BOF proposal: making the web safe and easy forEliot's father

On 16-May-06, at 8:44 AM, Hallam-Baker, Phillip wrote:
> As an attempt to focus discussion here:
>
> I think we are all agreed that there is no shortage of
strong  
> authentication solutions for a network.

Agreed
>
> In particular I think we need to decide on a single
identifier  
> format and a service discovery strategy. We also need
to develop a  
> deployment strategy.

agreed
>
> There is an internet person identifier: an email
address.

This is not a good identifier as it is not opaque, and was
not  
created for that purpose. dicksxip.comis a unique
identifier, but it  
is also where I receive email. I will often want to uniquely
identify  
myself without handing out an identifier that can be used in
another  
way.

URLs are great, opaque identifiers that allow retrieval of
meta-data  
about the identifier from the resource at the end of the
URL.
>
> There is a service discovery mechanism: DNS SRV.
I think it is also important to anticipate that smart
browsers will  
be widely deployed, and that service discovery by the
website may not  
be needed.

-- Dick
_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth

>>>>> "Hallam-Baker," ==
Hallam-Baker, Phillip <pbakerverisign.com> writes:

    Hallam-Baker,> As an attempt to focus discussion
here: I think we
    Hallam-Baker,> are all agreed that there is no
shortage of strong
    Hallam-Baker,> authentication solutions for a
network.

Right.
And I don't believe I was  proposing inventing a new one.

    Hallam-Baker,> What we need is a way to apply those
solutions
    Hallam-Baker,> within an internetwork.
Agreed.

    Hallam-Baker,> In particular I think we need to
decide on a single
    Hallam-Baker,> identifier format and a service
discovery
    Hallam-Baker,> strategy.  

I think we also need mandatory to
    implement solutions, because I think that's the only
way we're
    going to get away from passwords for the web.  Getting
away from
    sending tokens to websites that can be replayed to third
parties
    is critical in solving the phishing problem.

We also need to develop a deployment
    Hallam-Baker,> strategy.

Agreed.


    Hallam-Baker,> There is a service discovery
mechanism: DNS SRV.

Mmm.  I agree we need discovery.  I agree that discovery
needs to work
given only an identifier.  I agree SRV is excellent for some
uses.  I
think that asserting SRV at this stage is perhaps getting
our
implementation details mixed in our requirements.

 Hallam-Baker,> The ultimate goal of a deployment
strategy
must be Hallam-Baker,> to get support for interoperable
strong
Hallam-Baker,> authentication built into the operating
system
Hallam-Baker,> chrome.  Unless we get into the operating
systems
Hallam-Baker,> we are going to be playing turtle stacking
games
Hallam-Baker,> forever.

I think I agree with you.
_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth

On Tue, 16 May 2006, Dick Hardt wrote:
>> I think we are all agreed that there is no shortage
of strong 
>> authentication solutions for a network.
> Agreed

Indeed.

>> There is an internet person identifier: an email
address.
>
> This is not a good identifier as it is not opaque, and
was not created for 
> that purpose. dicksxip.comis a unique identifier, but it is
also where I 
> receive email. I will often want to uniquely identify
myself without handing 
> out an identifier that can be used in another way.

This is a dreadful identifier.  Email addresess are not
unique across
time, are often reused, and very easily mistaken - I'm sure
I'm not the 
only person that's received email for a previous owner - or
had their 
email sent to the current owner of any given address.

cheers!
============================================================
==============
"A cat spends her life conflicted between a deep,
passionate and profound
desire for fish and an equally deep, passionate and profound
desire to
avoid getting wet.  This is the defining metaphor of my life
right now."
_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth

>>>>> "Cat" == Cat Okita
<catreptiles.org> writes:

    Cat> This is a dreadful identifier.  Email addresess
are not
    Cat> unique across time, are often reused, and very
easily
    Cat> mistaken - I'm sure I'm not the only person
that's received
    Cat> email for a previous owner - or had their email
sent to the
    Cat> current owner of any given address.
Perhaps, but consider how well it works in practice.  There
are many
many websites that will be happy to reset a password and
send it to an
email address.

If you need high assurance out of a particular identifier
then use an
identity provider that provides that assurance.  I doubt
that banks
will ever allow identities issued by non-banks as an example
because
doing so would open them up to huge liability.

_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth

On Tue, 16 May 2006, Sam Hartman wrote:
>>>>>> "Cat" == Cat Okita
<catreptiles.org> writes:
>    Cat> This is a dreadful identifier.  Email
addresess are not
>    Cat> unique across time, are often reused, and
very easily
>    Cat> mistaken - I'm sure I'm not the only
person that's received
>    Cat> email for a previous owner - or had their
email sent to the
>    Cat> current owner of any given address.
> Perhaps, but consider how well it works in practice. 
There are many
> many websites that will be happy to reset a password
and send it to an
> email address.

I'm not sold on that being a feature ;>  Having my
password sent to
somebody else isn't my idea of a good thing.

> If you need high assurance out of a particular
identifier then use an
> identity provider that provides that assurance.  I
doubt that banks
> will ever allow identities issued by non-banks as an
example because
> doing so would open them up to huge liability.

Do banks in your country not require at least some form of
government 
issued identification in order to open an account?

cheers!
============================================================
==============
"A cat spends her life conflicted between a deep,
passionate and profound
desire for fish and an equally deep, passionate and profound
desire to
avoid getting wet.  This is the defining metaphor of my life
right now."
_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth

So, first an admission:

The problem really wasn't just Eliot's dad, but Eliot
himself.

Now to restate the problem that he/I have:

There are too many damn passwords and keys.  This says very
little about
identifiers at all.  In fact, web browsers and mail readers
do a darn
good job at remembering identifiers, and if they do that
much and no
more to solve the problem I don't see a security concern. 
The problem
remains the password.  If you solve only that problem and do
so securely
you've moved the ball substantially.

Eliot
_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth