Full Disclosure mailing list archives
Re: OpenID. The future of authentication on the web?
From: "Petko D. Petkov" <pdp.gnucitizen () googlemail com>
Date: Mon, 24 Mar 2008 15:27:39 +0000
as I said, some websites ask you for a username regardless whether that will be an email address. and unfortunately a username is not unique through out the Web. which means that if your username is john-bambenek on one system it could be completely different on another system due the fact that some vendors don't like the "-" or they don't like the length or they ask you to have a number in the username or even they provide you with such. So keeping track of usernames is as hard as keeping track of passwords. Put them all together and then you will experience the pain. On the other hand OpenID provides you with a unique ID. Only you can use it on every system without the need to worry. On Mon, Mar 24, 2008 at 3:22 PM, John C. A. Bambenek, GCIH, CISSP <bambenek.infosec () gmail com> wrote:
Well in my case it's easy... how many people do you know named John Bambenek (my father doesn't count)? :) I was just speaking about passwords in that case, presumably people can remember their email addresses. On Mon, Mar 24, 2008 at 10:17 AM, Petko D. Petkov <pdp.gnucitizen () googlemail com> wrote:what about usernames? you still need to keep track of your usernames since sometimes your preferred username is either taken or not possible or you need to login via email or any other peculiarity the site supports. On Mon, Mar 24, 2008 at 2:43 PM, John C. A. Bambenek, GCIH, CISSP <bambenek.infosec () gmail com> wrote:I would disagree. One could simply create a template password and thensaltit with some acronym for the site in question. For instance, S0m3p4ss!### where ### is a 3-letter acronym for the sitetheyare accessing. Still need only one password to remember and you don't necessarily have a single point of 0wnership anymore. On Sun, Mar 23, 2008 at 7:04 PM, Larry Seltzer <Larry () larryseltzer com> wrote:I understand the attractiveness of not having to remember lots ofIDsand passwords, but when you give up control of your data, you give up control of your future. Normal people aren't going to remember enough passwords, let alone strong passwords, to make that control meaningful. I do get yourpoint,but I bet that the best alternative is to give them one set of credentials and make it as strong as possible. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine larry.seltzer () ziffdavisenterprise com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/-- Petko D. (pdp) Petkov | GNUCITIZEN | Hakiri | Spin Hunters gnucitizen.org | hakiri.org | spinhunters.org
-- Petko D. (pdp) Petkov | GNUCITIZEN | Hakiri | Spin Hunters gnucitizen.org | hakiri.org | spinhunters.org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: OpenID. The future of authentication on the web?, (continued)
- Re: OpenID. The future of authentication on the web? Paul Schmehl (Mar 23)
- Re: OpenID. The future of authentication on the web? Larry Seltzer (Mar 23)
- Re: OpenID. The future of authentication on the web? Pedro Hugo (Mar 24)
- Re: OpenID. The future of authentication on the web? Paul Schmehl (Mar 24)
- Re: OpenID. The future of authentication on the web? Kurt Buff (Mar 23)
- Re: OpenID. The future of authentication on the web? John C. A. Bambenek, GCIH, CISSP (Mar 24)
- Re: OpenID. The future of authentication on the web? Larry Seltzer (Mar 24)
- Re: OpenID. The future of authentication on the web? John C. A. Bambenek, GCIH, CISSP (Mar 24)
- Re: OpenID. The future of authentication on the web? Petko D. Petkov (Mar 24)
- Re: OpenID. The future of authentication on the web? John C. A. Bambenek, GCIH, CISSP (Mar 24)
- Re: OpenID. The future of authentication on the web? Petko D. Petkov (Mar 24)
- Re: OpenID. The future of authentication on the web? John C. A. Bambenek, GCIH, CISSP (Mar 24)
- Re: OpenID. The future of authentication on the web? Petko D. Petkov (Mar 24)
- Re: OpenID. The future of authentication on the web? Gorn (Mar 24)
- Re: OpenID. The future of authentication on the web? Petko D. Petkov (Mar 24)
- Re: OpenID. The future of authentication on the web? Gorn (Mar 24)
- Re: OpenID. The future of authentication on the web? Petko D. Petkov (Mar 24)
- Re: OpenID. The future of authentication on the web? Valdis . Kletnieks (Mar 24)
- Re: OpenID. The future of authentication on the web? Paul Schmehl (Mar 24)
- Re: OpenID. The future of authentication on the web? Petko D. Petkov (Mar 24)
- Re: OpenID. The future of authentication on the web? John C. A. Bambenek, GCIH, CISSP (Mar 24)