The Single Sign On • Hacker News Board

Re: The Single Sign On

#71

Post by matrix » Wed, Mar 10, 2010, 2:49 PM UTC

blasdel wrote: post #62

GavinB wrote: post #13

Is it just me, or did was the annoying sales guy completely right about the technology being possible, able to satisfy the client, and successful in closing a profitable deal for the company? What weird dailywtf parallel universe is this?

The one where DailyWtf submissions are always boiled down and reconstituted into unrecognizable just-so parables that read like the editors of Chicken Soup for the Soul tried to write Malcolm Gladwell articles for InfoWorld.

I wish I could upvote this 10 times. I stopped reading the dailyWTF a long, long time ago because: a) the stories are embellished to the point of being pure fiction, and b) the writer's work is so long-winded that it's just painful to read. I suspect that the author thinks he's being funny.

Re: The Single Sign On

#72

Post by itgoon » Wed, Mar 10, 2010, 2:52 PM UTC

imgabe wrote: post #19

illumin8 wrote: post #4

Hilarious, and yet, sadly, this must be true. I've been asked countless times by end users why they must login to applications. I think the general population of business (read: average) computer users honestly thinks that passwords should not be required for accessing any information. These are the same type of users that have post-it notes with passwords attached to their monitors and probably write their ATM PIN#…

I think people get the need for a password, it's just that for the average office job, you have something like at least half a dozen different passwords, with different complexity requirements and different reset schedules. At work I have different passwords for: Windows login Expense report system Timesheet system Employee information system (where I can view my pay stub, w2, etc) 401(k) provider Insurance provider…

Worth every penny: http://passwordsafe.sourceforge.net/

Re: The Single Sign On

#73

Post by jf » Thu, Mar 11, 2010, 7:04 AM UTC

washingtondc wrote: post #25

jf wrote: post #15

Earlier quoted context omitted.

I really would love to use client-side certificates everywhere. It's just too much of a pain in the ass to do so. Off the top of my head: - Generating client-side certificates is expensive or a pain in the ass. - Every browser deals with client-side certificates differently. Some give scary warnings, etc. - Firefox and IE can generate keys locally and send a CSR to you, but they do it differently. Safari can't even g…

It's not hard to generate a certificate request. While Firefox and IE may use different routines to do a local key generation, it's certainly not difficult. The scary warnings you're talking about come up if you're connecting to an "untrusted" site - who's SSL server certificate isn't signed by a known, trusted root CA. It's certainly the best solution to this problem.

Yes, generating a certificate request isn't hard. Maintaining a CA is annoying at best.

Do you have a link to a site that describes how to do local key generation in Firefox and IE? Maybe I was just looking in the wrong places?

The scary warnings I was talking about are not the "untrusted" site warnings, they are the warnings you get after the remote SSL server times out. I guess this can happen after a few hours, depending on the server.

Yes, it's the best solution to this problem, but it's still a major pain in the ass.