Re: [apps-discuss] [saag] HTTP authentication: the next generation

[Yoav Nir <[e-mail]>]

resending with less recipients...

On Dec 12, 2010, at 1:10 AM, Yoav Nir wrote:

> 
> On Dec 11, 2010, at 1:09 AM, Paul Hoffman wrote:
> 
>> At 3:53 PM -0700 12/10/10, Peter Saint-Andre wrote:
>>> Other than that, I'm not aware of much activity. What have I missed?
>> 
>> TLS client certificates.
> 
> TLS client certificates work, but as we've learned both with the web and with IPsec clients, people would much rather not use them. A few IETFs ago (Chicago?), a bunch of us tried to push the idea of TLS with EAP authentication.
> 
> http://tools.ietf.org/html/draft-nir-tls-eap
> 
> At the time, the TLS working group (and an AD) told us that this would contradict the applicability statement of EAP, so no, you cannot use EAP for anything other than network access. 
> 
> Now we have the abfab working group, so I don't think this still holds.
> 
> Also, I agree with Marsh, that authentication is not enough, and you need the rest of TLS anyway.
> 
> So yes, I think that it is time to resurrect HTTP authentication.
> 
> Yoav
> 
>