4 ms·

I like the idea others had of just logging you out of facebook too. The honeypot problem I think is most serious. That can be mitigated by having a 'challenge'

by logn 13y ago

I like the idea others had of just logging you out of facebook too. The honeypot problem I think is most serious. That can be mitigated by having a 'challenge' question (e.g., "What is your favorite...") on the SSO managers such as facebook. But I think the better solution is that we seriously need to push browsers to encourage public/private key auth. That we don't have public/private keys standardized and easy to use is a shame. You could just have a little button on the browser that asks for a global password. When entered, it then populates your user-agent with your public key, and a localhost cookie with your private key. Then this entire mess maybe goes away (but I'm no security researcher). Maybe we could even then encrypt text boxes easily. That would be something: right click a text box and select 'PGP' etc.

bigiain 13y ago
The problem is - browsers != people. I have 3 browsers open on this machine, another 3 browsers on the phone in my pocket, four browsers on my iPad, and at work I keep separate browsers up logged in as either me-at-work or me-personally. There are also a few machines/browsers I use more-or-less regularly which aren't "mine" (the meeting room and board room machines, the girlfiend's laptop…). While client certs "work" (StartSSL.com's login for example), they fall a fair way short of "working well across multiple devices". (I'm not even sure if I could install a client cert on Safari/Chrome/AtomicWeb on iOS if I wanted to.) Maybe something like Chrome's bookmark/tab syncing could be extended - but I'd want it to work across Chrome/Firefox/Safari on at least OS X, iOS, Android, and Linux (and though not important for me, it'd need to work with IE on various Win versions too, if it's to get any real market penetration). I fear there's no secure way to make that happen though - who's "cloud" could you trust with your private key? (Hell, can you even trust Windows with your private key? I've _still_ not put my real GPG key onto my iPhone because I'm not convinced that'd be smart…)

by logn 13y ago

bigiain 13y ago

The problem is - browsers != people. I have 3 browsers open on this machine, another 3 browsers on the phone in my pocket, four browsers on my iPad, and at work I keep separate browsers up logged in as either me-at-work or me-personally. There are also a few machines/browsers I use more-or-less regularly which aren't "mine" (the meeting room and board room machines, the girlfiend's laptop…). While client certs "work" (StartSSL.com's login for example), they fall a fair way short of "working well across multiple devices". (I'm not even sure if I could install a client cert on Safari/Chrome/AtomicWeb on iOS if I wanted to.) Maybe something like Chrome's bookmark/tab syncing could be extended - but I'd want it to work across Chrome/Firefox/Safari on at least OS X, iOS, Android, and Linux (and though not important for me, it'd need to work with IE on various Win versions too, if it's to get any real market penetration). I fear there's no secure way to make that happen though - who's "cloud" could you trust with your private key? (Hell, can you even trust Windows with your private key? I've _still_ not put my real GPG key onto my iPhone because I'm not convinced that'd be smart…)