41–50 of 55 posts
I use it if have to. Prefer the choice of selecting different names/passwords for different sites.
Why?
Lately I've been thinking that what we really need is something based on PGP/GnuPG. Think about it. If the browser implemented access to your keychain, then you could use your keys as login. When you 'sign up' you would just provide you public key to the website (upload or url). Then when you were presented with a login, the browser would be sent a data set to sign with your private key and send back to the server yo…
I've been thinking about OpenPGP based website authentication too. You should check out the web pages I have book marked under the "gpg" tag: http://delicious.com/jf/gpg My main frustration right now is that, aside from Bouncy Castle, all the libraries I've looked at to do cryptography seem to just be partially implemented wrappers around GnuPG.
Lately I've been thinking that what we really need is something based on PGP/GnuPG. Think about it. If the browser implemented access to your keychain, then you could use your keys as login. When you 'sign up' you would just provide you public key to the website (upload or url). Then when you were presented with a login, the browser would be sent a data set to sign with your private key and send back to the server yo…
I don't know much about OpenID. Is it possible to use it without knowing it?
I didn't think much of it, but after using it for a week, I wish it was used everywhere. To those of you who haven't used it, try it out before condemning it. It's really nice to login with the click of a button (no typing usernames and passwords) and signing up is usually a one click action as well.
What's the best way to start for someone who doesn't want their entire internet identity tied with up Yahoo, Google, or Facebook?
Earlier quoted context omitted.
I've been saying this the whole time and nobody seems to view it as a serious problem. Sure, there are users who will use the same username and password on every site, and there's no hope for them. However, there is a class of users who might think with openid they can use the same credentials for their bank as they do for facebook, but not know to check for valid ssl certificates and nefarious proxying. Can someone…
Good openid providers like wordpress train their users not to expect a login page on anything a authenticating website redirects them to.
I use it (only for StackOverflow) but I don't think it's better or worse than normal logins. Sometimes it's a pain because I always have to do extra clicks to get logged in.
OpenID login can be pretty fast if you use a client-side SSL certificate: http://joel.franusic.com/How-to-set-up-a-client-side-SSL-cer...
Earlier quoted context omitted.
I've been thinking about OpenPGP based website authentication too. You should check out the web pages I have book marked under the "gpg" tag: http://delicious.com/jf/gpg My main frustration right now is that, aside from Bouncy Castle, all the libraries I've looked at to do cryptography seem to just be partially implemented wrappers around GnuPG.
actually it is possible already to set up certificates and use them for authentication, in firefox you can check this under preferences/advanced/encryption
Earlier quoted context omitted.
actually it is possible already to set up certificates and use them for authentication, in firefox you can check this under preferences/advanced/encryption
I really like client-side SSL certificates, I just hate dealing with custom root certificates. I'm excited about using the OpenPGP web-of-trust to add a "social" layer to applications. For example: "Allow any of my friends to log in to this server".
If all I had to do was grab their public key, I could then do everything behind the scenes (even creating groups so that some people can see some photos and others can't).