4 ms·

There aren't any great solutions to this problem on the horizon yet, sadly. FB login isn't a viable option because they or so aggressive about using it to mine

by TrevorJ 14y ago

There aren't any great solutions to this problem on the horizon yet, sadly. FB login isn't a viable option because they or so aggressive about using it to mine data, and let's face it - there are probably plenty of logins and services people don't want co-mingled with their public persona. Google login is another non-starter but for similar reasons, but with the added issue that they have so many services, with so many TOS's that you run a very real risk of losing access to a bunch of third party accounts if you ever run afoul of Googles' policies and they terminate your service. This happened to a lot of people who signed up for G+ but were not above the required age: they lost access to gmail and all the other Google services simply because they didn't read the fine print. Oddly enough, I think it might be credit card companies who are in the best position to solve this problem. They already have a large infrastructure for detecting fraud, they have the trust of the general public, and they already have a high level of integration with many websites. More importantly, they have a business model that is not predicated on selling your data to make a profit (well, at least not entirely).

politician 14y ago
The video linked at the end suggests using NFC-equipped smartphones to transmit blinded credentials containing just enough information to gain entry (e.g. I am over 18, I have authority to enter this pub, etc). What do you think about that solution?
- TrevorJ 14y ago
  I like the idea of a physical key like this a lot. I think it matters though that we are talking about something that happens 'over the air' (even if it is just NFC). The security would need to be bulletproof. I'm not very knowledgeable how these systems work for NFC other than RFID's in credit cards. With credit cards there is a dynamic CVV code that can only be used once so if somebody sniffs your card they can't use it for more than one transaction. This might be acceptable for credit cards, but it isn't ok at all for a login scenario because if they compromise your login once, they potentially have access to all sorts of things.

by TrevorJ 14y ago

politician 14y ago

The video linked at the end suggests using NFC-equipped smartphones to transmit blinded credentials containing just enough information to gain entry (e.g. I am over 18, I have authority to enter this pub, etc). What do you think about that solution?

TrevorJ 14y ago
I like the idea of a physical key like this a lot. I think it matters though that we are talking about something that happens 'over the air' (even if it is just NFC). The security would need to be bulletproof. I'm not very knowledgeable how these systems work for NFC other than RFID's in credit cards. With credit cards there is a dynamic CVV code that can only be used once so if somebody sniffs your card they can't use it for more than one transaction. This might be acceptable for credit cards, but it isn't ok at all for a login scenario because if they compromise your login once, they potentially have access to all sorts of things.