Category Archives: Uncategorized
Kerberos & load-balanced OpenSSO – GSS Channel binding exceptions
Recently I’ve been working with a client to build a federated SSO system. One of the requirements was for internal employees to have seamless access using Windows’ Kerberos. This isn’t anything novel, and is something I’ve worked on for a … Continue reading
Burning gas
Being at home over Christmas, followed by a week of cold weather has meant a rather poor start to my aim to achieve 10:10.
Watching my PII
For a while I’ve been thinking about how personal identity data (often called Personally Identifiable Information, or PII) is managed – both as a consumer, and from the perspective of service providers. I’ve been following along with the work being … Continue reading
SAML Federation for dummies
A couple of times recently I’ve had to explain SAML-based federation to people whose areas of expertise lie outside identity and security. After repeatedly drawing things in different ways on a whiteboard, I found myself working towards a real-world analogy. … Continue reading
User-centricity
Last week, I gave a talk at IDM 2009 entitled ‘Privacy and Data Minimisation with Improved Business Returns’. A bit of a mouthful and the result of title-decision-by-committee, but good subject matter! The main message of the talk was that … Continue reading
OASIS – Identity Management 2009
On 29/30th September, I went to the OASIS Identity Management 2009 forum, the theme of which was ‘Transparent Government: Risks, Rewards and Repercussions’. It was my first time at an OASIS event, and befitting the organisation and the location (it … Continue reading
Laws of Identity
There’s a stereotypical image that people who work at Microsoft are insular and inward-looking. Kim Cameron is far from that. He regularly posts insightful commentary on the ‘identity metasystem’ on his blog, and is widely seen as a ‘thought leader’ … Continue reading
More on Facebook security
This week I’ve come across two more articles about Facebook’s poor security/privacy. The first by Ian Glazer on the Burton Group Identity blog notes that apps can get access to all your details even if your privacy settings are set … Continue reading
Chroma-Hash
It’s rare that IT security and aesthetics come even close to being related, however I stumbled across something on the Information Aesthetics blog this week which peaked my interest. I’ve come across some debate recently around passwords. It seems to … Continue reading
Facebook Security
Despite my better judgment, I’m still using Facebook. All of my friends and acquaintances use it, increasingly as an IM application, and not just for posting inane status updates. Indeed Adium, my IM client of choice, now supports Facebook chat, … Continue reading