Possible change in logging on to SL

Another fantabulous reason to use the forums for authentication occurred to me while trying to read this thread:Brilliant, absolutely brilliant!

ok next time don`t use the tags it really causes a mess in message.......

And a lot of people don't know how to go find another browser and download it and install it -- nor do they understand why they should.

I'm guessing this actually means "thanks for the explanation"

Thanks for this, Kitty, really rather alarming for those of us who have a forum login active all the time, regardless of who we're logged in as. Plus, I'm no auth expert, but I question how much, if any, security this adds.

Nicholaz has posted a response to this on his blog, and suggests there that those of us with objections/concerns respond Quickly and directly to the ongoing development discussions. http://nicholaz-beresford.blogspot.com/

I just posted this on the discussion wiki, as recommended by Nick. Kitty or anyone else, do let me know if I said something stupid. Thanks.
---------------------------------------
Usability
I think you will find that the marginal security improvement is far outweighed by the negative usability impact of this proposed (I hope only proposed) change. It impacts residents who bring commerce into SL the most, since estate owners and businessfolks generally use one account for website transactions, and a small set of alts to manage their inworld lives.

Builders and scripters will also find this impossibly awkward, since they often need to have two accounts logged in at once for testing.

Forum users will also be negatively impacted; I leave the forum logged in all day on one account, regardless of which alt I am using inworld. If any.

Please reconsider.

Thank you for helping clear this up.

EDIT---------------------------------------------

After speanding some time reading the wiki, it seems that the client is no longer safe to use ( well as long as LLABS is concern it is ). Log in to the web site? Oh come on!

What strange about this is, many knew this hole for hackers was going to happen ( AND IT DID )! LLABS lazyness in creating a better Viewer ( by passing it along to the user base ) has created not only the a better option for some. But also to let the mice run in and cause all kind of problems. Many saw this coming, many called for a safer way for users to use the SL. But did LLABS hear us? NO! Not until the damage was done. Thank you kitty for exposing this topic to us...........


Usagi

Very well put I'd say.

i am voting for you for president in rl

(goes to get her magic markers and posterboard)

My job's main bank has its web interface set up to work specifically with IE. You can do *most* things with other browsers, but not all. We're their largest client, with millions of dollars going in and out every day, and have to live with the knowledge that they CHOSE to base the interface on the least secure browser out there. Nifty, huh?

That's perfect .

The only reason I posted it here is because most people aren't going to care about the shiny underlying technological changes, but the everyday changes that come with it (although the SLdev focused on those a lot as well).

I still wish we had a more centralized way of finding things out though, or contributing feedback back instead of having to stumble onto random bits of information all the time .

The days of letting us know about possible hacking issues, password issues, mainland grif attacks etc is a thing of the past. Its all about saving money and telling us its up to us to know about such issues. Gone are the days LLABS expressed a caring thought about its users. But now like most lindens they are only workers that run around either trying to fixs codes or breaking them.

Usagi

I use two computers. One for surfing, which includes the secondlife.com site, and one for Second Life, Hipihi, Multiverse, There, etc. The surfing machine is not really fit for 3D animated graphics.

This change is gonna be another bit of bother for dual computer folks, eh?

I'll agree. consider that one /signed.

Also, what bugs me is that they want SL to push out the 2D web browser. Did they change their minds or did they finally realize that SL is not going to be able to handle in this space/time?

Rob posted a message (https://lists.secondlife.com/pipermail/sldev/2007-September/005403.html) to the SLdev list stating it's not set in stone and that they'll look at concerns and/or weaknesses and/or alternative proposed by the community (my word choice, and really just means those who are contributing to the viewer).

All in all: yay!

All I know is that I trust Nicholaz far more than LL. And the irony is that Linden Lab trusts open software for their own login authentication* already.

Because this isn't obvious to some, allow me a little pedantry. There is a protocol called Secure Sockets Layer (SSL); this is the protocol that protects many internet exchanges, for example when you give your credit card number to amazon.com you may notice that the protocol for that page has changed from "http" to "https" where "https" is the regular web protocol running over an SSL encrypted channel. Other services use SSL to provide an encrypted channel for secret stuff (such as the "My Account" page on Google.com)

Linden Lab thought that it would be a good idea to have logins to the grid also be handled using SSL. That is why you will find a file named "ssl3.dll" in the Second Life program directory. If you look at the details of that file you will find that it is the open, free software implementation of SSL from the Mozilla Foundation*. So far so good, they are using a well known, free, open source security library to send your password to LL so that no one in the middle can see your login information.

