Beefy Boxes and Bandwidth Generously Provided by pair Networks
go ahead... be a heretic
 
PerlMonks  

Re^3: Concerning Single Sign-on, Bitcard (TypeKey), and OpenID, CACERT client certificate

by varian (Chaplain)
on Feb 26, 2007 at 09:05 UTC ( [id://602086]=note: print w/replies, xml ) Need Help??


in reply to Re^2: Concerning Single Sign-on, Bitcard (TypeKey), and OpenID, CACERT client certificate
in thread Concerning Single Sign-on, Bitcard (TypeKey), and OpenID

There are people that would vote for centralized authentication management and others that favor decentralized systems. To speak for myself I am a little wary of the centralized approach.

The single point of failure that you mentioned yourselves is one reason. If the central authentication server fails then all dependent servers have become inaccessable as well.

The second, even more compelling, reason is that if the central system gets compromised then the intruder can find ways to freely obtain id's and subsequently can access any server that relies on the central authentication process. This means that the central authentication service must be protected by extreme measures to provide some level of protection against intrusion.

The third reason is one of trust and accountability. Would you trust the access to your server to a third party controlled authentication process? Now if the third party is under heavy government supervision one might be inclined to accept the risk, but otherwise...

This is why I like public key certificates. It is a decentralized authentication procedure, server and browser only interact with each other. Still the same client certificate can be used to present an ID for as many servers as one likes. The ID carries a digital signature of both the user and a co-signing central root authority which relates to level of trustworthiness. In principle the enduser would need to manage only one client certificate.

Replies are listed 'Best First'.
Re^4: Concerning Single Sign-on, Bitcard (TypeKey), and OpenID, CACERT client certificate
by jettero (Monsignor) on Feb 26, 2007 at 11:30 UTC
    Again, I don't wish to be the OpenID advocate, but I appear to be in that role again...

    This technology is really only meant to replace the account setup and user email portion of the registration process. The crypto systems employed are to prevent spoofing mostly. The idea is to lower the bar so people can join your site without any effort. Really, if I have to sign up for another forum to make one post I'm going to explode.

    If you used your OpenID to log into a bank, the openid is really just in place of the email for the signup. It also transmits a few signup details for you (like email, real name, nickname, etc) and then the bank would ask you to configure a second factor for secure signon. First, they'd have to verify your identity matched, and then they'd ask you to set up another password (a secure one or a USB key, or a certificate or whatever) that you'd use to access your bank software.

    So the single point of failure isn't an end user security problem, only a sign-on problem.

    What we're having here is a semantic argument about Authentication vs Authorization. They're different, but when we say authentication we usually and implicitly mean both.

    -Paul

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://602086]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others exploiting the Monastery: (4)
As of 2024-03-29 12:39 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found