Re: WHY USING FACEBOOK, GOOGLE, AND TWITTER TO LOG INTO APPS IS A PROBLEM

On 17 June 2015 at 17:11, <Joerg.Heuer@telekom.de> wrote:

> Okay, let’s formulate my remark more correctly: It should be possible to
> store credentials outside of the browser, explicitly to allow for these
> different preferences. No problem with browsers implementing the same
> functionality. In essence we are talking about portability now.
>

Yes, I think that's the case.  And people are doing this already in a
variety of ways.


>
>
> *From:* Melvin Carvalho [mailto:melvincarvalho@gmail.com]
> *Sent:* Mittwoch, 17. Juni 2015 17:05
> *To:* Heuer, Jörg
> *Cc:* Eric Korb; W3C Credentials Community Group
>
> *Subject:* Re: WHY USING FACEBOOK, GOOGLE, AND TWITTER TO LOG INTO APPS
> IS A PROBLEM
>
>
>
>
>
>
>
> On 17 June 2015 at 16:57, <Joerg.Heuer@telekom.de> wrote:
>
> +1 to definitely not aim at storing credentials in the browser. I’d like
> to use different browsers on different platforms – and have them synced if
> I may…
>
>
>
> That's a design decision and people will have different preferences.  It's
> really important not to impose personal preferences onto others, here.
> Mozilla tried to do this and that's one reason Persona failed to become a
> standard.
>
> Estonia solve this quite neatly with the e citizen program by using a card
> reader.  The browsers have the ability to store credentials externally,
> which is a nice feature.
>
> It seems to have worked very well.  Once finland operate this, both
> belgium and holland have digital id schemes in the world.  I think
> estonia/finland is the most advanced.  There will be mounting pressure IMHO
> on denmark, norway, sweden and then germany to innovate:
>
> https://www.youtube.com/watch?v=L4J5yeyGu1A
>
> It's been a huge win for Estonia to date
>
> Adding the online national census capability cost only the census
> software, less than €10K, because the infrastructure was already in place
>
> compare the US: The 2010 census cost $13 billion, approximately $42 per
> capita
>
>
>
>
>
> *From:* Timothy Holborn [mailto:timothy.holborn@gmail.com]
> *Sent:* Mittwoch, 17. Juni 2015 16:52
> *To:* Eric Korb; Melvin Carvalho
> *Cc:* Credentials Community Group
> *Subject:* Re: WHY USING FACEBOOK, GOOGLE, AND TWITTER TO LOG INTO APPS
> IS A PROBLEM
>
>
>
> (Can't respond inline on Google inbox, as far as I can tell...)
> Re: credentials in the browser.
> So,
> How do you reset your tls cert? Say, for nanna...
> Are you suggesting you think credentials are unnecessary?
> What's the difference between trusting a data space service with your data
> vs. your credential access support.
> Do you think it's global or go home; or,
> Should every legal entity (and/or bot/agent) be able to "mint" a
> "credential", and what happens if your computer is stolen, or fails, or
> someone else is using your account on your computer.
> How does it support isolation of roles/persona.
> Communities at all levels share and disagree on an array of values. From
> images relating to local laws on nudity or gun licensing, to the cost of
> education.
> Who says one ring should rule them all...
>
>
>
> On Thu, 18 Jun 2015 at 12:17 am, Melvin Carvalho <melvincarvalho@gmail.com>
> wrote:
>
> On 17 June 2015 at 14:23, Eric Korb <eric.korb@accreditrust.com> wrote:
>
> Interesting article.
>
>
>
>
> http://www.fastcompany.com/3044280/one-more-thing/the-ghosts-of-app-permissions-past
>
>
>
> Yep, it used to be even worse.  They used to phish your password:
>
> http://microformats.org/wiki/social-network-anti-patterns
>
> Mozilla persona still does this.
>
> I prefer to keep credentials in the browser.  This can be done today with
> X.509 or the web crypto API.
>
>
>
>
>
> ----------------------------------
>
> Eric Korb, President/CEO - accreditrust.com <https://www.accreditrust.com>
>
>
>