Just A Summary : The authentication tarpit

Comment on The authentication tarpit by Sam Ruby

Tue, 29 Jan 2008 08:14:27 -0600

Authentication sucks, no two ways about it. Each mechanism introduces more problems.

Question: with Nokia’s LifeBlog mobile app, does the user enter their password each time, or is it saved away in some profile some place?

If the latter, then have the server generate some password for the user. It could be unique to this interface, or simply a hash of the hashed password you already have. Have the user obtain this password by navigating to a web page where you authenticate the user by whatever means you like, and have them enter that password in their profile.

Comment on The authentication tarpit by Piers Cawley

Tue, 29 Jan 2008 09:00:49 -0600

Apparently that’s what Flickr already do and it looks like it’s going to be what we do too. It’s just really bloody annoying.

Comment on The authentication tarpit by Vincent Palmer

Tue, 29 Jan 2008 09:04:08 -0600

@Sam, Nokia’s do save the password, not sure about other devices. Flickr have approached this problem too and use a separate password for APP.

Comment on The authentication tarpit by Rodger

Wed, 30 Jan 2008 02:32:05 -0600

GAAAAAAAAAAAAAAAHHH!

This profession would be a damn sight more enjoyable if people didn’t insist on making the same bloody mistakes when tackling well-known problems again and again and again and again.

If medicine was like this every operation would start with a rediscovery of anatomy from first principles…

Comment on The authentication tarpit by Piers Cawley

Wed, 30 Jan 2008 08:25:22 -0600

It’d be a damned sight more enjoyable if dodgy decisions didn’t get baked into hardware by mobile phone companies eager to jump the gun, thus forcing the rest of us to implement the broken solution ad infinitum.

The flickr style workaround is probably the least awful proposition given where we are now, but sometimes you just have to despair.

Comment on The authentication tarpit by Yossef

Thu, 31 Jan 2008 13:55:10 -0600

I use 1password, but there are still a few passwords (or them with small site-oriented variations) all over the place. This is partly because I just got 1password from the recent MacHeist, but also because I don’t like the idea of only being able to sign in to certain places from one computer (or specific computers, because I think there’s a way to have a central store).

Comment on The authentication tarpit by Piers Cawley

Tue, 05 Feb 2008 02:22:00 -0600

I use 1password + .mac keychain syncing, so I get to use it with all my macs. As I no longer own any computers that don’t run OS X, this is good enough for me.

Comment on The authentication tarpit by Gunnar

Tue, 22 Apr 2008 11:37:10 -0500

Why send the authN creds to the server at all?

http://1raindrop.typepad.com/1_raindrop/2008/04/a-claim-by-any.html