4 ms·

I've been frustrated for a long time by the lack of browser support for strong authentication with a good user experience. Form-based authentication always felt

I've been frustrated for a long time by the lack of browser support for strong authentication with a good user experience. Form-based authentication always felt like a terrible hack. That's the only dog I have in this fight. I certainly didn't want to frustrate anybody by posting what I did. If you like, I will delete what I posted on the StackOverflow page. Just say the word.

tptacek 15y ago
No, I'm just ranting, because HN is where I rant. It's good that you care about this stuff. If anything, it's the crazy SRP stuff in the original proposal that really sets me off. It is, in the end, frustrating that nobody (myself included!) wants to buckle down and write up all the boring details of how to do secure authentication today.
- charlieok 15y ago
  SRP is cool stuff, but if we're going to do SRP I would be more interested in doing it right. I think that would mean having browsers support a standard SRP protocol binding (eg http://www.ietf.org/rfc/rfc5054.txt http://www.ietf.org/rfc/rfc5054.txt) and then really nailing the browser user interface. I could see using SRP as an alternative to private keys, or as a strong "something you know" factor in addition to private keys (a "something you have" factor) in order to establish ownership of an account. However, this doesn't strike me as a credible first step in getting through the aforementioned "deployment deadlock" issue.
dan-k 15y ago
I actually would say it's relatively good as hacks go. It does a pretty good job of keeping the end goals in mind while dealing with some really tough obstacles. For one, it's browser agnostic, which makes the system much more manageable for all involved. In addition, it doesn't rely on people using the same copy of the same browser each time they sign in for any significant part of its functionality, and minimizes security risks if multiple people use the same browser. There's no way a browser-based solution could address any of those problems in the foreseeable future, if ever, and that not only would create huge headaches for developers, but would also alienate significant portions of users who still use public systems for at least some of their internet access. Completely aside from that, I'm not sure I see why you think browser support would be so much better of a solution, aside from having a more uniform interface. Combating phishing is primarily an issue of being intelligent about what sites you give your information to. Any decent form-based authentication system will send the data in an encrypted form, which will be as secure as data encrypted by the browser's built-in authentication system. Just having the browser as a middleman doesn't help if your data gets sent to or intercepted by the wrong people, and Firefox, at least, already has a good system for warning users about malicious sites.
- charlieok 15y ago
  Mainly, I hate the proliferation of passwords, and I hate typing those passwords in all the time. I'd rather consolidate those down into a handful of distinct purpose-specific identities that I have some ownership and control over. Also, you wrote: "Just having the browser as a middleman doesn't help if your data gets sent to or intercepted by the wrong people". Actually, having the browser more directly involved does help with this, because it can use strong authentication when negotiating a TLS session. By "strong authentication", I mean the authentication protocol has security features which make it useful over an untrusted network in the presence of eavesdroppers or even active adversaries looking to pull off a man-in-the-middle attack. Client certificates are a good example of this and are supported by today's browsers but there are UX problems there. It's not that the forms-based system doesn't work. I just think it could be a lot better. Just consider how much easier it is today to stay in a "walled garden" social network than to be an active commenter on a large number of independent blogs.

tptacek 15y ago

No, I'm just ranting, because HN is where I rant. It's good that you care about this stuff. If anything, it's the crazy SRP stuff in the original proposal that really sets me off. It is, in the end, frustrating that nobody (myself included!) wants to buckle down and write up all the boring details of how to do secure authentication today.

charlieok 15y ago
SRP is cool stuff, but if we're going to do SRP I would be more interested in doing it right. I think that would mean having browsers support a standard SRP protocol binding (eg http://www.ietf.org/rfc/rfc5054.txt http://www.ietf.org/rfc/rfc5054.txt) and then really nailing the browser user interface. I could see using SRP as an alternative to private keys, or as a strong "something you know" factor in addition to private keys (a "something you have" factor) in order to establish ownership of an account. However, this doesn't strike me as a credible first step in getting through the aforementioned "deployment deadlock" issue.

dan-k 15y ago

I actually would say it's relatively good as hacks go. It does a pretty good job of keeping the end goals in mind while dealing with some really tough obstacles. For one, it's browser agnostic, which makes the system much more manageable for all involved. In addition, it doesn't rely on people using the same copy of the same browser each time they sign in for any significant part of its functionality, and minimizes security risks if multiple people use the same browser. There's no way a browser-based solution could address any of those problems in the foreseeable future, if ever, and that not only would create huge headaches for developers, but would also alienate significant portions of users who still use public systems for at least some of their internet access. Completely aside from that, I'm not sure I see why you think browser support would be so much better of a solution, aside from having a more uniform interface. Combating phishing is primarily an issue of being intelligent about what sites you give your information to. Any decent form-based authentication system will send the data in an encrypted form, which will be as secure as data encrypted by the browser's built-in authentication system. Just having the browser as a middleman doesn't help if your data gets sent to or intercepted by the wrong people, and Firefox, at least, already has a good system for warning users about malicious sites.

charlieok 15y ago
Mainly, I hate the proliferation of passwords, and I hate typing those passwords in all the time. I'd rather consolidate those down into a handful of distinct purpose-specific identities that I have some ownership and control over. Also, you wrote: "Just having the browser as a middleman doesn't help if your data gets sent to or intercepted by the wrong people". Actually, having the browser more directly involved does help with this, because it can use strong authentication when negotiating a TLS session. By "strong authentication", I mean the authentication protocol has security features which make it useful over an untrusted network in the presence of eavesdroppers or even active adversaries looking to pull off a man-in-the-middle attack. Client certificates are a good example of this and are supported by today's browsers but there are UX problems there. It's not that the forms-based system doesn't work. I just think it could be a lot better. Just consider how much easier it is today to stay in a "walled garden" social network than to be an active commenter on a large number of independent blogs.