Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Single Sign On

thedailywtf.com

Post reply on HN
Print view View original

61–70 of 73 posts

Re: The Single Sign On

#61

Post by ghfdrvtsyup »

imgabe wrote: post #19
illumin8 wrote: post #4

Hilarious, and yet, sadly, this must be true. I've been asked countless times by end users why they must login to applications. I think the general population of business (read: average) computer users honestly thinks that passwords should not be required for accessing any information. These are the same type of users that have post-it notes with passwords attached to their monitors and probably write their ATM PIN#…

I think people get the need for a password, it's just that for the average office job, you have something like at least half a dozen different passwords, with different complexity requirements and different reset schedules. At work I have different passwords for: Windows login Expense report system Timesheet system Employee information system (where I can view my pay stub, w2, etc) 401(k) provider Insurance provider…

If you have that many passwords, why not make some sort of base password and then riff off of the base password for everything that needs access (and have a mental sequence for when an item needs a reset)? If your base password is at the highest complexity requirement, the only thing you need to remember is the individual sequences.

I do this for my passwords and it's been working for me for years ...

Re: The Single Sign On

#62

Post by blasdel »

GavinB wrote: post #13

Is it just me, or did was the annoying sales guy completely right about the technology being possible, able to satisfy the client, and successful in closing a profitable deal for the company? What weird dailywtf parallel universe is this?

The one where DailyWtf submissions are always boiled down and reconstituted into unrecognizable just-so parables that read like the editors of Chicken Soup for the Soul tried to write Malcolm Gladwell articles for InfoWorld.

Re: The Single Sign On

#63

Post by chops »

kgermino wrote: post #59
gridspy wrote: post #57

Earlier quoted context omitted.

The salesperson did say that there was only a single client... “But we don’t need to change it for everyone,” Craig jumped in, “just one client. Surely, you can do that!”

He would have meant one client as in one company, not one user.

Perhaps the salesperson meant "one client machine" and the programmer assumed that, given the context, meant "one client company." Client can be a rather ambiguous term.

Re: The Single Sign On

#64

Post by sjs »

chops wrote: post #63
kgermino wrote: post #59

Earlier quoted context omitted.

He would have meant one client as in one company, not one user.

Perhaps the salesperson meant "one client machine" and the programmer assumed that, given the context, meant "one client company." Client can be a rather ambiguous term.

You're giving the sales guy far too much credit.

Re: The Single Sign On

#65

Post by bricestacey »

"After going back to the drawing board, Gerald came up with another idea: configure the firewall proxy server on the client’s side to add a custom HTTP header (X-Forwarded-For) that included the original IP address. That idea went over just about as well: HTTP headers could be forged, and a malicious employee inside of the company could hack in too easily."

I believe this is a perfectly acceptable solution, except they should strip any existing X-Forwarded-For headers sent by a client and only auto-login users originating from the NAT.

Problem solved... I think?

Re: The Single Sign On

#66

Post by nostrademons »

gjm11 wrote: post #30
nopassrecover wrote: post #20

Earlier quoted context omitted.

Can you elaborate on Kolmogorov complexity and its relevance to someone who has not encountered the term before? (I have wikied it: http://en.wikipedia.org/wiki/Kolmogorov_complexity but sleep deprivation may be hindering my ability to spot the link)

To someone who doesn't understand what's going on, it may seem simpler to make something work for one person than to make it work for lots of people; but in fact the version that works for lots of people may be no less simple. (It may even be simpler, if it's necessary to put in special-case testing to make sure that only one person can use it.) From an implementer's perspective, the right measure of the complexity o…

3. It's quite possible to determine what the Kolmogorov complexity of something is, it's only impossible to determine what the Kolmogorov complexity of everything is. The halting problem only states that it's impossible to prove whether an arbitrary Turing machine halts. There're many Turing machines that can be proved to halt, some quite easily. For example,

  int main(int argc, char** argv) {
    return 1;
  }
can be proved to halt pretty easily, just looking at the CFG for the program.

Re: The Single Sign On

#67

Post by Herring »

kemiller wrote: post #5

That was actually a pretty clever solution he came up with. I didn't see the punchline coming.

Hang on. If (s)he hates remembering passwords, why not slap on something biometric on top of the normal login process?

Re: The Single Sign On

#68

Post by Herring »

nostrademons wrote: post #66
gjm11 wrote: post #30

Earlier quoted context omitted.

To someone who doesn't understand what's going on, it may seem simpler to make something work for one person than to make it work for lots of people; but in fact the version that works for lots of people may be no less simple. (It may even be simpler, if it's necessary to put in special-case testing to make sure that only one person can use it.) From an implementer's perspective, the right measure of the complexity o…

3. It's quite possible to determine what the Kolmogorov complexity of something is, it's only impossible to determine what the Kolmogorov complexity of everything is. The halting problem only states that it's impossible to prove whether an arbitrary Turing machine halts. There're many Turing machines that can be proved to halt, some quite easily. For example, int main(int argc, char** argv) { return 1; } can be prove…

Yeah CS theory & practice are often quite different.

http://en.wikipedia.org/wiki/Termination_analysis

Re: The Single Sign On

#69

Post by gjm11 »

nostrademons wrote: post #66
gjm11 wrote: post #30

Earlier quoted context omitted.

To someone who doesn't understand what's going on, it may seem simpler to make something work for one person than to make it work for lots of people; but in fact the version that works for lots of people may be no less simple. (It may even be simpler, if it's necessary to put in special-case testing to make sure that only one person can use it.) From an implementer's perspective, the right measure of the complexity o…

3. It's quite possible to determine what the Kolmogorov complexity of something is, it's only impossible to determine what the Kolmogorov complexity of everything is. The halting problem only states that it's impossible to prove whether an arbitrary Turing machine halts. There're many Turing machines that can be proved to halt, some quite easily. For example, int main(int argc, char** argv) { return 1; } can be prove…

I think that even in practice being able to determine the Kolmogorov complexity exactly is very decidedly not the usual case; you need to know that every program shorter than your candidate fails to do the right thing.

Your general point is very much correct, though. A clearer-cut application: In general, one cannot prove that a program does what it's supposed to; but if doing that is important, "all" you have to do is write it in a way that makes a correctness proof possible.

Re: The Single Sign On

#70

Post by imgabe »

ghfdrvtsyup wrote: post #61
imgabe wrote: post #19

Earlier quoted context omitted.

I think people get the need for a password, it's just that for the average office job, you have something like at least half a dozen different passwords, with different complexity requirements and different reset schedules. At work I have different passwords for: Windows login Expense report system Timesheet system Employee information system (where I can view my pay stub, w2, etc) 401(k) provider Insurance provider…

If you have that many passwords, why not make some sort of base password and then riff off of the base password for everything that needs access (and have a mental sequence for when an item needs a reset)? If your base password is at the highest complexity requirement, the only thing you need to remember is the individual sequences. I do this for my passwords and it's been working for me for years ...

That's more or less what I do. Not everyone cottons on to this scheme though. With the logins I might use once every 6 months or so, it can still be hard to remember which variation I'm on, especially if it's a "three tries then you're locked out" system.
Post reply on HN