4 ms·

If you have different secure passwords at every single website and some how avoid email as a single point of failure then Clickpass/OpenID might not be the righ

by immad 19y ago

If you have different secure passwords at every single website and some how avoid email as a single point of failure then Clickpass/OpenID might not be the right solution for you. For everyone else its better then whats currently out there, and we are going to implement further security measures going forward.

huhtenberg 19y ago
Email is not a single point of failure as I just explained in another reply and Internet users with rudimental sense of security is not a rarity. I'm afraid the ignorant "everyone else" crowd you are planning to cater to might not be as big as you expect it to be. Also you are tasking yourselves with handling confidential information, so stating that your "lips are sealed and encrypted" is not good enough. I fail to see how this is "better then whats currently out there". Sorry to be peeing in your punch on a launch day, but you do have a serious problem with a security disclosure.
- immad 19y ago
  1. If your email servers are compromised, than it makes them a single point of failure as most web accounts are accessible through forgotten password procedures. 2. Most people (66%) of users use the same password on all websites. Which is a far worse multiple trusted party single point of failure. Which is what I meant by "better than whats currently out there". 3. For services that really require a significantly increased level of security, like banks, it is very easy and likely that further security measures that don't rely on the OpenID provider will be built in on the websites. 4. It is important to figure out the security issue and make a rewarding web experience than hold up ones hands and decrease data portability and increase friction on the web. We are hoping to help that process along and are very open to suggestions on how we can improve that.

4 ms·

If you have different secure passwords at every single website and some how avoid email as a single point of failure then Clickpass/OpenID might not be the righ

by immad 19y ago

huhtenberg 19y ago
Email is not a single point of failure as I just explained in another reply and Internet users with rudimental sense of security is not a rarity. I'm afraid the ignorant "everyone else" crowd you are planning to cater to might not be as big as you expect it to be. Also you are tasking yourselves with handling confidential information, so stating that your "lips are sealed and encrypted" is not good enough. I fail to see how this is "better then whats currently out there". Sorry to be peeing in your punch on a launch day, but you do have a serious problem with a security disclosure.
- immad 19y ago
  1. If your email servers are compromised, than it makes them a single point of failure as most web accounts are accessible through forgotten password procedures. 2. Most people (66%) of users use the same password on all websites. Which is a far worse multiple trusted party single point of failure. Which is what I meant by "better than whats currently out there". 3. For services that really require a significantly increased level of security, like banks, it is very easy and likely that further security measures that don't rely on the OpenID provider will be built in on the websites. 4. It is important to figure out the security issue and make a rewarding web experience than hold up ones hands and decrease data portability and increase friction on the web. We are hoping to help that process along and are very open to suggestions on how we can improve that.