Re: [saag] SHA-1 to SHA-n transition

[Stephen Kent <[e-mail]>]

At 12:16 PM -0600 3/2/09, Nicolas Williams wrote:
>On Mon, Mar 02, 2009 at 10:11:43AM -0800, Eric Rescorla wrote:
>>  And the attacker will just pop up a dialog that says "our cool new UI
>>  system is broken. Type your password into the form for now." This is
>>  quite clear from [SDO+07].
>
>Clearly.  Eventually this would no longer be true -- but we'll never get
>there if we don't provide any mechanisms that can overcome this.
>Certificates won't do because passwords remain, and will remain the
>lowest common denominator for a long time.
>
>Unless small, portable devices with UIs (mobile phones!) become so
>ubiquitous (they're getting there) that they are as portable and ever
>present as passwords.  But I suspect the same will apply to that
>alternative: it will be years before we stop relying on passwords.

Not only does one need to carry a mobile phone everywhere to login, 
one also has to have an essentially free SMS service to avoid paying 
a phone service provider for authentication messages. The same 
requirement would apply to the sites that need to use SMS to send and 
receive these messages.

Steve