Re: Web ID as passwordless authentication for debian web services
Quoting Russ Allbery (2013-05-16 22:24:34)
> Jonas Smedegaard <dr@jones.dk> writes:
> > Quoting Russ Allbery (2013-05-16 19:57:59)
>
> >> Sure, but if you have control over the server certificate and are
> >> tying the server certificate to the user certificate via some
> >> mechanism like Monkeysphere, why do the whole indirection dance
> >> through a URI at all?
>
> > Because when identifier is a URI then it is reusable for other
> > purposes than authentication.
>
> Thank you -- this and your other message clarifies for me. The idea
> is to create a persistent representation of identity on the web that
> can be linked to, included in other graphs, etc. The problem with a
> certificate is that, while you can link *from* it, you can't (easily)
> link *to* it or include it in graphs that can be followed with simple
> HTTP requests.
Yesss. :-)
Thanks a lot for your patience with me.
> I'm not sure what I personally think of this use case (I'm in general
> not a fan of rich social graphs, since I think the privacy drawbacks
> of making all of that data easy to mine outweigh the benefits in most
> cases), but it's definitely a use case a lot of people care about.
I am quite concerned about privacy as well.
I am, however, concerned about transparency too, and believe that all
data that is public should also be easy to mine.
Identity-related data worrisome to be mined should not be published in
the first place, because just making it difficult to "tie the dots" is a
form of "security by obscurity": Knowledge within such data is then
effectively still minable by those with enough (computing) power.
I don't want to limit deep knowledge to those with enough power to
extract it themselves.
I want knowledge equally available to all, not favoring those in power!
> One further note, though:
>
> > For PGP keysigning, a common way to "authenticate" is to look at a
> > passport or drivers license. But we cannot really authenticate that
> > way.
>
> > In airports when showing a passport, it is matched against a
> > centralized database. The government issuing the passports also
> > provides ways for police and other governmental appointed people to
> > authenticate passports.
>
> > ...but noone else are allowed access to those centralized databases.
>
> The passport verification system works this way partly because it
> predates public key cryptography and partly because the government
> wants to store confidential data about you that it doesn't want other
> people (often including, and perhaps even *particularly*, you) to be
> able to see.
[ details on comparison between classic passports and PKI snipped ]
My point was not how passports are useful to governments, but how
passports are being "abused" outside of its intended use.
If we separate identities from those identified, then we encourage reuse
of identities.
Yes, reuse of identities can be used for evil. Anything can.
I believe that avoiding to explore generically useful things will most
likely hurt good use more than evil use, because it will also discourage
learning about possible uses and discourage learning to recognize (evil)
use by others.
- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
[x] quote me freely [ ] ask before reusing [ ] keep private
Reply to: