Ask HN: Thoughts on a website-embeddable, credential validating service? • Hacker News Board

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#11

Post by jlgaddis » Thu, Feb 22, 2018, 10:51 PM UTC

westurner wrote: post #2

blockchain-certificates/cert-verifier-js: https://github.com/blockchain-certificates/cert-verifier-js > A library to enable parsing and verifying a Blockcert. This can be used as a node package or in a browser. The browserified script is available as verifier.js. https://github.com/blockchain-certificates/cert-issuer > The cert-issuer project issues blockchain certificates by creating a transaction from the issuing i…

Exactly what part of such a service would benefit from anything related to a blockchain?

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#12

Post by jimrandomh » Thu, Feb 22, 2018, 11:13 PM UTC

estroz wrote: post #6

jimrandomh wrote: post #3

It sounds like this architecture (particularly the iframe bit) involves submitting the users' passwords to a third-party service to be validated. Developers and admins are likely to be hesitant about that, because the service host will end up being a significant target and a potential point of failure. This is partially avoidable; you can hash the password on the client and send the hash, and compare against the hash…

The library alternative was suggested in another comment and is definitely a path I'll consider over a service. The goal of this project wouldn't necessarily be to start a business, but to help standardise how websites interact with sensitive user data. Perhaps encrypting hashed passwords with a session key and matching against hashes encrypted with that key server-side would solve the issue you mention.

In order to do that you'd have to re-hash each of the data-dumped passwords with a new salt, each time you wanted to do a comparison. But a good password-hash algorithm is specifically designed to be slow, so re-hashing the whole database will take quite a lot of computational power, likely enough to make that strategy infeasible.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#13

Post by westurner » Thu, Feb 22, 2018, 11:56 PM UTC

jlgaddis wrote: post #11

westurner wrote: post #2

blockchain-certificates/cert-verifier-js: https://github.com/blockchain-certificates/cert-verifier-js > A library to enable parsing and verifying a Blockcert. This can be used as a node package or in a browser. The browserified script is available as verifier.js. https://github.com/blockchain-certificates/cert-issuer > The cert-issuer project issues blockchain certificates by creating a transaction from the issuing i…

Exactly what part of such a service would benefit from anything related to a blockchain?

Are you asking me why blockcerts stores certs in a blockchain?

Or whether using certs (really long passwords) is a better option than submitting unhashed passwords on a given datetime to a third-party in order to make sure they're not in the pwned passwords tables?

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#14

Post by jessaustin » Fri, Feb 23, 2018, 12:15 AM UTC

Why are you calling this a "credential validating service" rather than a "password validating service"? Credentials don't have to be passwords, instead they could be tokens or signed data. Passwords are the worst credentials, and they should only be considered when nothing else would work. The form of validation you propose is not exhaustive either. "a" repeated 57 times might not be on any of the lists, but it's still a bad passphrase.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#15

Post by brooklyn_ashey » Fri, Feb 23, 2018, 6:28 AM UTC

westurner wrote: post #13

jlgaddis wrote: post #11

Earlier quoted context omitted.

Exactly what part of such a service would benefit from anything related to a blockchain?

Are you asking me why blockcerts stores certs in a blockchain? Or whether using certs (really long passwords) is a better option than submitting unhashed passwords on a given datetime to a third-party in order to make sure they're not in the pwned passwords tables?

I was just reading about a company trying to make self-sovereign identity including actual certs (like degrees and such) an accessible and widely applicable/acceptable technology using Ethereum blockchain. I thought it showed some real practicality and promise. I believe it begins with U- forgot the name.Perhaps UPort? Anyhow, I'd be interested in hearing from anyone here about why that might be a bad or good idea. I don't personally have the skill in that tech to know.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#16

Post by bgdkbtv » Fri, Feb 23, 2018, 9:08 AM UTC

estroz wrote: post #8

bgdkbtv wrote: post #7

Why do you think this would need a service? It’s really easy to make as a dev using Have I Been Pwned Password API: https://twitter.com/noncototient/status/966628069048950784 Unless you’re talking about users whose dev skills only go as far as posting Wordpress articles. Then it might work, but integration would have to be super simple, I frame might not be the easiest solution for them.

Unsophisticated users are exactly who I would be targeting. I would likely have to make widgets to integrate with common site building services like WP. An iframe is likely the simplest solution if they're building a site from scratch though.

If you’re thinking of going with the iFrame path, you’ll have to make the whole iFrame a form. You’ll be competing directly with Gravity Forms. And they are huge, while your only competitive advantage is a feature they can implement in less than 5 minutes.

I’d love to see you make it work and make you money, but I’m not convinced yet.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#17

Post by ecesena » Fri, Feb 23, 2018, 7:45 PM UTC

My personal feeling is that signup of a new user is too critical of a function to depend upon an external service. I would very much prefer a client-side library as others have stated.

This said, I can see a ton of potential for a plug & play solution, for example (but not limited to) a signup form for wordpress, a react input password component with a strength bar, etc.

If you create "a product that people love", I don't think it does really matter whether you verify on the client side, or securely via a remote service. You may explain pros and cons, and let the admin decide.

But I'd focus on the final solution, rather than just the service itself.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#18

Post by westurner » Fri, Feb 23, 2018, 7:53 PM UTC

brooklyn_ashey wrote: post #15

westurner wrote: post #13

Earlier quoted context omitted.

Are you asking me why blockcerts stores certs in a blockchain? Or whether using certs (really long passwords) is a better option than submitting unhashed passwords on a given datetime to a third-party in order to make sure they're not in the pwned passwords tables?

I was just reading about a company trying to make self-sovereign identity including actual certs (like degrees and such) an accessible and widely applicable/acceptable technology using Ethereum blockchain. I thought it showed some real practicality and promise. I believe it begins with U- forgot the name.Perhaps UPort? Anyhow, I'd be interested in hearing from anyone here about why that might be a bad or good idea. I…

Known Traveler Digital Identity system is a "new model for airport screening and security that uses biometrics, cryptography and distributed ledger technologies."

Blockcerts are for academic credentials, AFAIU.

[EDIT]

Existing blockchains have a limited TPS (transactions per second) for writes; but not for reads. Sharding and layer-2 (sidechains) do not have the same assurances. I'm sure we all remember how cryptokitties congested the txpool during the Bitcoin futures launch.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#19

Post by brooklyn_ashey » Sat, Feb 24, 2018, 5:50 AM UTC

westurner wrote: post #18

brooklyn_ashey wrote: post #15

Earlier quoted context omitted.

I was just reading about a company trying to make self-sovereign identity including actual certs (like degrees and such) an accessible and widely applicable/acceptable technology using Ethereum blockchain. I thought it showed some real practicality and promise. I believe it begins with U- forgot the name.Perhaps UPort? Anyhow, I'd be interested in hearing from anyone here about why that might be a bad or good idea. I…

Known Traveler Digital Identity system is a "new model for airport screening and security that uses biometrics, cryptography and distributed ledger technologies." Blockcerts are for academic credentials, AFAIU. [EDIT] Existing blockchains have a limited TPS (transactions per second) for writes; but not for reads. Sharding and layer-2 (sidechains) do not have the same assurances. I'm sure we all remember how cryptokit…

Thank you. I looked into "clear", one of the airport known traveler ID systems. (I'm assuming there are others) It's pretty cool/concerning. Takes ~ 8 min to load a traveler into its system. Thanks for reminding me of TPS---the info on read vs write.