Sabin Linden informs us that the login process for the viewer is going to change to address anti-fraud and other security issues. Essentially, you're not going to be logging in through the viewer anymore.
Instead, logins will be processed through the Second Life website, and the browser launched from there with a custom, secure token included in a secondlife:/// link. The token is valid for five minutes.
While the solution has been tested internally to function fine with Windows and Mac viewers, the Linux viewer solution still needs work.
If you use multiple accounts (need to log out of one on the website and into another) this could be very cumbersome. Likewise if you use more than one kind of viewer (beta, release candidate, homebrew...). There are also concerns with how this will affect bots and non-traditional viewers (Katharine Berry's AJAXLife, etc), essentially making the login process potentially more involved.
It shouldn't be too difficult to provide working login services for alternative grids, however.
Ultimately the aim appears to be that the viewer never has access to your password, though the initial release should still have a familiar login screen that passes through the web-service to authenticate, and bots will continue to function as they are until at least the second iteration. After that they will need to post and retreive data from the web-service - which is not all that different to what they are currently doing.
While efforts to beef up security from potentially malicious viewers is laudible, really the viewer doesn't need your password. Once you're logged in, a malicious viewer can do anything it likes with your account that you could do, and can actively conceal from you that it is doing it (sending all your money to someone else, and displaying a false balance, for example).
1. kk a linden informs YOU but not the actual resident population. Did they inform YOU about the VAT thing too? Just how closely are YOU linked to LL?
Posted at 5:02AM on Sep 29th 2007 by sirhc DeSantis