4 ms·

Why are we satisfied with Sign In with <Big Company>? Shouldn't this be an open standard? I mean, I know open/federated identity systems have failed several tim

Why are we satisfied with Sign In with <Big Company>? Shouldn't this be an open standard? I mean, I know open/federated identity systems have failed several times, but there's no reason why we can have a spec where your device or browser generates per-site credentials and stores them in some encrypted replicated storage. And for email-relay, that's been going on since penet.fi in the 90s. Email is already federated, and there's no reason why you can't use third party email anonymizing services. Apple had an opportunity to produce something that might be adoptable by everyone, but instead they went walled-garden again.

scarface74 7y ago
And then you have to trust the third party.
- cromwellian 7y ago
  You only have to trust a third party with a throw-away email forwarding system. But we know how to do anonymous remailing/forwarding already, and Apple could have adopted a spec that forces developers to use a forwarding system that is end-to-end encrypted if they want to email your throwaway.
  - scarface74 7y ago
    And part of that “email forwarding” is access to all of your mail including your password resets.
    - cromwellian 7y ago
      You missed the point. There's no access because you can require end-to-end encryption for mails that use the forwarding system, just like the PGP remailer/forwarding systems, so the remailer node isn't subject to MITM. Moreover, if you're using "Sign in with X" in the first place, there's no password and no password reset. Key Exchange is the big MITM vulnerability. There's decades of experience now around building distributed identity. Bitcoin wallets are a large scale example of that. If we're going to finally flip the switch on not using verifiable, public email addresses as part of credentials, we should rip the bandaid off and get rid of the centrality all together.
      - scarface74 7y ago
        So instead of asking developer to support another Oauth provider which should be a simple change, now they have to support an encrypted email system that isn’t widely supported. Also, an iCloud ID doesn’t require you to use an Apple email address. So you also have to have an email provider that supports E2E encryption.
        cromwellian 7y ago
        Sure, why not. Folks have no trouble laying on all kinds of requirements when GDPR is brought up, but now suddenly requiring S/MIME or alternatives is a bridge to far. If we're going to have single signon for the world, and finally get rid of passwords, it should not be locked into one OS platform. If I sign on from Apple, how go I log in on my Linux desktop or non Apple device?
        scarface74 7y ago
        You’re depending on every single email provider and client to support it. GDPR is not a great example. A lot of American companies didn’t even bother and just blocked everyone with an EU IP address.
        clay_the_ripper 7y ago
        Well as an end user, I do trust Apple. I want to put this in the hands of a for profit company that has the reach and know how to make this viable right now, not in some far distant future where adoption is low. While I like the idea, in practical terms the goal is: 1. Make a login system that is private, secure and easy 2. Have it be widely adopted right now 3. Have it work forever, seamlessly A for profit company with the reach of Apple is the perfect solution for all three points.

scarface74 7y ago

And then you have to trust the third party.

cromwellian 7y ago
You only have to trust a third party with a throw-away email forwarding system. But we know how to do anonymous remailing/forwarding already, and Apple could have adopted a spec that forces developers to use a forwarding system that is end-to-end encrypted if they want to email your throwaway.
- scarface74 7y ago
  And part of that “email forwarding” is access to all of your mail including your password resets.
  - cromwellian 7y ago
    You missed the point. There's no access because you can require end-to-end encryption for mails that use the forwarding system, just like the PGP remailer/forwarding systems, so the remailer node isn't subject to MITM. Moreover, if you're using "Sign in with X" in the first place, there's no password and no password reset. Key Exchange is the big MITM vulnerability. There's decades of experience now around building distributed identity. Bitcoin wallets are a large scale example of that. If we're going to finally flip the switch on not using verifiable, public email addresses as part of credentials, we should rip the bandaid off and get rid of the centrality all together.
    - scarface74 7y ago
      So instead of asking developer to support another Oauth provider which should be a simple change, now they have to support an encrypted email system that isn’t widely supported. Also, an iCloud ID doesn’t require you to use an Apple email address. So you also have to have an email provider that supports E2E encryption.
      - cromwellian 7y ago
        Sure, why not. Folks have no trouble laying on all kinds of requirements when GDPR is brought up, but now suddenly requiring S/MIME or alternatives is a bridge to far. If we're going to have single signon for the world, and finally get rid of passwords, it should not be locked into one OS platform. If I sign on from Apple, how go I log in on my Linux desktop or non Apple device?
        scarface74 7y ago
        You’re depending on every single email provider and client to support it. GDPR is not a great example. A lot of American companies didn’t even bother and just blocked everyone with an EU IP address.
        clay_the_ripper 7y ago
        Well as an end user, I do trust Apple. I want to put this in the hands of a for profit company that has the reach and know how to make this viable right now, not in some far distant future where adoption is low. While I like the idea, in practical terms the goal is: 1. Make a login system that is private, secure and easy 2. Have it be widely adopted right now 3. Have it work forever, seamlessly A for profit company with the reach of Apple is the perfect solution for all three points.