3 ms·

I had roughly the same idea and I got told it's impossible. Thanks for proving that naysayers, will always be wrong! My idea was to add http-header or DnS recor

by X4 13y ago

I had roughly the same idea and I got told it's impossible. Thanks for proving that naysayers, will always be wrong! My idea was to add http-header or DnS records that tell browsers the auth-method, path and state. The browser would do the required HTTP Request to login. The user would have to set a key+master password to secure his "browser wallet". You could even solve that issue without waiting for browser vendors by adding browser addon that does queries to supporting sites by showing a lock icon in the url bar. When you click that lock icon, you do your initial setup with master password and/or key(s). After that you can click the button and toggle your login/logout state with a single click. The Website only needs to add one php/ruby,python or .htaccess file that adds those http-headers. For DNS you need to add some Resource record fields. I still don't get why Opera or Firefox didn't think of it, I mean Opera has "Unite" and Firefox has "OpenWebApps" which are in desperate need for a final solution to "Cross-Site Authentification" using built-in secure password or key stores..

kijin 13y ago
Password manager add-ons like LastPass have already solved the wallet problem. All they need is a reliable method to log into each site, without relying on the user to configure the login URL. This post is an attempt to describe one way of doing so: let website owners publish their own URLs. Another viable solution would be for password manager vendors like LastPass, 1Password, etc. to maintain an up-to-date database of accurate login methods for the 1000 most popular websites as well as every well-known CMS. The database would be periodically updated, just like AdBlock periodically updates its blocklist. This method would require even less effort on the part of website owners. The real reason I think browser vendors are uninterested in solutions like this is because they are already trying very hard to push their own identity providers: Google wants everyone to use Google accounts, Mozilla wants everyone to use Persona, and Microsoft wants everyone to use Microsoft accounts. Conflict of interest.

by X4 13y ago

kijin 13y ago

Password manager add-ons like LastPass have already solved the wallet problem. All they need is a reliable method to log into each site, without relying on the user to configure the login URL. This post is an attempt to describe one way of doing so: let website owners publish their own URLs. Another viable solution would be for password manager vendors like LastPass, 1Password, etc. to maintain an up-to-date database of accurate login methods for the 1000 most popular websites as well as every well-known CMS. The database would be periodically updated, just like AdBlock periodically updates its blocklist. This method would require even less effort on the part of website owners. The real reason I think browser vendors are uninterested in solutions like this is because they are already trying very hard to push their own identity providers: Google wants everyone to use Google accounts, Mozilla wants everyone to use Persona, and Microsoft wants everyone to use Microsoft accounts. Conflict of interest.