Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#1

Post by seanplaice » Sat, Jan 08, 2011, 7:41 PM UTC

I have been intrigued by the autho.me project. Last night it was great to see a conversation between Dan Kaminsky and Zed Shaw about specifics of autho.me.

Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
curated.by

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#2

Post by troutwine » Sat, Jan 08, 2011, 7:52 PM UTC

That is incredibly hard to read.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#3

Post by JeffJenkins » Sat, Jan 08, 2011, 8:04 PM UTC

troutwine wrote: post #2

That is incredibly hard to read.

Is this what all of twitter is like? I tried reading both this and that less ambitious movie titles page and it was really hard.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#4

Post by tptacek » Sat, Jan 08, 2011, 8:07 PM UTC

So for a whole long bunch of messages you have two people talking past each other about how the world uses passwords and the semantics of SSO and then "Is your SRP math constant time with respect to the passwords in use". Zed, seriously? This is making me sad.

Best to make sure your HMAC implementation is constant time with respect to the key, too!

If you think for just a little while, I think you can spot the "semantic" difference between using RSA and SRP in this scenario, and why using one instead of the other would change this system from a curiosity to a danger.

Has it occurred to you that this is the best conversation you've had about AUTHO.ME so far because it appeared authoritative but didn't challenge you at all? Is that what you want? Preening isn't going to make your system better. I'm trying hard to believe that you're better than that.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#5

Post by spooneybarger » Sat, Jan 08, 2011, 8:07 PM UTC

troutwine wrote: post #2

That is incredibly hard to read.

Hit more til you get to the beginning and then read up the page.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#6

Post by citricsquid » Sat, Jan 08, 2011, 8:07 PM UTC

troutwine wrote: post #2

That is incredibly hard to read.

Yeah, what on earth... it seems to be in reverse order, so to start reading I have to scroll down and click more until the entire thing is loaded, then read back up? This is... what.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#7

Post by [deleted] » Sat, Jan 08, 2011, 8:08 PM UTC

JeffJenkins wrote: post #3

troutwine wrote: post #2

That is incredibly hard to read.

Is this what all of twitter is like? I tried reading both this and that less ambitious movie titles page and it was really hard.

[deleted]

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#8

Post by pak » Sat, Jan 08, 2011, 8:12 PM UTC

troutwine wrote: post #2

That is incredibly hard to read.

Yes, this is why Twitter without intelligent clients reformatting all of this garbage (I have to read this backwards to make any sense of it) is unenjoyable for most power users.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#9

Post by cmelbye » Sat, Jan 08, 2011, 8:17 PM UTC

I don't understand autho.me, how is it supposed to be better than OpenID? In my opinion, it's worse than OpenID because with OpenID you can at least throw up a webpage at http://openid.yourcustomdomain.com/ and just edit a few meta tags when you need to switch to a different provider. I would personally only consider this if it were open source, and it's not so I can't see the draw.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#10

Post by gst » Sat, Jan 08, 2011, 8:19 PM UTC

I still don't get the reason why I should use autho.me over OpenID.

With OpenID the site to which I want to login redirects me to my OpenID provider. So the advantages are:

- I login on the site of my OpenID provider and the site to which I want to login does not learn my password.

- I can check the identity of the OpenID provider before disclosing my password (e.g., by checking the SSL certificate).

- The OpenID provider does not need to use a password-based login system, but can use other things (like secure tokens or OTP-based auth) instead.

If I get this correctly (please correct me if I'm wrong) with autho.me I enter my password directly on the site to which I want to login, but some JavaScript in the background does some cryptographic magic with the password. So:

- A malicious site can just read my password. It's nearly impossible to ensure that the correct code is running in the background.

- I do not only need to trust that my ID-provider has took precautions against XSS & Co., but I also need to trust each single website to which I'd want to login. A single compromised website and my password is compromised.

- Not really any advantage in comparison to OpenID.

Did I miss any obvious points/advantages?