Re:BitAuth for Decentralized Authentication
by alexro on Wednesday July 02, 2014 @09:29AM
(#7976813)
You can still use SSL, why that argument?
BitAuth makes you sign-up and log-in with a public key, SSL plays along to verify the server. Win-win?
[ Parent
| on HN ]
Re:BitAuth for Decentralized Authentication
by teraflop on Wednesday July 02, 2014 @01:04PM
(#7978107)
Sure, and any sane implementation of BitAuth should use SSL.
The point I'm trying to make is that if you can trust SSL to protect a BitAuth signature, you can also trust it to protect a password. So claiming "passwords may travel over plaintext" as a relative advantage of this scheme is disingenuous; in both cases, you need to provide that protection at a lower protocol level.