[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 17 Dec 2017 18:35:55 +0100
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Re: Authentication vs identification
On 12/17/2017 04:06 PM, Denny O'Breham wrote:
> But I need a reason to ID you. The reason is you giving me an ID. Any ID.
ok. i retract the point about the procedure initiation.
let's say it is as unrelated to our problem as the said reason.
i tried to give too much specificity to the terminology
(who is acting and who is being acted upon)... it was fruitless.
if we roll back a little to:
auth is a mutual activity (all parties are actively involved)
then the principal difference really shines:
i am the only man knowing my password (secret key)
therefore my active participation is REQUIRED for auth.
you can also think about auth as a special case of ID,
it does not alter the said difference.
The whole argument has arisen from the practice of confusing auth with
ID to the point of WORLDWIDE usage of non-secret identifiers as auth
tokens in all sorts of LIFE-CRITICAL applications.
> Let's reverse the process. I have a database with usernames and
> secret passwords. If someone give me his password, I can scan my
> database and see if this password is in my database. Even if I found
> it, I still haven't ID that person. The authentication process is not
> complete either. The proof lies in the fact that it is possible for
> me to find more than one user with the same password. At this point
> there is no way for me to ID you. I have to ask you for your
> username. Once you GIVE it to me, I can now compare this ID with the
> ones from all users that have the password that you gave me earlier.
> If it corresponds to one of the users, you have been both identified
> and authenticated.
yes, successful auth implies successful ID.
> An ID should be unique and public. A password should be only private.
>
> The Identification process is successful when the GIVEN ID matches one
> in the database (because it is unique).
> The authentication process is successful when both the GIVEN ID and
> the GIVEN password match the ones in the database for a single user.
there is more to the point.
some idiots love "password only" auth,
which makes the entire system vulnerable to password guessing,
as the system will match my guessed password against ALL known
passwords, thus doing the bulk of the attack in my stead.
> On 12/17/17, e@...tmx.net <e@...tmx.net> wrote:
>> On 12/17/2017 02:01 PM, Denny O'Breham wrote:
>>> «still, when i provide ma passport to a party that wants to ID me, i
>>> do not ID myself, they do it to me.»
>>>
>>> I could say the same thing about authentication:
>>
>> no you can't.
>> this party has no means of doing the auth.
>> in the asymmetric situation they do not have your key.
>> in the symmetric situation they know they are not you (if they initiate
>> auth it will be an attempt to fool themselves through and through -- not
>> real auth (of course you can include this scenario into the term "auth",
>> it will make the definition of "auth" useless, but i can not forbid you
>> creating useless definitions))
>>
>>
>>
>>> The proof about that is that even if I correctly give the right
>>> password, one could still refuse to authenticate me.
>>
>> no. they can refuse to give you access to their resources or whatever
>> goal of the auth it was.
>> giving you access is not auth.
>>
>>
>>> «the original claim was about the auth requiring smthng.»
>>>
>>> But to ID someone, I'm required to give something too: my name for
>>> example.
>>
>> no.
>> they can obtain your identifiers without your participation.
>> this is the characteristic feature of identifiers -- they are not
>> secret: your name, for example, is not a secret.
>> thus your participation IS NOT REQUIRED.
>>
>> you you seriously misunderstood the word "required".
>>
>>
>>> What is the difference in my level of "participation" in giving my ID
>>> or my password?
>>
>> you are supposed to be the only man on Earth in possession of your
>> password. (besides the service provider, but we have already established
>> the fact they are not you)
>>
>>> The true difference is that my ID can be known by anyone and my
>>> password is only known to me.
>>
>> it makes you the only person who can initiate auth.
>>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
