4 ms·

Centralized identity management was the grand promise of OAuth. It seems that somehow ended up, in most practical applications, as a "login with Facebook" butto

Centralized identity management was the grand promise of OAuth. It seems that somehow ended up, in most practical applications, as a "login with Facebook" button. There are a number of startups working on simplified or "passwordless" auth, but it seems that none have substantive traction. I'd love to be proven wrong, here, though!

voxic11 7y ago
The Web Authentication API is already implemented in the major browsers (excluding old IE and Safari). https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...
bdcravens 7y ago
Before that there was Microsoft Passport. Federated login for the web is a “problem” various parties have been working on for 20 years.
- jandrese 7y ago
  There's a fundamental problem of "I want my credentials to be validated by some central service, but I don't want to give some big faceless company my information." The centralized login service can be used to track your activity all across the net. It's a lot of power to give to some people you don't know. Worse, people's fears in this area are completely justified. Precious few companies have proven themselves to be contentious with our personal data. Some go as far as to repackage and outright sell said data for personal gain. A decentralized blockchain-like system might work for this, but as far as I know it has not been attempted.
  - dane-pgp 7y ago
    Actually, the problem of centralized login services tracking users across the net was considered and partially solved in 2010 by a team from Google and MIT. This was at a time when OpenID was the most popular federated login system, so the proposal was called PseudoID. Unfortunately this idea didn't gain more traction, and there are only a few references to it online now, such as this research paper and a YouTube video by one of the authors: https://ai.google/research/pubs/pub36553 https://ai.google/research/pubs/pub36553 https://www.youtube.com/watch?v=fCBPuGsO_I4 https://www.youtube.com/watch?v=fCBPuGsO_I4 Also, it didn't address all the methods by which a malicious identity provider could track the user, so it would probably have to be extended by having support added in the browser.
  - muttdog 7y ago
    This is being actively developed by Microsoft and others. Check out https://www.microsoft.com/en-us/security/technology/own-your-identity https://www.microsoft.com/en-us/security/technology/own-your... and https://identity.foundation/ https://identity.foundation/

voxic11 7y ago

The Web Authentication API is already implemented in the major browsers (excluding old IE and Safari). https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

bdcravens 7y ago

Before that there was Microsoft Passport. Federated login for the web is a “problem” various parties have been working on for 20 years.

jandrese 7y ago
There's a fundamental problem of "I want my credentials to be validated by some central service, but I don't want to give some big faceless company my information." The centralized login service can be used to track your activity all across the net. It's a lot of power to give to some people you don't know. Worse, people's fears in this area are completely justified. Precious few companies have proven themselves to be contentious with our personal data. Some go as far as to repackage and outright sell said data for personal gain. A decentralized blockchain-like system might work for this, but as far as I know it has not been attempted.
- dane-pgp 7y ago
  Actually, the problem of centralized login services tracking users across the net was considered and partially solved in 2010 by a team from Google and MIT. This was at a time when OpenID was the most popular federated login system, so the proposal was called PseudoID. Unfortunately this idea didn't gain more traction, and there are only a few references to it online now, such as this research paper and a YouTube video by one of the authors: https://ai.google/research/pubs/pub36553 https://ai.google/research/pubs/pub36553 https://www.youtube.com/watch?v=fCBPuGsO_I4 https://www.youtube.com/watch?v=fCBPuGsO_I4 Also, it didn't address all the methods by which a malicious identity provider could track the user, so it would probably have to be extended by having support added in the browser.
- muttdog 7y ago
  This is being actively developed by Microsoft and others. Check out https://www.microsoft.com/en-us/security/technology/own-your-identity https://www.microsoft.com/en-us/security/technology/own-your... and https://identity.foundation/ https://identity.foundation/