Here come the real kick in the teeth. Look up there at the top of the forums.secondlife for the User Control Panel ("User CP". through that page you can change your forum password THROUGH A TOTALLY NON-ENCRYPTED, NON-SECURE, REGULAR FARKING http PAGE.

So authenticting through their current forum web site doesn't offer you the same security that the current SL viewer does, It offers NONE AT ALL.

Fucking brilliant.

*http://www.mozilla.org/projects/security/pki/nss/ssl/

Yes, despite popular belief in the Linux users enclave, a large number of people do quite happily, because for those who aren't computer savvy to use Linux, Firefox, Solaris, Mac, Vista, CP/M etc and would just like a common system that works then IE works great.
If Linux etc is so good, great, just don't push it on other people or complain that the there's no Linux version of something or it doesn't work when other versions do

Seeing it's least secure, I'm guessing the bank is loosing millions of dollars regularly?
Other systems are mainly more secure because they are less common, so less hackers are trying to crack them. You could be more secure than Linux just by using a completely incompatable system to everyone else. Maybe that's the aim of Vista

Well IE works fine for me and many other people why should people change and go the setup process which is unfriendly for average users just to wave the alternative flag?
If others were No1, people would be knocking it as much as IE gets now.
People also complain other languages are better than English, but it's the one we get taught in most English speaking countries for good reasons.

This is not the OS or browser war forum or thread. There are plenty of totally useless stupid threads in this forum that would be improved by having OS and platform wars in them. This is not one.

I don't like the sound of this change in login procedures.

I also don't find a statement that it's not cast in stone to be of much cheer. Sabin Linden's email in SLDEV didn't sound like it was a proposal.

I do have a question: what effect would this proposed change have on folks that run a slew of campbots, landsearch bots, and other high-volume libsecondlife bot operators?

IE is easier to set up because its already there. Firefox downloads, installs, imports anything and everything you want from IE as easily as installing any bit of software I can think of.

I use IE only when I have to run a windows update. For every other purpose, if a website requires IE, I find someone else to work with.

And count me with the crowd that has my main avatar logged into the website full time, regardless of what other avatars I might have logged in or out of the system. And it will seriously tick me off if I have to log my main out so that my alt can test permissions. Its easier for both to be standing there so I can fix any issues and hand off a copy again for testing than it would be to log in, log out, log in, log out... all the while having to do it in a separate screen to get there!

Char

Well, not that I'm aware of, but leaving your keys in the car on a regular basis isn't automatically safe just because no one's stolen it YET.

I don't like this idea of LL's either.

I regularly use two computers to have two accounts logged in simultaneously. I also occassionally login two accounts on a single computer using the -multiple option.

I guess the -multple option becomes useless if LL goes this route.

This is bothersome, indeed.

LINDEN LAB IS THE MOST INCOMPETENT INTERNET COMPANY WE HAVE EVER SEEN !!!

VAT TO EU RESIDENTS. GOD DAMIT THAT REGULATION DATES FROM JULY 1 2003 !!!!!!

IT IS NOT MORE THAN NORMAL TO UNDERSTAND THAT PRICES ARE TAX INCLUDED AND NOW ALL OF THE SUDDEN IT IS ADDED !!!

BUNCH OF MORBID STUPID CHILDREN LINDEN LAB IS.
I’M LEAVING !!!

AND I WILL DO ANYTHING IN MY POWER TO HAVE LINDEN LAB NEGATIVE IN THE NEWS ALL I POSSIBLY CAN !!!

TECHNICAL PROBLEMS, SUDDEN RULE CHANGES !!!

WHAT KIND OF COMPANY IS THIS…. GOD DAMIT !!!!

Not a great deal - they'll have to modify their logon code to the new system (if implemented) so a bit of hassle there - but thereafter business as usual.

Matthew