3 ms·

That seems rather like throwing out the baby with the bathwater. If there was a strong federated identity provider, there would be less crappy passwords out th

That seems rather like throwing out the baby with the bathwater. If there was a strong federated identity provider, there would be less crappy passwords out there. Despite what it might seem like from HN users, the vast majority of people don't use password managers.

arbitrage 11y ago
If there was a strong federated identity provider, there would be one massive target for abuse and attack. If there was a well written protocol and library to help with the independent federation of identities, that could be used by anyone, that would truly help the security of the vast majority of people.
- Pharaoh2 11y ago
  Oh, do you mean like the massive target for abuse and attack that are password managers?
  - dvanduzer 11y ago
    Password management software centralizes the credentials of a given user. But each instance of the credential database is highly decentralized. So it's only a massive target if you then recentralize those credential databases on a cloud storage service, for example. Attacking the security of a password management system is different than stealing the credential database.
- deleted 11y ago
  [deleted]
  - ossreality 11y ago
    NO. You're not the first, or fiftieth person to think of this! There was a period of time where someone like you would post their solution to HN like it was some fucking miracle from God. People have been using email for one-time signin access for... over a decade. It's not a good idea. The worst part is you are almost kind of close to describing Persona/BrowserID which, alternatively, is actually a good idea.
dvanduzer 11y ago
What do you mean by "a strong federated identity provider"? If it's a federated system, there's already more than one provider. If it's a "strong" provider, then that probably means it's a market leader, in which case there's an equally strong incentive to edge the competition out.
jacquesm 11y ago
I'd be more than happy to ditch any service that required me to sign in with a third party identity.

arbitrage 11y ago

If there was a strong federated identity provider, there would be one massive target for abuse and attack. If there was a well written protocol and library to help with the independent federation of identities, that could be used by anyone, that would truly help the security of the vast majority of people.

Pharaoh2 11y ago
Oh, do you mean like the massive target for abuse and attack that are password managers?
- dvanduzer 11y ago
  Password management software centralizes the credentials of a given user. But each instance of the credential database is highly decentralized. So it's only a massive target if you then recentralize those credential databases on a cloud storage service, for example. Attacking the security of a password management system is different than stealing the credential database.
deleted 11y ago
[deleted]
- ossreality 11y ago
  NO. You're not the first, or fiftieth person to think of this! There was a period of time where someone like you would post their solution to HN like it was some fucking miracle from God. People have been using email for one-time signin access for... over a decade. It's not a good idea. The worst part is you are almost kind of close to describing Persona/BrowserID which, alternatively, is actually a good idea.

dvanduzer 11y ago

What do you mean by "a strong federated identity provider"? If it's a federated system, there's already more than one provider. If it's a "strong" provider, then that probably means it's a market leader, in which case there's an equally strong incentive to edge the competition out.

jacquesm 11y ago

I'd be more than happy to ditch any service that required me to sign in with a third party identity.