<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
You sneaky hacking devils! That's a great idea! I hadn't thought of
that :-)<br>
<br>
But does this solve the problem of malicious hosts taking over the
user's identity? Unless you involve that meta-tool in agent transfers,
I'm not seeing how.<br>
Can you explain more?<br>
<br>
Maybe it doesn't matter in your case, because the LL viewer can be
stripped out of all power involving inventory and such? But how about
actions involving objects already inworld that belong to the person?<br>
Please say more...<br>
<br>
Crista<br>
<br>
Stefan Andersson wrote:
<blockquote cite="mid:BLU134-W4C0C9B439CC0498E7A864D5AF0@phx.gbl"
type="cite">
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>Dear colleagues;<br>
<br>
for some time now, we at Tribal Media have employed an entirely
different way of logging the viewer in, with tokens, that does not
constitute changing the viewer.<br>
<br>
What we do, is that we install a 'launcher' app on the users computer.
It serves a number of purposes:<br>
<br>
1) Installs rezzme, genesis and osurl url monikers, all of them taking
tokens as auxiliary data - these monikers let people log onto web
sites, and launch a viewer with a pre-authenticated token by a link.
(see step 5)<br>
<br>
2) Identifies installed viewers, and keep track of preferreed viewer.<br>
<br>
3) Provides a pre-login login form to do non-web pre-launch
authentication (in this case, this would probably be where the _form_
obtains the token to pass to step 5)<br>
<br>
4) Launches pre-requisite software, as the TribalVoice.exe for when
voice should be enabled, or a Proxy to divert certain packets.<br>
<br>
5) Launched preferred user, with seamless login (using the login option
of the ll viewer with dummy data to bypass the login screen) supplying
the TOKEN in a tweaked LOGINURI - an example of this loginuri would be
-loginuri <a moz-do-not-send="true"
href="http://%7Bloginserver%7D/?token=%7Btoken">http://{loginserver}/?token={token</a>}
- have a look at the login service, it has been providing overloads and
aux data for some time now, just to be able to do this.<br>
<br>
6) Provides for hypergrid cross-login by providing both loginuri and
target region as endpoint.<br>
<br>
While we might not want to provide all these options in OpenSim, I
think our approach has worked well for us and our clients.<br>
<br>
Most of the code for these options are actually already out there in
various scattered projects.<br>
<br>
Best regards,<br>
Stefan Andersson<br>
Tribal Media AB<br>
<br>
<br>
<br>
<br>
<hr id="stopSpelling">
Date: Mon, 23 Feb 2009 14:31:25 -0800<br>
From: <a class="moz-txt-link-abbreviated" href="mailto:diva@metaverseink.com">diva@metaverseink.com</a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:opensim-dev@lists.berlios.de">opensim-dev@lists.berlios.de</a><br>
Subject: Re: [Opensim-dev] User Authentication<br>
<br>
Right. The constraint here, let's not forget, is that we want to
continue to reuse the LL viewer for a while.<br>
I'm going to read that doc about OpenID tokens, but if it requires
participation from the viewer, forget it... We are and will continue to
be in LL Viewer hacking mode in the foreseeable future, abnd I want to
make things safe before a better viewer comes along.<br>
<br>
The bottom line question in my email, phrased in OpenID terminology, is
whether we can use the Viewer's IP address as the token.<br>
<br>
<br>
Tommi Laukkanen wrote:
<blockquote
cite="mid:ad15b9430902231303t6a5cd576o526572438e3454c0@mail.gmail.com">
<div>As we cannot change the viewer at the moment one could use the
opensim login code to create the token...</div>
<div> </div>
<div>regards,</div>
<div>Tommi</div>
<pre><hr size="4" width="90%">
_______________________________________________
Opensim-dev mailing list
<a moz-do-not-send="true" class="EC_moz-txt-link-abbreviated"
href="mailto:Opensim-dev@lists.berlios.de">Opensim-dev@lists.berlios.de</a>
<a moz-do-not-send="true" class="EC_moz-txt-link-freetext"
href="https://lists.berlios.de/mailman/listinfo/opensim-dev">https://lists.berlios.de/mailman/listinfo/opensim-dev</a>
</pre>
</blockquote>
<br>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
Opensim-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Opensim-dev@lists.berlios.de">Opensim-dev@lists.berlios.de</a>
<a class="moz-txt-link-freetext" href="https://lists.berlios.de/mailman/listinfo/opensim-dev">https://lists.berlios.de/mailman/listinfo/opensim-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>