Re:Evernote hacked
by simcop2387 on Saturday March 02, 2013 @02:18PM
(#5310628)
While it would work in the sense that compromising the other systems wouldn't compromise anything else. It does leave that central service as a very very very big and attractive target. It introduces a single point of failure (security wise) that lets someone compromise everyone at everything all at once. It would also make it a good target for warrants and subpoena to be sent to gather information about people without their knowledge (less of an issue, but still a concern for privacy).
Assume a central account/profile service. This service would allow you to have a single login to this service, with a directory of pretty much any/all sites and services online.
The external services would receive a hashed token of your account/authorization. They would check for the validity of the token each [interval|day|time-the-service-was-accessed] to determine if the token/auth is still valid.
They would also be able to tell the central service whether or not they require an updated token/auth, for circumstances just like this.
Further, form data could be stored on the central service, like mailing, shipping, billing, etc info. A log of all sites/accounts that request/require/use this information is kept.
Access to this and all other profile information can be reviewed/revoked by the user at any time.
Groups and layers of account information would be something that could alternately be added to the central service. I.E. - you could have a first level login to get to your dashboard, but additional security could be required to change various portions of your profile details (one passwd for address info, another for accounts)....
Avatar galleries would be available and you could tell each service which avatar to associate with what.