full-disclosure - Re: OpenID. The future of authentication on the web?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 24 Mar 2008 15:27:39 +0000
From: "Petko D. Petkov" <pdp.gnucitizen@...glemail.com>
To: "John C. A. Bambenek, GCIH, CISSP" <bambenek.infosec@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, Larry Seltzer <Larry@...ryseltzer.com>
Subject: Re: OpenID. The future of authentication on the
	web?

as I said, some websites ask you for a username regardless whether
that will be an email address. and unfortunately a username is not
unique through out the Web. which means that if your username is
john-bambenek on one system it could be completely different on
another system due the fact that some vendors don't like the "-" or
they don't like the length or they ask you to have a number in the
username or even they provide you with such. So keeping track of
usernames is as hard as keeping track of passwords. Put them all
together and then you will experience the pain.

On the other hand OpenID provides you with a unique ID. Only you can
use it on every system without the need to worry.

On Mon, Mar 24, 2008 at 3:22 PM, John C. A. Bambenek, GCIH, CISSP
<bambenek.infosec@...il.com> wrote:
> Well in my case it's easy... how many people do you know named John Bambenek
> (my father doesn't count)? :)
>
> I was just speaking about passwords in that case, presumably people can
> remember their email addresses.
>
>
>
> On Mon, Mar 24, 2008 at 10:17 AM, Petko D. Petkov
> <pdp.gnucitizen@...glemail.com> wrote:
> > what about usernames? you still need to keep track of your usernames
> > since sometimes your preferred username is either taken or not
> > possible or you need to login via email or any other peculiarity the
> > site supports.
> >
> >
> >
> >
> > On Mon, Mar 24, 2008 at 2:43 PM, John C. A. Bambenek, GCIH, CISSP
> > <bambenek.infosec@...il.com> wrote:
> > > I would disagree.  One could simply create a template password and then
> salt
> > > it with some acronym for the site in question.
> > >
> > > For instance, S0m3p4ss!### where ### is a 3-letter acronym for the site
> they
> > > are accessing.  Still need only one password to remember and you don't
> > > necessarily have a single point of 0wnership anymore.
> > >
> > >
> > >
> > > On Sun, Mar 23, 2008 at 7:04 PM, Larry Seltzer <Larry@...ryseltzer.com>
> > > wrote:
> > > >
> > > > >>I understand the attractiveness of not having to remember lots of
> IDs
> > > > and passwords, but when you give up control of your data, you give up
> > > > control of your future.
> > > >
> > > > Normal people aren't going to remember enough passwords, let alone
> > > > strong passwords, to make that control meaningful. I do get your
> point,
> > > > but I bet that the best alternative is to give them one set of
> > > > credentials and make it as strong as possible.
> > > >
> > > >
> > > > Larry Seltzer
> > > > eWEEK.com Security Center Editor
> > > > http://security.eweek.com/
> > > > http://blogs.pcmag.com/securitywatch/
> > > > Contributing Editor, PC Magazine
> > > > larry.seltzer@...fdavisenterprise.com
> > > >
> > > > _______________________________________________
> > > >
> > > >
> > > >
> > > > Full-Disclosure - We believe in it.
> > > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > > > Hosted and sponsored by Secunia - http://secunia.com/
> > > >
> > >
> > >
> > > _______________________________________________
> > >  Full-Disclosure - We believe in it.
> > >  Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > >  Hosted and sponsored by Secunia - http://secunia.com/
> > >
> >
> >
> >
> >
> >
> >
> > --
> >
> > Petko D. (pdp) Petkov | GNUCITIZEN | Hakiri | Spin Hunters
> >
> > gnucitizen.org | hakiri.org | spinhunters.org
> >
>
>



-- 

Petko D. (pdp) Petkov | GNUCITIZEN | Hakiri | Spin Hunters

gnucitizen.org | hakiri.org | spinhunters.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/