat for this excellent service is that one has to take Verisign's word for it, when it comes to security and privacy of the login credentials. Having trusted Verisign fully with one's secrets, all that is required is Bookmarking the One-Click sign-in link provided after submission of the credentials. Clicking on the bookmark leads to a list of the added sites, clicking on any of the sites directly signs the user in, ofcourse one has to be signed in to pip.verisignlabs.com prior to that.
Another feature is the ability to create a Personal Identity Page with a unique pip url, where one can publish personal details like name, address, email, date of birth etc. that one wants to share publicly.
The pip url also acts as an OpenID for quick sign in to any website supporting openid.
Since pip.verisignlabs.com starts acting as a one stop shop for personal identity, it becomes important to protect the PIP account, as any compromise of the PIP account leads to compromise of all the accounts listed under One-Click sign-in, as well as compromise of the OpenID. As an extra security measure, Verisign provides an optional browser authentication certificate. Even if the username and password are compromised, unless the illegitimate user has the browser authentication certificate, it is impossible to gain access to the account.
If this is still not enough for some paranoids, then Verisign provides an added layer of security by providing an optional hardware security token for a nominal fee. It generates a secret key every 30sec which is required during every login. This should be more than enough to provide considerable peace of mind to the most paranoid person on this planet.

Comments

Popular posts from this blog

Making inactve USB Hard Disk spin down automatically in Linux.

I have a 400GB Seagate IDE HDD connected to Mars, our hostel's file-server using an USB enclosure. The USB enclosure is a cheap "Made in China" product. Consequently it has some special "features". One such notable "feature" is that the disk is kept spinning by the controller even if there has been no disk I/O for a long time. I have three other USB disks connected to the same machine, a 1TB Seagate FreeAgent Desk External Drive, a 500GB Maxtor Basics External Drive and a 2.5" 60GB Fujitsu SATA Disk inside a Transcend USB enclosure. All of these spin down themselves if there has been no I/O for sometime. Keeping the hard disk spinning unnecessarily for ever, not only wastes power but also overheats the drive, thereby reducing its life. I tried noflushd, which is supposed to force idle hard disks to spin down, but found it to be of no help. USB enclosure generally work by performing an SCSI emulation over USB. sdparm is an utility which can be use

Force an application to use VPN, using iptables in Linux

Enforcing an application, for example a torrent client like Transmission , to always use the VPN interface or any particular network interface for that matter, is trivially simple using iptables on Debian, Ubuntu or any other GNU/Linux distro. Personally, I am running Debian Sid on the Raspberry Pi . Occasionally I use it for downloading files ( legal stuff, seriously, believe me :D  ) using Transmission Bittorrent client over a VPN connection. Sometimes it happens that the VPN connection fails and doesn't reconnect for whatever reason and Transmission continues pulling stuff directly over my internet connection, which I would like to avoid. Fortunately it is very straightforward to enforce rules based on application owner UID. Transmission runs under the owner debian-transmission in Debian (use htop to check this) and the following two lines of iptables ensures that any process with owner having UID, debian-transmission , will not use any other network interface apart from the

BSNL Self Care Portal on Chrome/Firefox in Linux

BSNL has recently (not sure how recent, since I returned to India after quite a few months) made some changes to their accounting system and the old intranet site (10.240.43.216) for checking unbilled usage no longer seems to be working. It has been replaced with an ultra crappy, barely functional, CRM portal from Siebel and it manages to suck better than the most powerful vacuum cleaner ever made. To make matters worse, it is labelled as " Internet Exploder only", so any other standards compliant browser, which doesn't cause the internet to explode doesn't seem to work. Having nothing better to do, I delved a bit deeper to find out why non-IE browsers fail to render this piece of shit. A little bit of Googling made me stumble upon this - link . Apparently the login window seems to be some kind of popup with some applet inside. Whichever brain-dead retard designed it, something seems to be horrendously wrong with the way the login window captures the mouse focus. C