Skip to main content

Fuzbolero .'s Library tagged authentication →  View Popular

An OpenID is not an account! - simonwillison.net

  • The key thing here is that you should never trust an OpenID on its own. It could be a real person, or it could be a spammer, psycopath or general undesirable.



    Does this mean OpenID is completely useless? Absolutely not! You just have to think of it in the same way that you think of username and password combinations: as the “key” to an account.

  • The trust issue is now null and void. An OpenID is just as trustworthy as a regular username and password (which could have been posted to bugmenot and shared with thousands of people).
  • 1 more annotations...

Feature request: Integration of idselector instead? | drupal.org

Hmmm. Ideally, such functionality should be based on either opensourced solutions or go directly towards an OpenID provider you trust. Not good lacking insight into the code of security features.

drupal.org/306200 - Preview

drupal cms modules security authentication openid opensource security-management

  • Comfortable OpenID Login Box
  • The problem with ID Selector isn't open source, is it?
  • 2 more annotations...

Another blog about OpenID - ignisvulpis.blogspot.com

See also list of other blogs about "identity" along the sidebar on that blog.

ignisvulpis.blogspot.com - Preview

openid blog authentication reference development

On OpenID Gaining Momentum: 30,000 Sites, Half a Billion Accounts « The Real McCrea

  • Two nice pieces yesterday on how OpenID picked up steam in 2008. David Recordon’s post at OpenID.net is simply entitled 2008:Momentum. It offers a great review of the progress made last year:

IDselector.com - Making OpenID easier

    • Helps new users get and remember their OpenID.
    • "One click" login experience for return users.
    • Consistent login experience across OpenID enabled websites.

OpenID Provider (OP) Delegation - wiki.openid.net

  • This page exists to track information relating to the OpenID Provider Delegation Extension 1.0. 

OpenID Provider Delegation Extenstion - Draft 1 - wiki.openid.net

  • This document specifies an extension to OpenID Authentication 2.0
    Discovery. This extension allows an end-user to delegate authority
    over a particular OpenID Identifier to divergent OpenID Providers
    (OP's), depending on certain characteristics of a Relying Party
    and/or certain characteristics of an OpenID transaction.





    This extension specifies three categories under which Identifier
    authority can be delegated: Service, Class, and Domain. For example,
    an Identifier might specify a different authoritative OP depending
    on the Service (e.g., OpenID 2.0, OAuth, and others); the RP Domain
    (*.example.com); or a pre-defined service Class (e.g., one OP for
    single-factor auth, and another OP when two-factor Auth is
    required).





    By providing OpenID Identifiers with the ability to specify multiple
    OP's based on particular characteristics of each OpenID transaction,
    users will be able to utilize the best OP for any particular OpenID
    transaction.

Launchpad integration using OpenID | drupal.org

OpenID Teams | drupal.org

  • The OpenID Teams module is an OpenID extension which allows you to assign Drupal roles to users each time they log in, based on their membership of teams you specify which are provided by their OpenID provider.
29 Jan 09

OpenId Minus Id Equals Wide Open - Sam Ruby - intertwingly.net

  • What concerns me is that people may use such a URI for delegation.  If Jorgen, for example, were to add such a generic URI as his openid.delegate link, then anybody who has a windows live id could authenticate using his blog URI.

    What concerns me more is if somebody follows these instructions for delegation.  Then anybody with a Windows Live id could authenticate using his blog.
  • I don’t think that this means that there is a case where either Microsoft or Yahoo! would return the same OpenID URL in their response.  Rather if I were to type in “http://david.openid.live-int.com/” to an OpenID Relying Party, Microsoft’s provider would ignore this and have me choose the OpenID I wish to use after logging in on Live.com.  So, I don’t think this means that any two users will have the same OpenID
  • 19 more annotations...
06 Jan 09

YubiKey module | drupal.org

  • Users can assign one or more YubiKeys to an existing account, and log in using a YubiKey. This offers additional security to the users even over insecure connections.
02 Nov 08

What Would It Take To Have Open CA Authorities? - Slashdot.org

  • With the release of Firefox 3, those who have been using self-signed certificates for SSL now face a huge issue — the big, scary warning FF3 issues which is very unintuitive for non-technical users. It seems Firefox is pushing more websites in to the monopolistic arms of companies such as Verisign.

RFC 2617 - HTTP Authentication: Basic and Digest Access Authentication

  • This document also provides the specification for HTTP's
    authentication framework, the original Basic authentication scheme
    and a scheme based on cryptographic hashes, referred to as "Digest
    Access Authentication".

Securesite module: Support Digest Authentication - with external reference links | drupal.org

(With references/links to RFC2617 and Wikipedia definition of Digest authentication.)

drupal.org/136822 - Preview

drupal security securesite authentication reference qroykm

  • Users' passwords are stored when they log in or change their passwords. Passwords are currently stored in the securesite table, but a more secure solution needs to be found, otherwise any user who has permission to use the PHP filter will have access to every other user's password.
  • Users whose passwords have not been stored can cancel the HTTP authentication dialog and log in with the HTML form.
  • 4 more annotations...
1 - 20 of 32 Next ›
Showing 20▼ items per page

Selected Tags

Related Tags

Sponsored Links

Ads by Google

Diigo is about better ways to research, share and collaborate on information. Learn more »

Join Diigo