- From: Henry Story <henry.story@bblfish.net>
- Date: Fri, 5 Oct 2012 20:47:56 +0200
- To: Anders Rundgren <anders.rundgren@telia.com>
- Cc: public-identity@w3.org
- Message-Id: <F1C905A8-9783-4487-8614-48633049C059@bblfish.net>
On 5 Oct 2012, at 18:56, Anders Rundgren <anders.rundgren@telia.com> wrote: > On 2012-10-05 18:07, Henry Story wrote: >> >> On 5 Oct 2012, at 17:36, Anders Rundgren <anders.rundgren@telia.com> wrote: >> >>> On 2012-10-05 16:55, Henry Story wrote: >>> >>> TLS-CCA (TLS Client Certificate Authentication) >>> Favorite hate-object of mine :-) >>> >>>> On 5 Oct 2012, at 16:33, Anders Rundgren <anders.rundgren@telia.com> wrote: >>>> >>>>> On 2012-10-05 16:02, Melvin Carvalho wrote: >>>>>> >>>>>> I do agree that BrowserID has a first class UI and WebID has a second class one. >>>>> >>>>> Me too. However, that's not an inherent feature of WebID, it is the "feature" >>>>> you get when "security experts" try to design IT-systems for "people" :-) >>>> >>>> There are a few elements that make up the UI of certificate selection >>>> as far as WebID goes: >>>> >>>> 1. Certificate selection >>>> + Chrome, IE, Opera, Safari all have good UIs >>>> + Firefox has a bad one >>>> You can compare for yourself here: >>>> http://www.w3.org/wiki/Foaf%2Bssl/Clients/CertSelection >>> >>> Since WebID doesn't presume a specific issuer you will get a potentially >>> huge list of certificates that are not meant to be used as WebID. >>> Why is that? Because the lame filter-thing in TLS CCA isn't adapted >>> for the real world. >> >> Ok, you are speaking of the situation where a WebID requesting server >> asks a client for a certificate with the null filter, potentially allowing >> the user to select from every certificate he has ever seen. >> >> In order to solve that problem we had thought of creating an open DN >> for WebID signed certificates. See issue-62 >> >> http://www.w3.org/2005/Incubator/webid/track/issues/62 > > Now we have definitely reached "Workaround Paradise". I don't think the > PKI community including myself see this as a long-term solution. It does not have to be a long term solution. It has to be one available to us to get through a perceived bump, until the value of decentralised pki can become self evident. > >> For our current deployments this was not necessary, and until >> we have enough bigger players, coming up with a good name here was >> not interesting. Perhaps you and Ben Laurie have some suggestions here. >> ( Though we can take that to the public-webid mailing list ) >> >> On the whole for the moment most of us don't have more than a handfull >> certificates. For heavy users this may be a problem, and for them >> having a special DN for issuers of WebID certificates might be the >> answer. > > Sure, I just see WebID as one of a myriad PKI schemes in need of a > better TLS CCA. > >> >> ( Perhaps this is what Ben Laurie was trying to get at in one of his questions >> earlier. ) >> >>> >>> In addition, all resources these days are selected by icons so why >>> doesn't PKI come with that? IETF created an RFC for that but it was so >>> bad that not even Microsoft who sponsored the work ever implemented it. >> >> Well, WebID makes it possible to develop many cool UI improvements >> that would not have been possible before, not without some serious >> privacy issues popping up. >> >> To take your icon example: The browser could find the icon by dereferencing >> the WebID of the user. The profile could contain something like: >> >> <#me> acl:protectedSeeAlso <protected>; >> cert:key [ >> cert:modulus "ae3234d..."