Sun, May 22, 2005
These two articles are very interesting indeed. The first one is more interesting than the second, where implementation details are discussed. As readers of my blog may be aware, I don’t hold much faith in browsers and I certainly don’t think putting any kind of personal info into them is a good idea. Anyway, have a read of the articles:
In the articles Stephen Downes talks about the impossibility of authenticating users on the net. It’s impossible for a Service Provider to be sure that when Harry McDesperate says’s he’s Harry McDesperate, he’s not some lying theiving little toerag who’s found out the real Harry’s password.
The articles state that without the body, authentication is impossible. If you believe this and I do, then the only way to authenticate to a service is to point your browser at it, then jump in a car/bus/plane/boat and travel to the home of the website’s owner and say, “see that page access a while ago - that was me, ok?”.
So, what’s the solution? According to Stephen, we should all self-identify and Service Providers should trust that self-identification on the basis of the trust inherent in it. Trust? From where does this trust spring? From the consequences of our revealing our authentication credentials to toerags. If all we ever do is access mundane news web sites that require registration then we’re not going to care if someone starts impersonating us. What are they going to do? Read the news on our behalf? Let them steal our credentials I say.
If, on the other hand, we use our self-identification to manage our bank accounts then we’re going to keep our credentials secure, aren’t we? It’s that assumption of security that service providers use to trust self-identification. For, in Stephen’s implementation, only the bearer of correct credentials can login to their self-identification server, to assert from there on, “I am Harry McDesperate”. btw, in case no-one’s heard of such a character, he is, in fact, the world’s most violent web surfer. This introduces another level of trust in self-identification - no-one’s going to dare impersonate such an individual!
So, what’s it all about? You participate in Single Sign On (SSO) by authenticating to your self-identity server. Hold on, authenticate? but that’s pointless as there’s no guarantee it’s me authenticating. It may be my neighbour who’s watching my keystrokes on my open access wireless lan. Indeed but if it’s to access my offshore bank stashes then the little old lady next door ain’t gonna be listening on my keystrokes. There’s the trust coming in now, see what I mean?
As the value of a Service Provider’s offerings increase in value to you, so it’s level of assumed trust in your assertions increases too.
It’s all a bit Shibbolethy. The Service Provider redirects and gets info on you etc. using SAML. Very nice but not particularly interesting to someone who’s been at the Shibb/SAML coalface for a while. The interesting part is that symbiotic trust relationship between you and the Service Provider.
The other interesting part is where you authenticate to your self-identity server and from then on get SSO to all enabled sites. Authenticate, SSO, enabled sites. This is exactly what you can do with the Bodington VLE right now. You can login and Guanxi will get you SSO access to all Shibboleth Service Providers.
What I’d really like to do now is explore the concept of self-identification, using Bodington as a self-identity server.
The new way of doing things described by Stephen is called mIDm (My - ID - Me) or (Middim) as I called it at first. The only bothersome thing about that pronunciation is it sounds a bit too like Midden. I doubt mIDm will resemble such an object as it’s far too interesting and radical to attract corporate flies.