W3C approves WebAuthn as the web standard for password-free logins • Hacker News Board

Re: W3C approves WebAuthn as the web standard for password-free logins

#151

Post by mderazon » Fri, Mar 08, 2019, 12:50 PM UTC

This will make sharing accounts between people much harder

Re: W3C approves WebAuthn as the web standard for password-free logins

#152

Post by mehh » Tue, Mar 12, 2019, 7:14 PM UTC

agentultra wrote: post #148

mehh wrote: post #142

Earlier quoted context omitted.

Which flavour of Formal Mathmatical language would you suggest it should be written in?

TLA+, Alloy, Isabelle, Coq, or Lean would all be fine choices. I'd prefer TLA+ myself as the language, TLA, is straight-forward maths.

What about Z or B?

Re: W3C approves WebAuthn as the web standard for password-free logins

#153

Post by mgoetzke » Thu, Mar 14, 2019, 6:52 AM UTC

WorldMaker wrote: post #42

mgoetzke wrote: post #4

If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.

Hailstorm was always just a very early version of what today we see in OAuth/OpenID Connect. The one that we should be truly sad didn't connect with enterprises/consumers was Vista-era CardSpace ( http://en.wikipedia.org/wiki/Windows_CardSpace ). That was an early play at what today we are finally seeing in FIDO / Webauthn standards, with a rather good UX to go with it (using the visual metaphor of plastic cards/cred…

Sorry I mixed that up. I meant CardSpace, thought it was codenamed Hailstorm. Hailstorm being the protocol being used by CardSpace

Re: W3C approves WebAuthn as the web standard for password-free logins

#154

Post by mgoetzke » Thu, Mar 14, 2019, 6:53 AM UTC

smacktoward wrote: post #47

mgoetzke wrote: post #4

If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.

Hailstorm wasn't really the same thing. It positioned Microsoft as a centralized identity provider, with MS holding all the user data and everyone else just connecting to proprietary Microsoft online services to check if the user was who they said they were. Kind of like Facebook Login, but built around 2000s-era-trendy technologies like XML and SOAP instead of JavaScript and JSON. It's hard to see how Hailstorm woul…

yeah i mixed that up, I meant CardSpace as was pointed out. Still a no-go for other reasons though.