full-disclosure - Re: OpenID. The future of authentication on the web?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 24 Mar 2008 10:51:49 +0100
From: Gorn <gorn@...all.nl>
CC: full-disclosure@...ts.grok.org.uk
Subject: Re: OpenID. The future of authentication on the
 web?

Petko D. Petkov wrote:
>>
> 
> As I said, if you don't trust public OpenID providers, roll your own.
> It is very, very, very easy.
> 
You seem to miss one point, in the current online environment you are 
not talking about 5 or 6 id/credentials but more like 20 to 30. 
(remember each blog you post to, each mailing list each web store 
requires its own id/credentials.) OpenID provides for the possibility to 
group these id's by function and select the correct provider with the 
safeguards you want for each group. An OpenID for money related 
transactions would need more safeguards as an OpenID for lets say full 
disclosure ;-)
> 
> 
> 

FG

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/