Re: [apps-discuss] [saag] [websec] [kitten] HTTP authentication: the next generation

[Marsh Ray <[e-mail]>]

On 01/14/2011 04:12 AM, Peter Gutmann wrote:
>
> Who says there's a password involved?  It's equally appropriate for public-
> key/certificate-based auth, "sign this challenge" for example.  I think "when
> the user can be relied upon to not authenticate to the wrong site" covers most
> of the bases and is technology- and mechanism-neutral.

What is being authenticated? How much of the surrounding context is 
being assumed or implied, and how much is actually being authenticated?

Who is doing the authentication?

What capabilities will the result be used to authorize?

These are real questions that go to the heart of the problem. I don't 
believe that they have been reconsidered in the context of today's 
computing environment.

Give a description of the semantics of the "sign this challenge" act, 
without presupposing agreement on definitions we take for granted like 
"authentication", "login", "session", etc.

I suspect the result would sound absurd enough that we would want to 
throw out the whole thing and start over.

I suspect we avoid this exercise because we realize this subconsciously, 
or at least avoid saying it out loud.

I suspect that this is a big part of why we find the problem intractable.

- Marsh