Re:Some New HTTP Verbs
by badrabbit on Tuesday September 13, 2022 @09:42AM
(#32824172)
Most of these things can be done easilu with existing verbs.
But here is something else: client authenticating versions of existing verbs like SGET, this is my idea to kill cookies.
Browsers/clients generate signing keys like with TLS except they use either session-unique public key and identifier for anonymous access or server-registered identifiers and public key for logged in access. Each SGET is signed by the server/account specific private key.
This sort of kills passwords and cookies with one blow. Browsers and clients will have to use some library to session=init("account name") or session=init("anonymous") and just pass that session to the http library so it can do SGET/SPOST. The effect would be every HTTPS transaction would be authenticated by a specific client which eliminates many MiTM scenarios and MFA bypass techniques (you can steal public keys like cookies but private key theft would be made extremely difficult), and since you are authenticating a unique client, why do you need passwords? Just add MFA to it and you don't even have to deal with SSO and oauth! Registration just means you request an account identifer with a pubkey and if approved the server gives it an ok. The burden however is on clients and servers to maintain account information which they sort of already do in a messy non-stanrdard way which this would also fix.
What are your critiques? And can someone steal my idea please?
But here is something else: client authenticating versions of existing verbs like SGET, this is my idea to kill cookies.
Browsers/clients generate signing keys like with TLS except they use either session-unique public key and identifier for anonymous access or server-registered identifiers and public key for logged in access. Each SGET is signed by the server/account specific private key.
This sort of kills passwords and cookies with one blow. Browsers and clients will have to use some library to session=init("account name") or session=init("anonymous") and just pass that session to the http library so it can do SGET/SPOST. The effect would be every HTTPS transaction would be authenticated by a specific client which eliminates many MiTM scenarios and MFA bypass techniques (you can steal public keys like cookies but private key theft would be made extremely difficult), and since you are authenticating a unique client, why do you need passwords? Just add MFA to it and you don't even have to deal with SSO and oauth! Registration just means you request an account identifer with a pubkey and if approved the server gives it an ok. The burden however is on clients and servers to maintain account information which they sort of already do in a messy non-stanrdard way which this would also fix.
What are your critiques? And can someone steal my idea please?