3 ms·
The end of password pain: building frictionless authentication at the Guardian
- bob1029 7mo agoI've been enjoying modern machine-to-machine flows. Trading trusted URLs for client ids is a really secure model. Especially if you go the extra mile with role based machine auth to cloud key stores. You can do the entire thing without a single secret string. I'd much rather prove I can control a URL than ensure a piece of information never leaks out.
- mooreds 7mo agoAre you talking about CIMD?
- bob1029 7mo agoNot specifically but it's the same idea. CIMD is perhaps one step too far for the cases I've worked with. We seem to prefer an out-of-band process for establishing trust. Two CTOs exchanging FQDNs at lunch is a fairly robust model.
- mooreds 7mo agoAh, okay. Something like https://www.ietf.org/archive/id/draft-schwenkschuster-oauth-spiffe-client-auth-00.html https://www.ietf.org/archive/id/draft-schwenkschuster-oauth-... might also be of interest, though it is still nascent.