Re: WebID as passwordless authentication for debian web services
On 17/05/13 17:36, Olivier Berger wrote:
>> The only way to prevent this attack in WebID that I see is to either do
>> leap-of-faith permanent caching [...] or
>> to secure the connection to my identity URI.
>
> I wonder how OpenID, for instance, is supposed to resist to such
> attacks, in comparison...
It's basically the same, but with less social expectation of https. If
your OpenID identity URL is http, a relying party (e.g. the blog you're
commenting on) can be MitM-attacked and there's nothing you can do about
it; if your OpenID identity URL is https, it has to rely on the PKIX
(the CA cartel), or some sort of CA-replacement like Convergence, to
detect/avoid MitM.
By way of context, OpenID originated on Livejournal as a way to have
federation between blogging platforms (e.g. other sites running the
Livejournal codebase). At the time, https was considered sufficiently
expensive that LJ didn't even use it to secure login, let alone normal
browsing. OpenID's original threat model was "stop people not on my
friends list from reading what I blog about them", not "stop the US
government from reading my secrets".
S
Reply to: