Re: [apps-discuss] [http-auth] [websec] [saag] [kitten] HTTP authentication: the next generation

["Henry B. Hotz" <[e-mail]>]

On Dec 13, 2010, at 11:24 AM, Marsh Ray wrote:

> So IMHO, significant improvements in web authentication would be greatly 
> beneficial. But they will have to:
> 
> * Require connection integrity. This probably means mandatory TLS.
> 
> * Require a user interaction that takes place outside the insecure 
> browser rectangle and feels different enough that it's easy to explain 
> the difference.
> 
> * Not leak info to untrusted parties. These days privacy is often more 
> important than traditional security.
> 
> * Support browser vendors in making a UI that "sucks less" to have to 
> use, or possibly have to use it less. Put users in control of their 
> identity and auth credentials without nagging them repeatedly until they 
> give in and click the "Yes to all" button.
> 
> * Represent an actual improvement in security over the current standard 
> of HTML form POST password and secret HTTP session cookie.
> 
> - Marsh


+1
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[e-mail], or [e-mail]