Proof-of-concept public key authentication for web users • Hacker News Board

Re: Proof-of-concept public key authentication for web users

#21

Post by viraptor » Tue, Jul 19, 2011, 10:48 PM UTC

nodata wrote: post #14

viraptor wrote: post #2

How is that different from client certificate authentication? It seems strange that solution is not mentioned at all.

The terrible, terrible UI. Plus: the same problem as normal SSL certs: the registries aren't secure/trustable.

UI is just an implementation part. If the main point was to improve on the user interaction side, I missed it completely. Only things he provided were an idea roughly equivalent to the existing one and a shell script which needs to be run outside of the browser. It's hardly better than "pick one entry from the dialog box", however ugly that dialog box is.

Re: Proof-of-concept public key authentication for web users

#22

Post by udoprog » Tue, Jul 19, 2011, 11:41 PM UTC

viraptor wrote: post #21

nodata wrote: post #14

Earlier quoted context omitted.

The terrible, terrible UI. Plus: the same problem as normal SSL certs: the registries aren't secure/trustable.

UI is just an implementation part. If the main point was to improve on the user interaction side, I missed it completely. Only things he provided were an idea roughly equivalent to the existing one and a shell script which needs to be run outside of the browser. It's hardly better than "pick one entry from the dialog box", however ugly that dialog box is.

No, the main point is to show how simple client verification actually is. This implementation is one step up on the application stack into a comfort zone which seems to be more acceptable by devs.

I believe in design in depth, and by allowing the most basic of techniques (form submission + cli tool stack) to handle something that is generally perceived as difficult and letting people "get" the manual process, the automation might not seem as daunting.

I did not intend to create a standard, just to provoke more discussion. I would however by gladly surprised if I woke up tomorrow and twitter allowed me to sign in by solving a challenge instead of a password : ).

Re: Proof-of-concept public key authentication for web users

#23

Post by jesboat » Thu, Jul 21, 2011, 4:09 AM UTC

a3_nm wrote: post #8

What we need is a public key authentication scheme with the possibility for normal users to delegate their identity to some trusted third party to which they hand their public key (like with OpenID). I think this would be the best of both worlds: normal users get a seamless experience, and nerds have total control over their identity without even needing to, say, own a domain name and trust DNS.

nothing prevents an openid provider from using cert-based auth now