The power of the keys

Google's obsession with SSO ("single sign-on") was presumably one of the drivers pushing its disastrous "Buzz" product rollout over the cliff (Pat wrote about it here, among other places). SSO is kind of like playing monopoly with a new rule that whenever you land on another player's property, they get to charge you the rent for all their properties. The concept of SSO is aggregation: Instead of having a username and password pair for your email, another pair for your social networking platform (indeed, perhaps several), a pair for your Youtube account, a pair for your Picassa account, a pair for "Google Checkout" (a credit card information-retaining platform that you have probably used without even realizing it), and so on, you would log on to all these services using a single Google account. And any others that Google later buys.

Among the many, many follies of this approach (aggregation, for instance, is a risk that I mentioned here; cf. this from 2008), the foolishness of applying a skeleton key model to disparate services on the open ocean of the web—i.e. outside of the safe inlets of campus networks—is aptly illustrated by the latest phishing attack. "It's bad enough if hackers gain control of your Twitter account, but if you also use that same password on other websites (and our research shows that 33% of people do that all of the time) then they could access your Gmail, Hotmail, Facebook, eBay, Paypal, and so forth," warns Sophos AV's Graham Cluley.

Right he is. It is true that if you break someone's username/password pair for one account or service, it isn't a bad bet that you may be able to gain access to other services for which they may have used the same credentials. If you obtain my ebay credentials, for instance, maybe I used the same credentials for my Amazon account. Maybe. But you can see where this is going. With multiple sign-on, user credential apathy may lead to a wider security breach. With SSO, however, if hackers gain control of your Google account, and you have chosen to opt in to (or been dragged unawares into) Google's interlinking of its various services, that is, in and of itself, a comprehensive security breach. An attacker has unfettered access to everything you do within Google's ever-growing ambit.

I sure hope no one signs on to their Gmail account from a public library. Be very careful about logging out, not merely closing a browser window.