{"id":670,"date":"2015-09-08T22:31:56","date_gmt":"2015-09-08T21:31:56","guid":{"rendered":"http:\/\/www.owlfish.com\/weblog\/?p=670"},"modified":"2015-09-08T22:31:56","modified_gmt":"2015-09-08T21:31:56","slug":"killing-passwords","status":"publish","type":"post","link":"https:\/\/www.owlfish.com\/weblog\/2015\/09\/killing-passwords\/","title":{"rendered":"Killing Passwords"},"content":{"rendered":"<p>Passwords on websites and in apps are the bane of internet usage.\u00a0 Much has been written (recently in TechCrunch &#8211; <a title=\"TechCrunch article on passwords\" href=\"http:\/\/techcrunch.com\/2015\/09\/07\/kill-the-password\/\">Kill The Password)<\/a> on how painful they are to generate and remember.\u00a0 Password managers help with the challenge, but are\u00a0 a cumbersome band aid.<\/p>\n<p>When building a website application, adding username and passwords is also painful, requiring extensive work to get working well and securely.\u00a0 So, what are the alternatives?\u00a0 There are some good ideas out there, but they tend to be complicated (OpenID Connect), or put large identity providers in a special position (Fido, OpenID Connect) or are centralized and cost money (e.g. <a title=\"Clef\" href=\"https:\/\/getclef.com\/\">Clef<\/a>).<\/p>\n<p>I think it&#8217;s possible to build a simple, distributed, secure authentication mechanism that allows users to login to sites without generating passwords.\u00a0 The vision is that a user can authenticate themselves easily:<\/p>\n<ul>\n<li>Enter your email address<\/li>\n<li>See a pass phrase in the application \/ website<\/li>\n<li>Check your phone &#8211; if the same pass phrase is displayed, tap authenticate and you are in<\/li>\n<\/ul>\n<p>I&#8217;ve been experimenting with how this could be done, documenting the specification on an <a title=\"Owlauth specification\" href=\"https:\/\/github.com\/owlfish\/owlauth-spec\">Owlauth<\/a> Github page, and writing an authentication server in Go that implements the specification.\u00a0 It&#8217;s not done yet &#8211; the current code sends email to the user with a link rather than a notification to a phone &#8211; but it&#8217;s close enough that it proves it can work.<\/p>\n<p>In addition to the specification, I&#8217;ve also got a test application running (A <a title=\"Larder Web Application\" href=\"https:\/\/owlfish.com\/larder\">larder app for tracking food best before dates<\/a>) that authenticates using this method.<\/p>\n<p>The challenge now is how to move this forward.\u00a0 Finishing the implementation to allow device based authentication is straightforward (I&#8217;ve got most of the code done), but it&#8217;s of no use if there isn&#8217;t a community of developers interested in deploying it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Passwords on websites and in apps are the bane of internet usage.\u00a0 Much has been written (recently in TechCrunch &#8211; Kill The Password) on how painful they are to generate and remember.\u00a0 Password managers help with the challenge, but are\u00a0 a cumbersome band aid. When building a website application, adding username and passwords is also [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[7],"tags":[],"_links":{"self":[{"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/posts\/670"}],"collection":[{"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/comments?post=670"}],"version-history":[{"count":4,"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/posts\/670\/revisions"}],"predecessor-version":[{"id":674,"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/posts\/670\/revisions\/674"}],"wp:attachment":[{"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/media?parent=670"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/categories?post=670"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.owlfish.com\/weblog\/wp-json\/wp\/v2\/tags?post=670"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}