📅 Original date posted:2013-11-02
📝 Original message:On 2 November 2013 14:02, Mike Hearn <mike at plan99.net> wrote:
> On Sat, Nov 2, 2013 at 6:01 AM, <bitcoingrant at gmx.com> wrote:
>
>> In brief, the authentication work as follows:
>>
>>
>>
>> Server provides a token for the client to sign.
>>
>> client passes the signed message and the bitcoin address back to the
>> server.
>>
>> server validates the message and honors the alias (optional) and bitcoin
>> address as identification.
>>
>
> http://pilif.github.io/2008/05/why-is-nobody-using-ssl-client-certificates/
>
I actually use client certificates for almost all of my authentication.
It's true that the browser manufacturers have created an UX which is not
ideal, and very little effort is made to improve it. But it is possible.
See this project from Mozilla labs.
http://www.azarask.in/blog/post/identity-in-the-browser-firefox/
Unfortunately this got killed :(
More popular is the trusted third party model like OAuth or Persona.
There's a conflict of interest as well, because browser manufacturers are
often identity providers too, so there is an incentive to push TTP
technology.
There's two elements here. One is paswordless login (which I love). The
other is who controls your identity. I like to control my own identity (in
my browser) using PKI. But facebook and the big webmail providers have a
lions share of the market.
The way to shift the balance is to offer the right incentives.
>
>
> ------------------------------------------------------------------------------
> Android is increasing in popularity, but the open development platform that
> developers love is also attractive to malware creators. Download this white
> paper to learn more about secure code signing practices that can help keep
> Android apps secure.
> http://pubads.g.doubleclick.net/gampad/clk?id=65839951&iu=/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20131102/1aaf3dcc/attachment.html>;
Melvin Carvalho [ARCHIVE] /
npub1uv…saxrt
2023-06-07 15:08:25
in reply to nevent1q…vz34
Author Public Key
npub1uvtfvcegcn9kds68r8he57emc480vqtx8t22kpsctxgjxae44gvsksaxrtPublished at
2023-06-07 15:08:25Event JSON
{
"id": "87fb8b2eadcac0a510082b27ca8ee6bb041b749cf9768b92c39d951e505e122a",
"pubkey": "e316966328c4cb66c34719ef9a7b3bc54ef601663ad4ab06185991237735aa19",
"created_at": 1686150505,
"kind": 1,
"tags": [
[
"e",
"724c6f13ca667850218ef24a7051f9062418fb5d7bd972070be69e4bf08accba",
"",
"root"
],
[
"e",
"efa2aa707dbda495bb22d6918b6aab01c4a633528c2fc8524152cd87432c505d",
"",
"reply"
],
[
"p",
"f2c95df3766562e3b96b79a0254881c59e8639f23987846961cf55412a77f6f2"
]
],
"content": "📅 Original date posted:2013-11-02\n📝 Original message:On 2 November 2013 14:02, Mike Hearn \u003cmike at plan99.net\u003e wrote:\n\n\u003e On Sat, Nov 2, 2013 at 6:01 AM, \u003cbitcoingrant at gmx.com\u003e wrote:\n\u003e\n\u003e\u003e In brief, the authentication work as follows:\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e Server provides a token for the client to sign.\n\u003e\u003e\n\u003e\u003e client passes the signed message and the bitcoin address back to the\n\u003e\u003e server.\n\u003e\u003e\n\u003e\u003e server validates the message and honors the alias (optional) and bitcoin\n\u003e\u003e address as identification.\n\u003e\u003e\n\u003e\n\u003e http://pilif.github.io/2008/05/why-is-nobody-using-ssl-client-certificates/\n\u003e\n\nI actually use client certificates for almost all of my authentication.\n\nIt's true that the browser manufacturers have created an UX which is not\nideal, and very little effort is made to improve it. But it is possible.\nSee this project from Mozilla labs.\n\nhttp://www.azarask.in/blog/post/identity-in-the-browser-firefox/\n\nUnfortunately this got killed :(\n\nMore popular is the trusted third party model like OAuth or Persona.\nThere's a conflict of interest as well, because browser manufacturers are\noften identity providers too, so there is an incentive to push TTP\ntechnology.\n\nThere's two elements here. One is paswordless login (which I love). The\nother is who controls your identity. I like to control my own identity (in\nmy browser) using PKI. But facebook and the big webmail providers have a\nlions share of the market.\n\nThe way to shift the balance is to offer the right incentives.\n\n\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e Android is increasing in popularity, but the open development platform that\n\u003e developers love is also attractive to malware creators. Download this white\n\u003e paper to learn more about secure code signing practices that can help keep\n\u003e Android apps secure.\n\u003e http://pubads.g.doubleclick.net/gampad/clk?id=65839951\u0026iu=/4140/ostg.clktrk\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20131102/1aaf3dcc/attachment.html\u003e",
"sig": "8c3238ca6a5e2ebe363c8406a814e9666fc852e44efee712af34c8d1e05ca2859607c4ccca2e474934e7e952badffca7bdb57dea523e161b609165fec64431e6"
}