> 1. Relying on any form of secret is unsustainable. Absolutely not. It is one of the three major categories of auth (something you have/are/know). The problem

> 1. Relying on any form of secret is unsustainable. Absolutely not. It is one of the three major categories of auth (something you have/are/know). The problems with secret-based auth are either implementation-related or "between keyboard and chair" issues (password re-use, etc). If you have to pick one of token-based, biometric-based, or secret-based, what is a better option, exactly? Is it perhaps biometrics, which can't be changed (let alone inaccurate and almost always fool-able)? Or is token-based more appealing to you? "Something you have (and will lose)". The best we seem to be able to do today is Token+Secret based, ala internet banking token which requires PIN to output code. Failing the ability to actually ship bespoke hardware to each of your customers, we're left with secret-based. If the implementations (on both client/server side) were solid and users were educated about security, we'd be a hell of a lot better than we are now. > Information wants to be free, and it will. This means nothing. I just created an RSA keypair and then wiped it 35 times, just to spite you ;) > Secrets must be kept secret at ALL time. With the coming death of privacy, keeping a secret will be ridiculously complicated and expensive. Secrets make a system fragile. Secrets must be kept secret for as long as they are active, not all eternity. If your secret is compromised, you change it to a new secret. If you hadn't reused your previous secret elsewhere, you don't have a problem. > 2. We need fewer systems. [...] Custom shouldn't be the default, it should be last resort. As in: centralized authentication services, or better frameworks for auth? If it is the second, I'll give you this one. But if it is the first, no - nobody actually needs more of that. There are already plenty, and even useful in certain cases. But there are others that you absolutely do not want to rely on external authentication systems. When you call up your bank to shout at them because you can't log in, they don't have the option to say "talk to FB/Twitter/Google+/OpenID, not on our end". Also - not necessarily better security, you're just delegating those issues to someone else, who "takes security seriously". As a company/org, you're literally handing the keys that your users use to enter your site, to someone else. In situations like banking, medical, e-gov, etc. - that's a no-go. > 3. We need a common language. A language that makes sense to use in the 21st century. A language that help us think, a language that's computer assisted. Text? What a goddamn joke. What? Natural or Programming? You're asking for something non-textual? Have you caught up with English, Math and Javascript? I genuinely don't know what you're asking for. > 4. We don't know yet what an identity is. All you had to do was ask. This stuff has been discussed in OAuth extensively. > In a future that's going be a lot like a distributed semantic marketplace, what we need is not security. What we need is accountability. Identity and fraud is what must be solved. So we need to protect the confidentiality and integrity of these systems, but we don't need "security"? > You tinfoil hat people should really take a step back and consider your paranoia. Privacy is not a good thing. That's interesting - my people and I spoke and we'd like to know more. How is privacy not a good thing? Are we exclusively talking digital privacy here, or remove-bathroom-doors privacy as well? > demonizing the government It isn't really about this government, it is about this government's surveillance and what the next government will do with all that data. And anyone who hacks them. > Guess what, you're missing the entire point. I am indeed. This issue is about the practical state of affairs of our technological stacks. What points are you making? 1. Secrets are bad security. 2. Centralized auth systems 3. Non-textual computer assisted language that helps us think. 4. (identity confusion) + we don't need security, we need security. 5. Privacy is not a good thing. > Sheeps be disagreeing. Bah, just felt like engaging a troll for once.