Microsoft, stop sending user identifiers in clear text

https://annoyedmicrosoftuser.blogspot.com/2015/10/microsoft-stop-sending-user-identifiers.html

by ramen-hero • 11 years ago

221 42 11 years ago

annoyedmicrosoftuser.blogspot.com

_nedR4• 11 years ago

While you're at it Microsoft, please also give a way for users to remotely log out all active sessions on other computers and devices.

c54• 11 years ago

What would you want this feature for?

wernercd• 11 years ago

Security? Forget to log off somewhere, cell phone gets stolen, account gets hacked...

It's nice to be able to force logoff everywhere.

mglinski• 11 years ago

It's a terrible hack, but changing your Skype password via their website does log you out of all active sessions within a 2-5 minute timeframe. A friends Skype got "hacked" via a third party botting a message to all of his contacts, and as soon as I changed the password the spam stopped and soon after his local client logged out.

r00fus• 11 years ago

It's not a hack... this is exactly what is guaranteed for OAuth2 servers that follow spec to deauthorize all tokens.

Kiro2• 11 years ago

How should Microsoft resolve this? Not using CIDs at all?

po1nter• 11 years ago

Not include them in the (sub)domain name?

Kiro2• 11 years ago

So it's fine to use them in the query string?

ramen-hero• 11 years ago

The profile picture URL looks like “https:‍//cid-___.users.storage.live.com/___”. Both the host part and the path part contain your CID. The CID in the host name really doesn’t have an effect (from the client’s perspective); you could use, for example, “cid-0000000000000000.users.storage.live.com” instead, or really just “storage.live.com”.

drdaeman• 11 years ago

1. Not using any persistent identifiers when they're transferred as plain text.

2. Not allowing to retrieve any information based on persistent identifier alone i.e. require authentication for all resources (unless all data under some resource was explicitly meant to be publicly available).

3. Optionally, try to get rid of any long-term persistent identifiers (of course, besides Microsoft account ID which is meant to be persistent), in favor of ephemeral ones that are reasonably short-lived and rotated frequently.

jo9092• 11 years ago

Isn't the real point that one should not be able to obtain that much information simply by knowing some user id or user name?

I would guess plenty of services include the username in some URLs.

Edit: of course the autor also stated that, but more as a side note. Leaking the CID would not be a problem if there wasn't any futher information to be gained.

pdkl953• 11 years ago

It is well known that unique identifiers are used to identify general internet traffic as the host moves to different IPs. This works even when the intended meaning of that identifier isn't known.

https://www.eff.org/deeplinks/2013/12/nsa-turns-cookies-and-...

jo9092• 11 years ago

Fair argument that every unique id or name makes you trackable, but that is a much bigger (and IMHO long lost) battle on so many fronts, and it does not seem very fair to single out Microsoft here. And I don't think that is the motivation of the author either.

aembleton2• 11 years ago

I noticed that my bank (Halifax) sends a long numerical code to webtrends for every page that I visit. The code that it sends seems to be unique for each session.

This is blocked by uBlock but it is concerning.

spydum• 11 years ago

Different problem. That session identifier is probably unique to each session. The complaint here is that the CID is always the same for you, and can be used to look up more information (your profile)

bboreham• 11 years ago

And it's sent as part of the host, hence plaintext.

aembleton2• 11 years ago

Just checked and it is not unique to each session :(

rasz_pl• 11 years ago

http://www.windytan.com/2015/04/trackers-and-bank-accounts.h...

eponeponepon2• 11 years ago

Intriguing that this renders Tor essentially transparent in some contexts - that could almost seem by design.

I guess (unless Tor is completely broken) that there would still be more legwork involved in associating traffic from the endpoint with its corresponding traffic into Tor, but even "user logs into that service through Tor" is still a pretty fertile datapoint. Obviously Microsoft would be able to see that pretty easily anyway, but why would they make it easy for others to see it too?

devit2• 11 years ago

Why?

DNS lookups are routed through Tor just like HTTP/TCP traffic (in implementations that aren't broken).

eponeponepon2• 11 years ago

Ah, OK, I see. My understanding of Tor is far from complete, I should point out - it's not my area of expertise at all, and I'm just an interested observer!

But surely the point still stands? Even if you only see the DNS lookup as it emerges from the endpoint, you still know that User XYZ uses Tor to access Service ABC, correct?

pjc50• 11 years ago

Given that Microsoft recentralized Skype in order to make it suitably wiretappable, we can hazard a guess at the reason.

_nedR4• 11 years ago

Intriguing that this renders Tor essentially transparent in some contexts - that could almost seem by design.

I would have commented on your tinfoil hat, except for what Microsoft did to Skype post-acquisition:- Completely rewriting its protocol architecture from one which was P2P with end-to-end encryption and practically impossible to wiretap or monitor, to a centralized architecture (ostensibly for scalability reasons) which made it much more easier to wiretap or obtain metadata.

http://www.zdnet.com/article/skype-ditched-peer-to-peer-supe...

http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...

Here's a choice quote from the above article.

"In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;"

throwawaykf052• 11 years ago

When I heard about the "re-centralization" of Skype, I ran an experiment. I set up calls with a couple of people in various locations and monitored my network connections (on OSX I used nettop). Voice and video traffic is still direct P2P. It was the same when I tried it again last year. Not that I did not investigate messaging connections, nor group video chats, not mobile usage, all scenarios where a centralized service may be more useful.

However this gels with their explanation that they have only centralized the call setup servers for reliability and voice/video traffic for mobile devices where P2P is not very feasible. On laptops and PCs, where P2P remains feasible, traffic is still routed directly been peers.

Now I haven't run the same experiment in the past year, but I hope somebody will, and that too at larger scale. Given this forum is "hacker" news, there is a distinct lack of technical investigation to verify technical claims, and a disturbing propensity to take tech media for its word, especially when biases are being confirmed.

MichaelGG• 11 years ago

Impossible to wiretap or monitor? The Skype client was an obfuscated blob! There's no reason to believe it wasn't trivial for Skype to wiretap individuals. After all, authentication authority was centralized. Here's a simple test: is there a password recovery feature you can do via email or so?

There may have been evil reasons for Skype's change. Or maybe, MS realised that needlessly taking customer resources to run the Skype network isn't suitable behavior?

vbezhenar• 11 years ago

Another concern: modern HTTPS use SNI standard and those who sniff your traffic, can extract the hostname from this traffic, because it's not encrypted yet. So DNS sniffing is not necessary, if I understand everything correctly.

I would consider that as misuse of DNS. User id must be in request parameter or path, not in hostname.

bargl• 11 years ago

If you can look up skype Id by CID then this also opens your IP up to discovery. Which is a really big deal for people who stream (like my little brother).

But I have no confirmation that is possible or not. Just speculation.

mdpopescu• 11 years ago

As far as I know, this used to be a big problem in the Starcraft 2 pro gamer community, before everyone switched to naming their account "||||||||" or some such. (They would get DDOSed a lot.)

nv-vn• 11 years ago

Let's not forget the whole Skype thing where knowing a user's ID is enough to edit any of their messages.

philliphaydon• 11 years ago

Everyone seems to talk about what MS should do, and why it's bad. But I wonder why the people working on these systems do not think or feel the same, and want to fight internally to fix it etc.

Microsoft, stop sending user identifiers in clear text

Related Stories