TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

BitAuth for Decentralized Authentication

105 点作者 richardburton将近 11 年前

10 条评论

teraflop将近 11 年前
OK, I&#x27;ll be the obligatory critic: I don&#x27;t see how this solves any problems that TLS client certificates don&#x27;t. The introduction says BitPay considered client certificates, but doesn&#x27;t say why they rejected them. And &quot;easy to implement wherever TLS is implemented&quot; sounds like more of a selling point than &quot;easy to implement wherever the Bitcoin protocol is implemented.&quot;<p>Also, it seems a little questionable to claim &quot;passwords may travel over plaintext&quot; as a benefit of BitAuth over password authentication. My initial impression is that when not using HTTPS, BitAuth is more secure than password authentication against a <i>passive</i> adversary, but that both are equally vulnerable to MITM attacks.
评论 #7974005 未加载
评论 #7974596 未加载
评论 #7975908 未加载
评论 #7976325 未加载
al2o3cr将近 11 年前
It&#x27;s Tuesday, so I guess it&#x27;s time for another &quot;assume a public-key infrastructure&quot; post - this time with OMG BITCOINZ sauce on top.<p>It still handwaves away the biggest problem: getting users to store a private key securely. If that was straightforward, we&#x27;d all be using GPG already...
评论 #7974241 未加载
tonyhb将近 11 年前
This seems like the HMAC authorisation in OAuth 1, moved to HTTP via JS and custom headers. If the comparison is right, it should be a generally secure and easy to implement auth protocol.<p>It would be great for something like this to be commonplace, but the UI definitely needs to be solid. A few questions looking at it initially:<p>- How does the browser know your private keys?<p>- How does the browser know how to send the signed header?<p>- How are nonces managed (especially over multiple devices, if the new nonce always needs to be higher than a previously used one)?<p>- Can you have more than one SIN?<p>- If so, what&#x27;s the benefit of having multiple SINs vs multiple passwords?<p>On a sidenote, bitpay make some seriously kick ass tools and I love how creative they are.
评论 #7974079 未加载
M4v3R将近 11 年前
So, they&#x27;ve basically just reinvented SRP [1] using EC crypto. I&#x27;m a big fan of SRP and use it in production, but it has already years of refinements which makes it very secure. Designing auth mechanisms is hard, there are many subtle ways you can get it wrong. If you&#x27;re looking for this kind of auth mechanism, I recommend to take a look at SRP first.<p>Still, kudos for their efforts. If they continue to improve this, it could take a fair amount of auth &quot;market&quot; some day.<p>[1] <a href="http://srp.stanford.edu" rel="nofollow">http:&#x2F;&#x2F;srp.stanford.edu</a>
scrollaway将近 11 年前
As usual in decentralized authentication posts, I&#x27;d like to mention Mozilla Persona[1] which is a decentralized third party authentication service over the open source BrowserID protocol.<p>I don&#x27;t mean to diminish the author&#x27;s work in any way; but if you&#x27;re interested in these things and don&#x27;t know about Persona, please look into it!<p>[1]: <a href="https://www.mozilla.org/en-US/persona/" rel="nofollow">https:&#x2F;&#x2F;www.mozilla.org&#x2F;en-US&#x2F;persona&#x2F;</a>
评论 #7974966 未加载
评论 #7974637 未加载
lifeisstillgood将近 11 年前
I mean this stuff is just catnip for me. Unexpected new uses of technology from one domain to another, just serves to reinforce how seminal bitcoin was&#x2F;is.<p>Having looked at it with my very layperson eyes, I struggle to see how it is significantly better than say client side certificates. Same idea - sign a request with local private key, only difference is using the SIN mechanism to let the server know I am to be trusted.<p>But it&#x27;s fascinating to see the evolution of these things in real time
评论 #7973965 未加载
评论 #7973893 未加载
omgitstom将近 11 年前
The most important piece that needs to be handled is described in the github repo:<p>&#x27;There also needs to be a public place to store SIN&#x27;s, preferably in a decentralized blockchain or datastore like namecoin. Key revocations could be stored here as well as reviews&#x2F;feedback to build a reputation around an identity.&#x27;<p>Otherwise, apps that integrate will need to store SINs in their user tables. I see that this would add an unnecessary amount of work around management of SINs.<p>Great work, I&#x27;m looking forward to see where this goes.
yeukhon将近 11 年前
So the workflow is generate asymmetric key pairs, generate SIN, sign the request with your private key to verify?<p>How exactly does it work for multiple devices? Each device has its own key pair and an unique SIN? How do we connect multiple SINs as one user?
评论 #7976006 未加载
erpellan将近 11 年前
How is this different&#x2F;better than SSH?
geoffsanders将近 11 年前
Just use LaunchKey - <a href="https://launchkey.com" rel="nofollow">https:&#x2F;&#x2F;launchkey.com</a> or <a href="https://github.com/launchkey" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;launchkey</a>
评论 #7974412 未加载
评论 #7974170 未加载