4 ms·
A slightly less overloaded summary might be "users must trust their identity provider", which is true of every authentication scheme I'm aware of except for per
by _wmd 13y ago
A slightly less overloaded summary might be "users must trust their identity provider", which is true of every authentication scheme I'm aware of except for perhaps PGP, which itself is a usability nightmare for 99% of the planet
No clue what point this post was trying to make
- wtbob 13y ago> A slightly less overloaded summary might be "users must trust their identity provider" And every CA in the world. And trust that the identity provider is always competent (i.e., that the .well-known/browserid file is never compromised). Which isn't really true of usernames & passwords--at least that way a mistake at my mail provider doesn't automatically expose my banking account to risk.
- yeukhon 13y ago> which is true of every authentication scheme I'm aware of except for perhaps PGP I am not getting your point about PGP. Using PGP as Identity authentication? Wouldn't it just be the same as running your own IdP?