top | item 2128966

The Road to Better Authorization

10 points| psadauskas | 15 years ago |blog.theamazingrando.com | reply

9 comments

order
[+] r00fus|15 years ago|reply
The author doesn't really expound why 1password wouldn't work. It's available for Mac/Win and integrates nicely with FF, IE(Win), Chrome and Safari(Mac).

That software is indispensable to me, as I often login to numerous dev and test instances of webapps in addition to my shopping and forum sites... I can now have long, secure passwords/phrases that are autogenerated. In addition, with dropbox, I have 1password distributed on all my devices.

I avoid the Google problem he mentioned by using separate browsers (ie, FF for work, Safari/Chrome for personal) or separate computers/devices (I only really use Facebook on my mobile). If multiple instances of a particular browser is desired, something like http://fluidapp.com/ or Mozilla Prism could be used to segregate the profiles.

In short, the author ignores existing products and is re-inventing the process.

[+] psadauskas|15 years ago|reply
Thats a little unfair. I mentioned existing products, and I use them, so I can't fathom where you get that I ignore them.

I've used KeePass for years, but I have to manually open it and copy/paste passwords. I've just started using 1Password, and "integrates nicely" is not how I would describe its interaction with Chrome. Even the 1Password site has a list of a half-dozen bullet points of critical things the Chrome extension can't do.

In the very first section, I explain how I'm doing the exact same thing with multiple browsers, and that "works" (not well) until you get about 3. I have 4 AWS accounts for various projects, and remembering which browser is which is annoying. What I want is a single button in a toolbar or menu to pick a different account for a single website, without having to leave my preferred browser.

I feel like you're sticking your head in the sand. "I've found workarounds to all the problems he mentioned, so nobody should spend their time trying to make it better!"

I don't mean to be personal, but you just skimmed out a few things to nitpick, without really reading the article.

[+] davito88|15 years ago|reply
i've always thought password authentication is not the best way to be doing auth for websites. certificates seem to be the right solution, but difficult for the user to manage. (i love certs for ssh.)
[+] psadauskas|15 years ago|reply
I guess I could expand upon that in the 2nd bonus point. Certificates would make an excellent extension to HTTP Auth, as long as end-users can self-sign, like SSH, and not have to pay a $100/yr extortion fee to a company like Verisign.
[+] r00fus|15 years ago|reply
Agreed. Any time I can ditch the password, I do. Certs are a pain in the ass to setup, though. SSH without passwords is pure freedom.