[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 17 Dec 2017 10:06:39 -0500
From: "Denny O'Breham" <obreham@...il.com>
To: passwords@...ts.openwall.com
Subject: Re: Authentication vs identification
But I need a reason to ID you. The reason is you giving me an ID. Any ID.
Let's reverse the process. I have a database with usernames and
secret passwords. If someone give me his password, I can scan my
database and see if this password is in my database. Even if I found
it, I still haven't ID that person. The authentication process is not
complete either. The proof lies in the fact that it is possible for
me to find more than one user with the same password. At this point
there is no way for me to ID you. I have to ask you for your
username. Once you GIVE it to me, I can now compare this ID with the
ones from all users that have the password that you gave me earlier.
If it corresponds to one of the users, you have been both identified
and authenticated.
I cannot arbitrarily identify you.
An ID should be unique and public. A password should be only private.
The Identification process is successful when the GIVEN ID matches one
in the database (because it is unique).
The authentication process is successful when both the GIVEN ID and
the GIVEN password match the ones in the database for a single user.
In any case, the only person that can initiate the identification or
the authentication process is the user.
The fact that I can list all the usernames in my database doesn't mean
I can correctly identify someone without his participation. Someone
has to initiate the identification process.
The database owner (or anyone else) could identify someone ARBITRARILY
in the database without participation of the user (ex.: delete data
where username = «John»). But, in theory, anyone could also
authenticate someone without his participation too, even if it is just
pure luck (ex.: delete data where username = «John» and password =
«123456»). But I have a problem considering that as identifying or
authenticating someone. All it means is that it is easier to guess an
ID than to guess an ID and a password.
On 12/17/17, e@...tmx.net <e@...tmx.net> wrote:
> On 12/17/2017 02:01 PM, Denny O'Breham wrote:
>> «still, when i provide ma passport to a party that wants to ID me, i
>> do not ID myself, they do it to me.»
>>
>> I could say the same thing about authentication:
>
> no you can't.
> this party has no means of doing the auth.
> in the asymmetric situation they do not have your key.
> in the symmetric situation they know they are not you (if they initiate
> auth it will be an attempt to fool themselves through and through -- not
> real auth (of course you can include this scenario into the term "auth",
> it will make the definition of "auth" useless, but i can not forbid you
> creating useless definitions))
>
>
>
>> The proof about that is that even if I correctly give the right
>> password, one could still refuse to authenticate me.
>
> no. they can refuse to give you access to their resources or whatever
> goal of the auth it was.
> giving you access is not auth.
>
>
>> «the original claim was about the auth requiring smthng.»
>>
>> But to ID someone, I'm required to give something too: my name for
>> example.
>
> no.
> they can obtain your identifiers without your participation.
> this is the characteristic feature of identifiers -- they are not
> secret: your name, for example, is not a secret.
> thus your participation IS NOT REQUIRED.
>
> you you seriously misunderstood the word "required".
>
>
>> What is the difference in my level of "participation" in giving my ID
>> or my password?
>
> you are supposed to be the only man on Earth in possession of your
> password. (besides the service provider, but we have already established
> the fact they are not you)
>
>> The true difference is that my ID can be known by anyone and my
>> password is only known to me.
>
> it makes you the only person who can initiate auth.
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
