3 ms·

> For the simplest next step web servers can just do simple challenge response over SSL to ensure I hold my "certificates" private key. What happens when you l

> For the simplest next step web servers can just do simple challenge response over SSL to ensure I hold my "certificates" private key. What happens when you lose your private key? What happens when you change machine?

lifeisstillgood 11y ago
What happens when I lose my car key? I have to provide proof of identity and ownership to a trusted and specialised business provider who then allows me access again. What happens when I lose my client certificate? Should be the Same thing. Otherwise the value to me of the website being protected is worth less than that of my car. Really most websites are using security in the same way the local bar uses human based facial recognition "oh hi paul, your usual?" Since there is next to no value in a Facebook feed, I will make a rational decision as to how much cost of effort I will put in to get access back.
- davnicwil 11y ago
  That's an interesting point, replacing a lost key is always going to be the weak point in any security scheme, unless you intentionally make the process hard/cumbersome enough that it isn't, but makes losing the key a very unpleasant, costly event both for the user, and the service you're trying to access. Why would businesses like Facebook implement such a scheme? As you predict it would probably end up in them losing a lot of customers when keys are lost. I think any business, even where security is critical, would worry about this too. I.e. 'what, my bank makes me call up their customer service, wait on hold, speak to 8 different individuals, then wait three days for processing, if I lose my key? No thanks, remembering a strong password seems an easier alternative - I'll just go to a competitor that allows that'. That's not even to mention wrapping up the scheme in an easy-to-use way for non-technical users. It'd be fine until the point it isn't, at which point the customer service / PR fallout cost of things going wrong is very high. Everyone understands passwords. I think there are enough problems here that such a scheme would likely not have enough adoption to become mainstream. But I think more importantly, isn't the fact that your key(s) would have to be tied to a physical client the true deal-breaker? A website that you can only access from a certain set of physically secured devices with the correct keys installed throws away perhaps the biggest advantage of the web.
  - lifeisstillgood 11y ago
    I remain unconvinced. Most web sites deliver very little value to the end user. I mean if the government right now made us pay for each site we used, how many would you choose as worth ten bucks a month? So when there is a base level of security that makes us question the value of access to a given site, we shall see changes in how identity and personally identifiable data is used. This I think is a Good Thing. So, it is highly likely two factor auth will be a minimum standard for any site that's got anything of value - look at Target or the OPM. And if you want to connect to and use those sites you must have the right dongle. That's is a real pain. But you won't be allowed in otherwise. Target will still let you in the front door to spend money, but as they really cannot give every shopper a Target two factor auth, they will subcontract that out to hardware suppliers like Apple Pay. So we stop spreading our pollution every which way and start building sewers - Apple as the data sewer pipe provider ... Hmm. Now two factor auth is from the site owner to us. A physical key exchange. A web of trust is a much different proposition (liberty wise) and might come through things like OPM debacle. Giving every Covil servant a dongle might work but giving them a master cert and then signing the Certs they generate for their phone every so often seems more manageable - and will flow out to passports, drivers licences etc. So I do t really know much - and my brain is under flu-like attack but the ideas are floating out there.

lifeisstillgood 11y ago

What happens when I lose my car key? I have to provide proof of identity and ownership to a trusted and specialised business provider who then allows me access again. What happens when I lose my client certificate? Should be the Same thing. Otherwise the value to me of the website being protected is worth less than that of my car. Really most websites are using security in the same way the local bar uses human based facial recognition "oh hi paul, your usual?" Since there is next to no value in a Facebook feed, I will make a rational decision as to how much cost of effort I will put in to get access back.

davnicwil 11y ago
That's an interesting point, replacing a lost key is always going to be the weak point in any security scheme, unless you intentionally make the process hard/cumbersome enough that it isn't, but makes losing the key a very unpleasant, costly event both for the user, and the service you're trying to access. Why would businesses like Facebook implement such a scheme? As you predict it would probably end up in them losing a lot of customers when keys are lost. I think any business, even where security is critical, would worry about this too. I.e. 'what, my bank makes me call up their customer service, wait on hold, speak to 8 different individuals, then wait three days for processing, if I lose my key? No thanks, remembering a strong password seems an easier alternative - I'll just go to a competitor that allows that'. That's not even to mention wrapping up the scheme in an easy-to-use way for non-technical users. It'd be fine until the point it isn't, at which point the customer service / PR fallout cost of things going wrong is very high. Everyone understands passwords. I think there are enough problems here that such a scheme would likely not have enough adoption to become mainstream. But I think more importantly, isn't the fact that your key(s) would have to be tied to a physical client the true deal-breaker? A website that you can only access from a certain set of physically secured devices with the correct keys installed throws away perhaps the biggest advantage of the web.
- lifeisstillgood 11y ago
  I remain unconvinced. Most web sites deliver very little value to the end user. I mean if the government right now made us pay for each site we used, how many would you choose as worth ten bucks a month? So when there is a base level of security that makes us question the value of access to a given site, we shall see changes in how identity and personally identifiable data is used. This I think is a Good Thing. So, it is highly likely two factor auth will be a minimum standard for any site that's got anything of value - look at Target or the OPM. And if you want to connect to and use those sites you must have the right dongle. That's is a real pain. But you won't be allowed in otherwise. Target will still let you in the front door to spend money, but as they really cannot give every shopper a Target two factor auth, they will subcontract that out to hardware suppliers like Apple Pay. So we stop spreading our pollution every which way and start building sewers - Apple as the data sewer pipe provider ... Hmm. Now two factor auth is from the site owner to us. A physical key exchange. A web of trust is a much different proposition (liberty wise) and might come through things like OPM debacle. Giving every Covil servant a dongle might work but giving them a master cert and then signing the Certs they generate for their phone every so often seems more manageable - and will flow out to passports, drivers licences etc. So I do t really know much - and my brain is under flu-like attack but the ideas are floating out there.