3 ms·
TrustBearer OpenID - Two-Factor Authentication With OpenID
- wmf 19y agoI like this. (Although I would prefer a SecurID-type dongle rather than smartcard-type.) Rather than complaining about how OpenID reduces security, they're finding a case where OpenID increases it. Most Web sites will never support smartcard login, but if they support OpenID they get it for free.
- JustinBastress 19y agoI'd be interested in hearing why you prefer OTP over asymmetric crypto...because the way I see it, one huge problem with OTP is that the authenticator needs to know the 'shared secret' on the device...Smart cards and similar devices using public key encryption have no such requirement. I guess one benefit of OTP tokens is that they don't need to be physically connected to the computer (hence no software to install period), but when it comes right down to it, they're really not much better than just username/password when it comes to phishing or real-time keylogging attacks...not to mention the fact that you have to type that huge number /in addition to/ your regular credentials...
- wmf 19y agoMy objection is just installing the client software. Public key is definitely superior for all the reasons you gave.