Elliotte Harold wrote:
Kenneth Downs wrote:
True, but we need a better answer than that.
Can you explain what mechanisms are storing the passwords, and why no
additional weakness has been introduced?
The issue here is really one of psychology and usability. A poorly
usable authentication system will cause users to route around it, for
example by always using the same password, by choosing easily
remembered passwords, by writing them down on Post-it notes stuck to
their monitors, or all of the above. The theoretical strength of
authentication systems is irrelevant in the face of user
counter-measures such as these.
<snip>
A browser-based password store is the most secure authentication
system devised to date. In practice, everything else that has been
tried has been less secure. I suspect we're not going to improve on
this state of affairs until we move away from usernames and passwords
completely.
Well you've convinced me.
Technically there is nothing really to the issue of changing the PHP code.
However, this leaves the issue of what we are telling customers, if
anything.
The conversation we ought to have with the customer is all about what
type of single sign-on the users are using. But, methinks most
programmers instead are having a conversation about their own efforts in
handling passwords, which is misleading and irrelevant.
--
Kenneth Downs
Secure Data Software, Inc.
www.secdat.com www.andromeda-project.org
631-689-7200 Fax: 631-689-0527
cell: 631-379-0010
_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk
NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com
Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php