^^xsd:hexBinary; >> cert:exponent 56433 ]. >> >> Now the protected resource could contain >> >> <../#me> a foaf:Person; >> foaf:img <pix/sunnyDay.jpeg>; >> foaf:icon <pix/sunny-tiny.jpeg> . >> >> Given that the browser is representing the user here, and can therefore, >> one can imagine get full rights, so it can access the pictures >> and display it as an icon. The nice thing is that the user can go >> to his profile page, update the icon there, and this be immediately reflected >> across all the browsers on all his devices. >> >> You could not do this while respecting privacy without WebID because you would >> have had to put the picture into the certificate. > > This is not what I had in mind. I see the icon as a locally stored attribute to a key. > Microsoft had that with Information Cards but since they never got consumer-PKI to > work satisfactory in Windows, they essentially blew it. On the Web 'local' does not matter any more. Your feeling that it should be "local" has a whiff of pre-web thinking to it. It will be locally stored when you do an HTTP GET. The advantage of having it on your profile server is that you can then synchronise all your browser information with all your devices easily. > > Local icons though presume that there is a functioning key provisioning mechanism > which we (IMO) have not. Since soft tokens in NSS doesn't even supports PINs it > is really the entire PKI client platform that needs overhaul. > > I'm currently using proprietary PKI solutions building on unique client SW. > Looks good, works well. > > WebCrypto could very well become a better mousetrap than TLS CCA. By WebCrypto you mean using javascript. That does not really change anything. As I said I can make WebID work with js apis just as well. What I am basing myself on are simply strong logical foundations, essentially Fregean logic adapted to the Web. > > Anders > > >> >>> >>>> 2. Certificate creation >>>> Using Keygen they are all pretty good now >>>> (except for the silly message to save your certs some browsers display) >>> >>> No product management has ever bothered about PKI key provisioning which >>> is why everybody in their right mind do not use the stuff created by >>> MSFT, GOOG, or APPL. >>> >>> This is though yesterdays news; MSFT have had this information for a decade >>> but since this requirement doesn't come from the US (US banks and government >>> agencies haven't yet "invented" consumer-PKI), it is silently ignored. >>> >>> TLS and web-sessions still suck. Logout anybody? >> >> yes, but I put that in the Transparency box. If you can see that you >> are logged in at all times, a simple gesture should allow you to logout. >> >> The javascript crypto people are trying to generalise Firefoxes javascript >> logout feature, but that is not really the right way to do it. See 3 below. >> >> >>> >>> Fixable? Nope, TLS is owned by people who's interest is security, not usability. >>> Any comments that it might be less than optional is taken as "blasphemy" and >>> we all know how fun that is... >>> >>> As a consequence the wast majority of consumer-PKIs have moved on and created >>> more or less "novel" approaches for PKI authentication. >>> >>> [When vendors actually care for what they do like when Google did their Wallet, >>> you see what is possible] >> >> yes, so the issue was to make the vendors aware of what is possible in creating >> a distributed social web using pki. >> >>> >>> BR >>> AR >>> >>>> >>>> 3. Transparency. >>>> >>>> All browsers suck at this level, and not just for certificates. It should be >>>> a UI principle - supported it seems by EU law, as Dr Ian Walden remarked on the >>>> public webid list [1] - that the browser show you what identity level you have >>>> on each site. BrowserID won't make it any better, unless they change the UI, >>>> in which case the same change can be brought in favor of client certificates. >>> >>> >>> >>>> What Anders is fruestrated about is the UI for using certificates if you >>>> don't use it as WebID suggests. Then of course things are a lot more frusttrating. >>>> >>>> I explain all three levels of the UI in the video on http://webid.info/ >>>> which shows screencasts that you can duplicate and verify. >>>> >>>> Henry >>>> >>>> >>>> [1] http://lists.w3.org/Archives/Public/public-webid/2012Oct/0021.html >>>> >>>> >>>>> >>>>> Anders >>>>> >>>>> >>>>>> >>>>>> However, as I've stated WebID is the *only* identity system that uses a URI to define a user, so is architecturally scalable. BrowserID does *not* use URIs. >>>>>> >>>>>> I dont use WebID for the UI, I use it because every other identity system has turned into walled gardens, and I dislike lockin. >>>>>> >>>>>> >>>>>> >>>>>> I highly doubt bringing up philosophy will actually help here unless