4 ms·

Neither. Google and identity is a bad idea regardless of the problem you're trying to solve (http://www.identityblog.com/?p=1204 http://www.identityblog.com/?p

Neither. Google and identity is a bad idea regardless of the problem you're trying to solve (http://www.identityblog.com/?p=1204 http://www.identityblog.com/?p=1204). It's the worst of the three. OTP is good, but challenge-response is better. Is your OTP from a second factor? Card Space is my personal favourite, but the [card] portability issue hasn't been solved. U-Prove holds promise. CardSpace, with U-Prove and second-factor challenge/response would be awesome :-) So as I said, neither of those is ideal. But then I have solved exactly that problem (securely login to websites from virus infested machine in an internet cafe) before, for the UK MoD. I used identity federation (WS-*), and opted for Chip & PIN authentication on the identity provider side, thereby cutting out replay attacks. The solution is complex, and costs a lot more money than the average web site would be willing to pay. Unless someone credible like the Passport Office or DVLA volunteers as an identity provider. Here's the case study. http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?CaseStudyID=4000003478 http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?....

7952 15y ago
So its an argument about which third party you trust? Google or the DVLA? perhaps people trust google because they have to already. If you are running chrome and using gmail you are implicitly trusting them with your data. I agree that this is a bad way of picking a tehnology. I like the chip and pin approach; its a good solution. Perhaps banks should provide federated login. Do you trust them ? :)
- Spearchucker 15y ago
  It's about context. I trust my bank for banking. I would trust the DVLA to assert my identity where a directed assertion is required, and where I agree to it. I don't trust Google at all because an ad company has no business looking at my email, let alone asserting my identity to third parties. So technically I don't trust any third party. I trust some of them in varying degrees based on what I'm trying to do.

7952 15y ago

So its an argument about which third party you trust? Google or the DVLA? perhaps people trust google because they have to already. If you are running chrome and using gmail you are implicitly trusting them with your data. I agree that this is a bad way of picking a tehnology. I like the chip and pin approach; its a good solution. Perhaps banks should provide federated login. Do you trust them ? :)

Spearchucker 15y ago
It's about context. I trust my bank for banking. I would trust the DVLA to assert my identity where a directed assertion is required, and where I agree to it. I don't trust Google at all because an ad company has no business looking at my email, let alone asserting my identity to third parties. So technically I don't trust any third party. I trust some of them in varying degrees based on what I'm trying to do.