Proof-of-concept public key authentication for web users
1–10 of 23 posts
Re: Proof-of-concept public key authentication for web users
#2How is that different from client certificate authentication? It seems strange that solution is not mentioned at all.
Re: Proof-of-concept public key authentication for web users
#3How is that different from client certificate authentication? It seems strange that solution is not mentioned at all.
More info on client SSL certificates:
http://www.gnegg.ch/2008/05/why-is-nobody-using-ssl-client-c...
Re: Proof-of-concept public key authentication for web users
#4So you either require the user to somehow sync a private key across multiple computers (Including phones and tablets) or the can't access the site with this method. Do you agree on the digest, method, sizes? Do you blacklist md5, sha1? Does everyone agree to this or can I go to one site which uses an insecure algorithm and theres the potential for information to be leaked, which affects my usage of that private key on other websites. Do I have a private key for each different website? Do I then need something to manage this for me, ala KeyPass or 1Password? How do I authenticate with KeyPass or 1Password, with a password? We're back to where we started.
I don't think PKI is the solution for this problem.
BrowserID is moving in the right direction, I can trust Google to have appropriate security for my personal information, but as we've seen time and time again sites like gawker, mtgox cannot be. It would be nice to see a service like BrowserID catch on and I'd be willing to pay for a vendor for the service if they provide full disclosure on their method storing of my data. So I know they aren't storing in plaintext, hashing with md5, encrypting the passwords etc.
Re: Proof-of-concept public key authentication for web users
#5So you either require the user to somehow sync a private key across multiple computers (Including phones and tablets) or the can't access the site with this method. Do you agree on the digest, method, sizes? Do you blacklist md5, sha1? Does everyone agree to this or can I go to one site which uses an insecure algorithm and theres the potential for information to be leaked, which affects my usage of that private key o…
Haven't all of your questions basically been answered in practice by the fact that keys are simple and effective when used to log in over ssh? Do you have a different private key per each server you log into, does a compromised server automatically render your keypair worthless, do you have software to handle keys now?
Haven't your arguments been refuted by the simple fact that people use keypairs every day to log into servers easily and securely? The last time I had to type an account's password was when I had to run "sudo" on a test server.
Re: Proof-of-concept public key authentication for web users
#6So you either require the user to somehow sync a private key across multiple computers (Including phones and tablets) or the can't access the site with this method. Do you agree on the digest, method, sizes? Do you blacklist md5, sha1? Does everyone agree to this or can I go to one site which uses an insecure algorithm and theres the potential for information to be leaked, which affects my usage of that private key o…
Haven't all of your questions basically been answered in practice by the fact that keys are simple and effective when used to log in over ssh? Do you have a different private key per each server you log into, does a compromised server automatically render your keypair worthless, do you have software to handle keys now? Haven't your arguments been refuted by the simple fact that people use keypairs every day to log in…
The first time you log into an SSH server, your connection is actually insecure (this is also true of every subsequent time you log in and see that yes/no dialog).
Re: Proof-of-concept public key authentication for web users
#7Earlier quoted context omitted.
Haven't all of your questions basically been answered in practice by the fact that keys are simple and effective when used to log in over ssh? Do you have a different private key per each server you log into, does a compromised server automatically render your keypair worthless, do you have software to handle keys now? Haven't your arguments been refuted by the simple fact that people use keypairs every day to log in…
The first time you log into an SSH server, your connection is actually insecure (this is also true of every subsequent time you log in and see that yes/no dialog).
Is there any way to be sure of an server's ssh fingerprint before logging in? You need to do that offline right? Maybe a PGP signed e-mail from the sysadmin?
Re: Proof-of-concept public key authentication for web users
#8What we need is a public key authentication scheme with the possibility for normal users to delegate their identity to some trusted third party to which they hand their public key (like with OpenID). I think this would be the best of both worlds: normal users get a seamless experience, and nerds have total control over their identity without even needing to, say, own a domain name and trust DNS.
Re: Proof-of-concept public key authentication for web users
#9Earlier quoted context omitted.
The first time you log into an SSH server, your connection is actually insecure (this is also true of every subsequent time you log in and see that yes/no dialog).
Is there any way to be sure of an server's ssh fingerprint before logging in? You need to do that offline right? Maybe a PGP signed e-mail from the sysadmin?
That's exactly the kind of thing you're supposed to do to verify those keys.
(I don't either).
This is a much bigger deal in a web setting, though.
Re: Proof-of-concept public key authentication for web users
#10Earlier quoted context omitted.
Haven't all of your questions basically been answered in practice by the fact that keys are simple and effective when used to log in over ssh? Do you have a different private key per each server you log into, does a compromised server automatically render your keypair worthless, do you have software to handle keys now? Haven't your arguments been refuted by the simple fact that people use keypairs every day to log in…
The first time you log into an SSH server, your connection is actually insecure (this is also true of every subsequent time you log in and see that yes/no dialog).
It's insecure in that you don't know the identify of the endpoint without verifying the fingerprint out of band. That problem is already solved in browsers thanks to SSL certs and certificate authorities.