Re: [http-auth] [saag] re-call for IETF http-auth BoF

[Hannes Tschofenig <[e-mail]>]

Hi Yutaka, 

it is definitely a good idea to get ourselves organized to continue our work in securing the Web. 

For me, the main questions are: 

 * What is the biggest problem? 
    You, for example, point to the usage of forms for user authentication in Web pages in the agenda proposal.
    The NSTIC fans seem to believe that passwords are the problem to begin with.  

 * What solution approach is most promising? (or multiple approaches)
     You seem to suggest to standardize a strong-password based authentication mechanism in http://tools.ietf.org/html/draft-oiwa-http-mutualauth-05
     NSTIC fans seem to believe that the approach is towards stronger credentials (non-password-based) and the usage of federated log-ins. 
     Again others believe that we will never agree on a single authentication protocol and hence we need a framework that allows passwords to be plugged in dynamically.
     Browser vendors are interested, as you may recall from the Identity in the Browser discussion, in standardizing username/password form indications  so that the user does not need to type their username & password too often into forms - but the browser does it instead. 

 * How do we motivate the different stakeholders to implement and deploy our favorite solutions? (There is also the usability issue for the user.)
    Whatever you come up with changes are needed on the client, and on the server side. That requires a lot of cooperation.


Ciao
Hannes

On Jun 5, 2011, at 8:06 PM, Yutaka OIWA wrote:

> Dear all at http-auth mailing list,
> (Cc: Peter, Sean, Harry, and related mailing lists subscribers)
> 
> following the discussions in the Prague http-auth Bar-BoF in March,
> and the W3C Identity in Browser workshop in the last month, now I
> would like to re-call the formation of BoF for http-auth in IETF.  The
> workshop was really hot and enjoying, and there were so many useful
> inputs to both Web community and IETF, I believe.  Some materials
> presented and discussed there are available at
> <http://www.w3.org/2011/identity-ws/>.
> 
> # Harry, are the *output* materials of the workshop already available to public?
> 
> Currently I'm preparing a start-up version of problem statement document and
> proposed BoF agenda.  However, very unfortunately, the last week I had a
> severe fever heat and could not work well (I'm really sorry about that).
> I'm going to submit them to the list within two days, and if possible
> comments to the last version of the agenda proposal, available at
> <http://www.ietf.org/mail-archive/web/http-auth/current/msg00770.html>,
> are welcome.  I'm currently working based on that.
> 
> Thanks,
> 
> Yutaka
> 
> -- 
> Yutaka OIWA, Ph.D.                                       Research Scientist
>                            Research Center for Information Security (RCIS)
>    National Institute of Advanced Industrial Science and Technology (AIST)
>                      Mail addresses: <[e-mail]>, <[e-mail]>
> OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag