Re:Cutting the Gordian Knot of Web Identity
by losvedir on Tuesday September 06, 2011 @10:08AM
(#2965645)
I'm not sure I like this solution very well. It's tied to a particular device and browser (unless you authenticate to the cloud or something, which means you have to deal with passwords anyway), and if someone sits at your computer they can log into all your stuff.
However, here's an interesting authentication solution I've been reading about lately[1] proposed by an actual security researcher. That blog post links to his peer-reviewed paper and to a talk that he gave.
The idea is basically to have a specific identity manager device he calls a "pico", with a little camera on it. Web sites can display a QR-code or something with its public key in it, you point the pico at it, and the pico authenticates with the site on its own. His proposal also includes weird "pico siblings" and stuff like that, which seems unfeasible to me, but some version of it as a mobile app might be interesting.
However, here's an interesting authentication solution I've been reading about lately[1] proposed by an actual security researcher. That blog post links to his peer-reviewed paper and to a talk that he gave.
The idea is basically to have a specific identity manager device he calls a "pico", with a little camera on it. Web sites can display a QR-code or something with its public key in it, you point the pico at it, and the pico authenticates with the site on its own. His proposal also includes weird "pico siblings" and stuff like that, which seems unfeasible to me, but some version of it as a mobile app might be interesting.
[1] http://www.lightbluetouchpaper.org/2011/03/27/pico-no-more-p...