6 ms·

Maintaining a separate identity for every site across the web gets more impractical by the second. I think most people would agree that a third-party authentica

by yock 16y ago

Maintaining a separate identity for every site across the web gets more impractical by the second. I think most people would agree that a third-party authentication service is a positive thing, but there seems to be a stigma, earned or not, surrounding Facebook that makes people hesitant to assign that responsibility to them. I think ultimately it's going to come down to a paid, independent service. Startups can't offer this kind of thing for free as there is no trust involved in the transaction. Likewise most large companies have already traded away their trust capital for various fiscal and political gains over the course of their existence. No, there must be some legal recourse for the consumer for the moment the authenticator screws up, and the only way to transfer risk in that way is with money. Probably the single biggest barrier to this is the widespread desire to remaining anonymous on the web. The thing it seeks to combat is precisely the thing so many value so greatly: maintaining multiple identities, personas, existences on the web.

hapless 16y ago
What's impractical about it ? I'm very comfortable with separate identities per-site. If your site isn't worth a separate identity, why am I interacting with it in the first place?
- mquander 16y ago
  I'm comfortable with separate identities per site, but it is impractical for most people. You have three general choices: - Maintain a separate login and password for every site. This requires a lot of memorization and is a pain in the ass when you find yourself trying four passwords because you forgot which you used. - Use password management software or a naming system that lets you keep track. This is effective but is a bit much for a majority of people who do not, and probably never will, use tools and reasoning to help them do things on their own volition. - Use the same login and password almost everywhere. This is easy but is shitty security. You might claim that using a third-party authenticator is just like option #3, but it's not. Option #3 above means that your single credentials are under the control of the least secure site you use them on, so if someone cracks some install of PHPBB version 0.0001 that you logged into, you're fucked. Using a third-party auth provider relieves you from this worry. It even means that you can switch at your leisure and start using a hardware generator or a long passphrase if the provider supports it.
  - mike-cardwell 16y ago
    Choice. Let people choose if they want to use Facebook, or if they want to log in directly. Allowing people to log in directly should be the minimum requirement. Facebook should be an addon authentication system, not the only.
    - mquander 16y ago
      Oh, I think Facebook is much worse. I'm just pointing out that there really is a problem to be solved; separate authentication for every site is not obviously the best possible experience. Choice is a fine answer, if the developers are willing to spend the extra time implementing and maintaining the choices.
  - wvenable 16y ago
    I'm not comfortable using any sort of 3rd party service. I also don't like that I have any kind of connected identity across multiple sites. This sort of authentication system should be built into the browser, entirely under my control, and every site should be given a separate identity token.
    - daychilde 16y ago
      Sounds good, but what happens when you reinstall your OS, or change your OS or browser? Not saying it's not possible - not trying to shoot this down at all - just I think it's a major issue.
      - wvenable 16y ago
        One could use a cloud service like Xmarks which already syncs bookmarks and browser passwords. Just because it's built into the browser doesn't mean that you can store the information in the cloud and sync it between browsers. The difference is that you control the connection and your information directly. With OpenID or Facebook the connection is directly between those entities and site you are visiting. With a browser-based system, the connection is always between the site and you or the cloud and you.
- HeyLaughingBoy 16y ago
  Furthermore, makes it harder for some of us to use your service at work. My work will let me visit Facebook, but each access is logged and IT does track it. While I can notify IT that it's a valid work use, doing this for every site that causes a similar reaction from the firewall gets tiring after a while. The harder you make it for us to visit, even if it's a minor inconvenience, the less likely we will.
- yock 16y ago
  Well, for one thing, this becomes a bigger and bigger problem: http://www.xkcd.com/792/ http://www.xkcd.com/792/ Yes, it's a ridiculous example, but the vast majority of end users keep the same username and password for all of their online services. Obtain one U/P pair and you could conceivably access their identity anywhere. A centralized, specialized authentication provider could maintain multiple levels of authentication depending on what the service demanded. Perhaps your favorite news aggregator only required that you be authenticated with a username and password, but your bank could be using the same authentication service and demand a physical token or one-time password to continue to the service. The idea is to maintain the convenience we already demand and practice in a manner which is orders of magnitude more secure.
  - deleted 16y ago
    [deleted]
  - julianz 16y ago
    That XKCD made me go back through a whole lot of my "low security" sites and change the password away from the same old thing I'd used for ages. Still funny though :)
- mkramlich 16y ago
  whether having separate identities is a net win or a net lose depends on N. Having to maintain say 3 separate identities (N=3) on the web (roughly: one for public social, one for private/secret, one for money/utilities) is a much lower burden than having to maintain say 30 or 300 separate unconnected identities, each with their own username/password/profile/messaging/eventstreams/community-connections.
scott_s 16y ago
What makes me nervous about singing into a site through Facebook is I don't know what kind of permissions I'm giving to the site regarding my FB account.
- abraham 16y ago
  Facebook always displays an allow page with what data the site is requesting.
  - scott_s 16y ago
    Will it always do that? Are there any implicit allowances? Will there be in the future? For what's true now, I could look it up. But I'd rather not. For what will be in the future, I have no idea. The simplest thing for me to do is use my Facebook account for Facebook only.
    - recoiledsnake 16y ago
      Exactly. This is the reason that I am far more comfortable using my Google or Yahoo OpenID than a Facebook login.
      - loewenskind 16y ago
        Why? Because these companies are less likely to sell your data to third parties? You know Google has pretty well always read your gmail right?
        abraham 16y ago
        > You know Google has pretty well always read your gmail right? That is a loaded question that does not cover how and why google uses your emails.
        loewenskind 16y ago
        What are you talking about? It doesn't matter why they're doing it today. It matters that they're doing it. Even if you're naive enough to buy into "don't do evil", surely you realize that it wont always be that way.