you can clarify what you mean re privacy, anonymity, multiple identities. There was some work by the IETF in this direction that seemed going in the right directions: >>>>>> >>>>>> >>>>>> Philosophy may be a distraction here. We'd like to communicate the core key facts. And that is we want to deliver interoperable solutions. >>>>>> >>>>>> >>>>>> >>>>>> https://tools.ietf.org/html/draft-hansen-privacy-terminology-03 >>>>>> >>>>>> I also think this discussion should be confined to its proper mailing list. For example, if it simply becomes FOAF+SSL folks championing the wonders of RDF, then perhaps the discussion should remove other mailing lists than WebID. If its a philosophical discussion, then I'd keep it on philoweb. Or an identity discussion that's not dogmatic, keep on public-identity. This is basic etiquette. >>>>>> >>>>>> >>>>>> Personally I am agnostic to the serialization. It could be RDF, salmon, XML or JSON. I dont even care if auth is done via PKI or not. In this case it's simply associating a public key with a user in a machine readable way. The serialization is unimportant. >>>>>> >>>>>> The common problem that identity is trying to solve, is to authenticate a user in a way that does not create a walled garden. And that requires: >>>>>> >>>>>> - Identifying a user in a standards compliant and scalable way >>>>>> - Making your auth system interoperable with others >>>>>> >>>>>> This is what we are trying to promote. WebID is committed to be an interoperable scalable identity solution. I think people would be happy to promote any other system that will commit to interop. Isnt that the common goal? >>>>>> >>>>>> >>>>>> >>>>>> cheers, >>>>>> harry >>>>>> >>>>>> >>>>>> >>>>>> On 10/04/2012 09:24 PM, Henry Story wrote: >>>>>>> [resent as the image was too big and so stripped from the mailing >>>>>>> list, making one part of the text incomprehensible ] >>>>>>> >>>>>>> On 4 Oct 2012, at 17:10, Hannes Tschofenig <hannes.tschofenig@gmx.net <mailto:hannes.tschofenig@gmx.net>> wrote: >>>>>>> >>>>>>>> Hi Melvin, >>>>>>>> >>>>>>>> On Oct 4, 2012, at 4:49 PM, Melvin Carvalho wrote: >>>>>>>> >>>>>>>>> I think the aim is to have an identity system that is universal. The web is predicated on the principle that an identifier in one system (eg a browser) will be portable to any other system (eg a search engine) and vice versa. The same principle applied to identity would allow things to scale globally. This has, for example, the benefit of allowing users to take their data, or reputation footprint when them across the web. I think there is a focus on WebID because it is the only identity system to date (although yadis/openid 1.0 came close) that easily allows this. I think many would be happy to use another system if it was global like WebID, rather than another limited context silo. >>>>>>>> >>>>>>>> I think there is a lot of confusion about the difference between identifier and identity. You also seem to confuse them. >>>>>>>> >>>>>>>> Here is the difference: >>>>>>>> >>>>>>>> $ Identifier: A data object that represents a specific identity of >>>>>>>> a protocol entity or individual. See [RFC4949]. >>>>>>>> >>>>>>>> Example: a NAI is an identifier >>>>>>>> >>>>>>>> $ Identity: Any subset of an individual's attributes that >>>>>>>> identifies the individual within a given context. Individuals >>>>>>>> usually have multiple identities for use in different contexts. >>>>>>>> >>>>>>>> Example: the stuff you have at your Facebook account >>>>>>> >>>>>>> This is a well know distinction in philosopohy. You can refer to things in two ways: >>>>>>> - with names ( identifiers ) >>>>>>> - with existential variables ( anonymous names if you want ), and attaching a description to that >>>>>>> thing that identifies it uniquely among all other things >>>>>>> >>>>>>> So for example Bertrand Russell considered that "The Present King of France" in "The Present King of France is Bald" was >>>>>>> not acting like a proper name, but as an existential variable with a definite description. That is in >>>>>>> mathematical logic he translated that phrase to: >>>>>>> >>>>>>> ∃x[PKoF(x) & ∀y[PKoF(y) → y=x] & B(x)] >>>>>>> >>>>>>> See http://en.wikipedia.org/wiki/Definite_description >>>>>>> Harry Halpin goes into this in this Philosophy of the Web Thesis >>>>>>> http://journal.webscience.org/324/ >>>>>>> http://www.ibiblio.org/hhalpin/homepage/thesis/ >>>>>>> >>>>>>> So yes we know this, and understand this very well. The Semantic Web is an outgrowth of >>>>>>> Fregean logic, tied to the Web through URIs, and with some of the best logicians >>>>>>> in the world having worked on its design. This is our bread and butter. >>>>>>> >>>>>>> In fact in WebID we are using this to our advantage. What we do is we use >>>>>>> a URI - a universal identifier - to identify a person, in such a way that it is >>>>>>> tied to a definite description as "the agent ID that knows the private key of public >>>>>>> key Key". >>>>>>> >>>>>>> [ image available at: >>>>>>> http://www.w3.org/wiki/images/4/49/X509-Sense-and-Reference.jpg ] >>>>>>> >>>>>>> >>>>>>> The text in the document named "http://bblfish.net/" says: >>>>>>> >>>>>>> <#hjs> foaf:name "Henry Story"; >>>>>>> cert:key [ a cert:RsaPublicKey; cert:modulus ... ; cert:exponent ... ] >>>>>>> >>>>>>> >>>>>>> So in the above the Identifier is "http://bblfish.net/#hjs" which referes to <http://bblfish.net/#hjs> >>>>>>> (me) which you can recognise as the knower of the private key >>>>>>> published on the http://bblfish.net/ web page (in RDFa, in this case) >>>>>>> >>>>>>>> >>>>>>>> To illustrate the impact for protocols let me try to explain this with OpenID Connect. >>>>>>>> >>>>>>>> OpenID Connect currently uses SWD (Simple Web Discovery) to use a number of identifiers to discover the identity provider, see http://openid.net/specs/openid-connect-discovery-1_0.html >>>>>>>> >>>>>>>> The identifier will also have a role when the resource owner authenticates to the identity provider. The identifier may also be shared with the relying party for authorization decisions. >>>>>>>> >>>>>>>> Then, there is the question of how you extract attributes from the identity provider and to make them available to the relying party. >>>>>>> >>>>>>> In WebID that is easy for public info: you use HTTP GET. >>>>>>> Otherwise you put protected info into protected resources, link to them from the WebID profile, >>>>>>> and apply WebID recursively to the people requesting information about that resource. Ie: you >>>>>>> protect the resources containing information that needs protecting. >>>>>>> >>>>>>> This makes it possible to describe people and their relations extremely richly, >>>>>>> and it allows one to be very fine grained in who one allows access to information. >>>>>>> >>>>>>> >>>>>>>> There, very few standards exist (this is the step that follows OAuth). The reason for the lack of standards is not that it isn't possible to standardize these protocols but there are just too many applications. A social network is different from a system that uploads data from a smart meter. Facebook, for example, uses their social graph and other services use their own proprietary "APIs" as well. >>>>>>> >>>>>>> Yes, I know people keep saying its impossible, and then we have trouble showing them - >>>>>>> since the impossible cannot be seen. >>>>>>> >>>>>>> Btw in WebID we use >>>>>>> >>>>>>> The one well know api: HTTP. >>>>>>> A semantic/logic model: RDF and mappings from syntax to that model - which >>>>>>> is based on Relations which I think Bertrand Russel showed to be pretty much all you needed. >>>>>>> >>>>>>> Then it is a question of working together and developing vocabularies that metastabilise. >>>>>>> (More on that in a future video). >>>>>>> >>>>>>>> >>>>>>>> This is the identity issue. >>>>>>>> >>>>>>>> You are mixing all these topics together. This makes it quite difficult to figure out what currently deployed systems do not provide. >>>>>>>> >>>>>>>> Ciao >>>>>>>> Hannes >>>>>>>> >>>>>>> >>>>>>> Social Web Architect >>>>>>> http://bblfish.net/ >>>>>>> >>>>>> >>>>>> >>>>> >>>> >>>> Social Web Architect >>>> http://bblfish.net/ >>>> >>> >> >> Social Web Architect >> http://bblfish.net/ >> > Social Web Architect http://bblfish.net/
Attachments
- application/pkcs7-signature attachment: smime.p7s
Received on Friday, 5 October 2012 18:48:35 UTC