<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">John,<br><br>> As a customer of Eddie's service I can say that it works quite well<br>> given the limitations of browsers.<br><br>But we can't tell if it's secure, because the details are not<br>documented.<br><br>> Getting users to manage moving private keys and certificates from<br>> Firefox into an iPhone is not something most people are going to<br>> manage, given the current technology. (yes it is possible) <br>> <br>> One possible area of exploration is coupling Eddie's existing LoA 2<br>> certificates with openID Connect to have a LoA 2 service.<br>> <br>> Doing that with openID 2.0 is still a LoA 1 service so not<br>> particularly interesting to NSTIC.<br>> <br>> Having long experience with PKI client auth there are many things that<br>> could be done to improve the
experience for using it as a primary<br>> authenticator for SAML, openID 2.0 and OpenID Connect.<br>> It is probably best to separate the primary and secondary<br>> authenticator issues to some extent, especially if you are looking for<br>> a grant.<br>> <br>> OpenID is agnostic to the primary authenticator technology used by<br>> Identity providers. Some like StarSSL use PKI, others like Google<br>> are offering OTP, and SMS, and Mobio who are doing QR codes.<br><br>I know.<br><br>> We still have a lot of room for innovation with primary<br>> authenticators. <br>> <br>> The hardest work is perhaps the identity proofing and management at<br>> higher assurance levels, without that the value of the additional<br>> security is not apparent to a lot of people.<br><br>Username+password credentials are used on the Web to authenticate<br>repeat visits, i.e. to ensure that the user who is
logging in to an<br>account is the same user who registered and created the account<br>earlier. No proofing is involved. The main role of OpenID as it is<br>used on the Web today is to replace username+password login for that<br>same purpose. No proofing is needed for that. But OpenID as used<br>today does not eliminate the security risks of passwords, arguably it<br>makes them worse by facilitating phishing attacks. By authenticating<br>to the identity provider with a certificate rather than a password you<br>do eliminate the password, and the phishing attacks, thus making<br>OpenID much more secure.<br><br>> There are a lot of things people can try and get NSTIC grants for. <br>> <br>> I don't know that the openID general list is necessarily the place to<br>> dig into the deployment details of PKI client auth though.<br>> <br>> Good luck with your grant proposal for those of you going after
it.<br><br>Thank you, I really appreciate that :-)<br><br>Francisco<br><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> John Bradley <ve7jtb@ve7jtb.com><br> <b><span style="font-weight: bold;">To:</span></b> Eddy Nigg (StartCom Ltd.) <eddy_nigg@startcom.org> <br><b><span style="font-weight: bold;">Cc:</span></b> "openid-general@lists.openid.net >> 'openid-general'" <openid-general@lists.openid.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, February 14, 2012 7:06 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [OpenID] OpenID Providers
Invited to Join in an NSTIC Pilot Proposal<br> </font> </div> <br>
<div id="yiv750055563"><div>As a customer of Eddie's service I can say that it works quite well given the limitations of browsers.<div><br></div><div>Getting users to manage moving private keys and certificates from Firefox into an iPhone is not something most people are going to manage, given the current technology. (yes it is possible) </div><div><br></div><div>One possible area of exploration is coupling Eddie's existing LoA 2 certificates with openID Connect to have a LoA 2 service.</div><div><br></div><div>Doing that with openID 2.0 is still a LoA 1 service so not particularly interesting to NSTIC.</div><div><br></div><div>Having long experience with PKI client auth there are many things that could be done to improve the experience for using it as a primary authenticator for SAML, openID 2.0 and OpenID Connect.</div><div>It is probably best to separate the primary and secondary authenticator issues to some extent, especially if you are
looking for a grant.</div><div><br></div><div>OpenID is agnostic to the primary authenticator technology used by Identity providers. Some like <a rel="nofollow" target="_blank" href="http://www.startssl.com/">StarSSL</a> use PKI, others like <a rel="nofollow" target="_blank" href="http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html">Google</a> are offering OTP, and SMS, and <a rel="nofollow" target="_blank" href="http://www.mobio.net/">Mobio</a> who are doing QR codes.</div><div><br></div><div>We still have a lot of room for innovation with primary authenticators. </div><div><br></div><div>The hardest work is perhaps the identity proofing and management at higher assurance levels, without that the value of the additional security is not apparent to a lot of people.</div><div><br></div><div>There are a lot of things people can try and get NSTIC grants
for. </div><div><br></div><div>I don't know that the openID general list is necessarily the place to dig into the deployment details of PKI client auth though.</div><div><br></div><div>Good luck with your grant proposal for those of you going after it.</div><div><br></div><div>John B.</div><div><br></div><div><div><div>On 2012-02-14, at 7:55 AM, Eddy Nigg (StartCom Ltd.) wrote:</div><br class="yiv750055563Apple-interchange-newline"><blockquote type="cite">
<div>
<br>
On 02/14/2012 06:46 AM, From Francisco Corella:
<blockquote type="cite">
<div style="color:rgb(0, 0, 0);background-color:rgb(255, 255,
255);font-family:times new roman, new york, times, serif;font-size:12pt;">I guess you mean that if the relying party
downloads a certificate in<br>
the body of an HTTP response with a content-type header whose
value is<br>
a MIME type indicating that the body contains a certificate, and
if<br>
Firefox "finds a valid key pair" then Firefox will import the<br>
certificate automatically. Did I guess right?<br>
</div>
</blockquote>
<br>
Yes.<br>
<br>
<blockquote type="cite">
<div style="color:rgb(0, 0, 0);background-color:rgb(255, 255,
255);font-family:times new roman, new york, times, serif;font-size:12pt;">Well, depending on the details, that could be
a security hole. If the<br>
valid key pair that Firefox finds consists of the publick key in
an<br>
existing certificate and the associated private key, Firefox
could end<br>
up replacing the existing certificate with one downloaded by an<br>
attacker that binds the public key to the attacker's identity.<br>
</div>
</blockquote>
<br>
No, if an attacker could do that it'd be too late anyway, then he
probably could impersonate the entire internet. "Finding" a public
key that would match a private key is kind of impossible (with
sufficient key size). But I'm not sure if this is the right forum
for such crypto stuff.<br>
<br>
<div class="yiv750055563moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a rel="nofollow" target="_blank" href="http://www.startcom.org/">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a rel="nofollow">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a rel="nofollow" target="_blank" href="http://blog.startcom.org/">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a rel="nofollow" target="_blank" href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</div>
_______________________________________________<br>general mailing list<br><a rel="nofollow" ymailto="mailto:general@lists.openid.net" target="_blank" href="mailto:general@lists.openid.net">general@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-general<br></blockquote></div><br></div></div></div><br>_______________________________________________<br>general mailing list<br><a ymailto="mailto:general@lists.openid.net" href="mailto:general@lists.openid.net">general@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-general" target="_blank">http://lists.openid.net/mailman/listinfo/openid-general</a><br><br><br> </div> </div> </blockquote></div> </div></body></html>