by yock 16y ago

hapless 16y ago

What's impractical about it ? I'm very comfortable with separate identities per-site. If your site isn't worth a separate identity, why am I interacting with it in the first place?

mquander 16y ago
I'm comfortable with separate identities per site, but it is impractical for most people. You have three general choices: - Maintain a separate login and password for every site. This requires a lot of memorization and is a pain in the ass when you find yourself trying four passwords because you forgot which you used. - Use password management software or a naming system that lets you keep track. This is effective but is a bit much for a majority of people who do not, and probably never will, use tools and reasoning to help them do things on their own volition. - Use the same login and password almost everywhere. This is easy but is shitty security. You might claim that using a third-party authenticator is just like option #3, but it's not. Option #3 above means that your single credentials are under the control of the least secure site you use them on, so if someone cracks some install of PHPBB version 0.0001 that you logged into, you're fucked. Using a third-party auth provider relieves you from this worry. It even means that you can switch at your leisure and start using a hardware generator or a long passphrase if the provider supports it.
- mike-cardwell 16y ago
  Choice. Let people choose if they want to use Facebook, or if they want to log in directly. Allowing people to log in directly should be the minimum requirement. Facebook should be an addon authentication system, not the only.
  - mquander 16y ago
    Oh, I think Facebook is much worse. I'm just pointing out that there really is a problem to be solved; separate authentication for every site is not obviously the best possible experience. Choice is a fine answer, if the developers are willing to spend the extra time implementing and maintaining the choices.
- wvenable 16y ago
  I'm not comfortable using any sort of 3rd party service. I also don't like that I have any kind of connected identity across multiple sites. This sort of authentication system should be built into the browser, entirely under my control, and every site should be given a separate identity token.
  - daychilde 16y ago
    Sounds good, but what happens when you reinstall your OS, or change your OS or browser? Not saying it's not possible - not trying to shoot this down at all - just I think it's a major issue.
    - wvenable 16y ago
      One could use a cloud service like Xmarks which already syncs bookmarks and browser passwords. Just because it's built into the browser doesn't mean that you can store the information in the cloud and sync it between browsers. The difference is that you control the connection and your information directly. With OpenID or Facebook the connection is directly between those entities and site you are visiting. With a browser-based system, the connection is always between the site and you or the cloud and you.
HeyLaughingBoy 16y ago
Furthermore, makes it harder for some of us to use your service at work. My work will let me visit Facebook, but each access is logged and IT does track it. While I can notify IT that it's a valid work use, doing this for every site that causes a similar reaction from the firewall gets tiring after a while. The harder you make it for us to visit, even if it's a minor inconvenience, the less likely we will.
yock 16y ago
Well, for one thing, this becomes a bigger and bigger problem: http://www.xkcd.com/792/ http://www.xkcd.com/792/ Yes, it's a ridiculous example, but the vast majority of end users keep the same username and password for all of their online services. Obtain one U/P pair and you could conceivably access their identity anywhere. A centralized, specialized authentication provider could maintain multiple levels of authentication depending on what the service demanded. Perhaps your favorite news aggregator only required that you be authenticated with a username and password, but your bank could be using the same authentication service and demand a physical token or one-time password to continue to the service. The idea is to maintain the convenience we already demand and practice in a manner which is orders of magnitude more secure.
- deleted 16y ago
  [deleted]
- julianz 16y ago
  That XKCD made me go back through a whole lot of my "low security" sites and change the password away from the same old thing I'd used for ages. Still funny though :)
mkramlich 16y ago
whether having separate identities is a net win or a net lose depends on N. Having to maintain say 3 separate identities (N=3) on the web (roughly: one for public social, one for private/secret, one for money/utilities) is a much lower burden than having to maintain say 30 or 300 separate unconnected identities, each with their own username/password/profile/messaging/eventstreams/community-connections.

scott_s 16y ago

What makes me nervous about singing into a site through Facebook is I don't know what kind of permissions I'm giving to the site regarding my FB account.

abraham 16y ago
Facebook always displays an allow page with what data the site is requesting.
- scott_s 16y ago
  Will it always do that? Are there any implicit allowances? Will there be in the future? For what's true now, I could look it up. But I'd rather not. For what will be in the future, I have no idea. The simplest thing for me to do is use my Facebook account for Facebook only.
  - recoiledsnake 16y ago
    Exactly. This is the reason that I am far more comfortable using my Google or Yahoo OpenID than a Facebook login.
    - loewenskind 16y ago
      Why? Because these companies are less likely to sell your data to third parties? You know Google has pretty well always read your gmail right?
      - abraham 16y ago
        > You know Google has pretty well always read your gmail right? That is a loaded question that does not cover how and why google uses your emails.
        loewenskind 16y ago
        What are you talking about? It doesn't matter why they're doing it today. It matters that they're doing it. Even if you're naive enough to buy into "don't do evil", surely you realize that it wont always be that way.