Date: Sun, 17 Dec 2017 14:14:06 +0100 From: "e@...tmx.net" <e@...tmx.net> To: passwords@...ts.openwall.com Subject: Re: Authentication vs identification On 12/17/2017 02:01 PM, Denny O'Breham wrote: > «still, when i provide ma passport to a party that wants to ID me, i > do not ID myself, they do it to me.» > > I could say the same thing about authentication: no you can't. this party has no means of doing the auth. in the asymmetric situation they do not have your key. in the symmetric situation they know they are not you (if they initiate auth it will be an attempt to fool themselves through and through -- not real auth (of course you can include this scenario into the term "auth", it will make the definition of "auth" useless, but i can not forbid you creating useless definitions)) > The proof about that is that even if I correctly give the right > password, one could still refuse to authenticate me. no. they can refuse to give you access to their resources or whatever goal of the auth it was. giving you access is not auth. > «the original claim was about the auth requiring smthng.» > > But to ID someone, I'm required to give something too: my name for > example. no. they can obtain your identifiers without your participation. this is the characteristic feature of identifiers -- they are not secret: your name, for example, is not a secret. thus your participation IS NOT REQUIRED. you you seriously misunderstood the word "required". > What is the difference in my level of "participation" in giving my ID > or my password? you are supposed to be the only man on Earth in possession of your password. (besides the service provider, but we have already established the fact they are not you) > The true difference is that my ID can be known by anyone and my > password is only known to me. it makes you the only person who can initiate auth.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