3 ms·

Please see my response here: https://news.ycombinator.com/item?id=19341688 https://news.ycombinator.com/item?id=19341688 If the secret sauce is key rotation,

Please see my response here: https://news.ycombinator.com/item?id=19341688 https://news.ycombinator.com/item?id=19341688 If the secret sauce is key rotation, then the best strategy is to rotate for every use. Building that strategy into the system basically results in OpenID. Take OpenID and allow the client to generate tokens offline, and that's SecurID. And I still see value in the unique IDs, because they serve as a type of proof that key exchange has taken place. How does the bank go to court and demonstrate the the individual has validated their identity? The best way is to retain the key. Oh, but we're supposing that's illegal. So instead they'll show the unique ID and say, well then how did I get this unique ID? I don't think you're applying enough hacker mentality to this. If we're going to approach this problem, let's approach it will the full capabilities that modern cryptography give us. There's no reason to share a secret with the company and extend trust to them; we already know how to securely share a secret between two endpoints (client and central authority) through untrusted middle men (company).

Someone1234 8y ago
Please see my response here: https://news.ycombinator.com/item?id=19341434 https://news.ycombinator.com/item?id=19341434 How are you paying for giving out half a billion SecurID-like tokens? I'm talking about a code that can be printed on your driver's license, you're talking about a piece of electronics that has to be shipped to every person in the US, the logical differences are stark.
- jdmichal 8y ago
  So every OpenID provider has issued millions of dollars in tokens? No, of course not. All the tokens allow is offline generation of secrets. But if you don't need offline generation, then you don't need expensive tokens. I specifically call this out in my linked response; I don't know why you're still stuck on it. Also, soft tokens are a thing and are basically free to generate. I've got several loaded on my phone right now, and have the code backed up in my password vault. Also also, printing secret codes on drivers licenses seems like an amazingly bad idea... Every bar bouncer I interact with sees that thing!
  - Someone1234 8y ago
    > All the tokens allow is offline generation of secrets. Which negates the whole benefit of having short lived secrets, which was the whole crux of why you were suggesting it. > Also, soft tokens are a thing and are basically free to generate. So now instead of buying every citizen in the US a token we're buying every citizen a smartphone or legally requiring them to have one? Seems problematic. > Also also, printing secret codes on drivers licenses seems like an amazingly bad idea... Then print them on a separate sheet of cardboard. Still a massive order of magnitude cheaper than what you're suggesting which could range from $0.5-20B+ depending on implementation. I'm suggesting a more flexible SSN that solves the major issues we already facing. You're suggesting a token based system without actual tokens, smartphone apps without actual smartphones, and printed list of codes.
    - jdmichal 8y ago
      I'm suggesting a system where you prove that you know a secret by exchanging a token. You're proposing a system where you prove you know a secret by telling everyone who asks you for it and hope they forget it later. (And somehow think that this is a workable long-term system that resolves the problems of the values we have now which work exactly the same way...) There's nothing about the former system that requires the things you are stuck on. (And I honestly think you're just being stubborn for some reason, because I'm pretty sure you understand the idea I'm conveying.) You could do it over the phone using a touch-tone system. You could do it through a website. You could do it with an app. You could do it with a hard or soft token. You could do it with a smartcard. The only requirement is that you are capable of telling your secret to the central authority in exchange for a token, in a way that it is very difficult for others to observe. Or, alternatively, to have come to an agreement about how to generate such tokens offline. But the important part is that in the system I'm talking about, you get a secret value from a central authority. And then you don't tell anyone that secret except that same central authority. Everyone else sees temporary values that are useless if saved -- no pinky promises and laws required.
      - Someone1234 8y ago

Someone1234 8y ago

Please see my response here: https://news.ycombinator.com/item?id=19341434 https://news.ycombinator.com/item?id=19341434 How are you paying for giving out half a billion SecurID-like tokens? I'm talking about a code that can be printed on your driver's license, you're talking about a piece of electronics that has to be shipped to every person in the US, the logical differences are stark.

jdmichal 8y ago
So every OpenID provider has issued millions of dollars in tokens? No, of course not. All the tokens allow is offline generation of secrets. But if you don't need offline generation, then you don't need expensive tokens. I specifically call this out in my linked response; I don't know why you're still stuck on it. Also, soft tokens are a thing and are basically free to generate. I've got several loaded on my phone right now, and have the code backed up in my password vault. Also also, printing secret codes on drivers licenses seems like an amazingly bad idea... Every bar bouncer I interact with sees that thing!
- Someone1234 8y ago
  > All the tokens allow is offline generation of secrets. Which negates the whole benefit of having short lived secrets, which was the whole crux of why you were suggesting it. > Also, soft tokens are a thing and are basically free to generate. So now instead of buying every citizen in the US a token we're buying every citizen a smartphone or legally requiring them to have one? Seems problematic. > Also also, printing secret codes on drivers licenses seems like an amazingly bad idea... Then print them on a separate sheet of cardboard. Still a massive order of magnitude cheaper than what you're suggesting which could range from $0.5-20B+ depending on implementation. I'm suggesting a more flexible SSN that solves the major issues we already facing. You're suggesting a token based system without actual tokens, smartphone apps without actual smartphones, and printed list of codes.
  - jdmichal 8y ago
    I'm suggesting a system where you prove that you know a secret by exchanging a token. You're proposing a system where you prove you know a secret by telling everyone who asks you for it and hope they forget it later. (And somehow think that this is a workable long-term system that resolves the problems of the values we have now which work exactly the same way...) There's nothing about the former system that requires the things you are stuck on. (And I honestly think you're just being stubborn for some reason, because I'm pretty sure you understand the idea I'm conveying.) You could do it over the phone using a touch-tone system. You could do it through a website. You could do it with an app. You could do it with a hard or soft token. You could do it with a smartcard. The only requirement is that you are capable of telling your secret to the central authority in exchange for a token, in a way that it is very difficult for others to observe. Or, alternatively, to have come to an agreement about how to generate such tokens offline. But the important part is that in the system I'm talking about, you get a secret value from a central authority. And then you don't tell anyone that secret except that same central authority. Everyone else sees temporary values that are useless if saved -- no pinky promises and laws required.
    - Someone1234 8y ago