On Thu, Nov 02, 2006 at 10:48:29PM +0100, Magnus Hagander wrote: > The same could apply to SSL cert based authentication, for users > connecting from machines outside of my realm. Once you have "unlocked" > the certificate, you can authenticate any number of times to any number > of services that will accept this certificate *without* having to > re-enter your password.
Why would you need to unlock it? SSL certificate is effectively a password stored in a file of length 1024 bits or whatever. > This is both a convenience for the user, and a requirement if you use > OTPs. I don't understand the OTP part. Single signon is only a convenience. Ability to resume a session (provided by SSL) or ability to login using a smaller authentication token than a certificate can be used to provide performance improvement. If the requirement is that no password is provided, password + SSL certificate is not an improvement. Any token based authentication system should allow for the token to become invalid at any time, and require re-authentication using the primary mechanism. The benefit to kerberos, from my perspective, is that it already exists, and is widely used. I prefer SSL certificates alone myself. All of my db passwords are randomly generated anyways, and a 1024-bit randomly generated password is better than a 64-bit password picked by a person at a keyboard. Having both isn't an improvement I think. My own system at home uses RSA keys or SSH entry. I don't bother with passwords anymore. If they can access my password, they can access my certificate. If they can access my certificate, they can access my password. Dual authentication models work better with very different systems. For example, a USB key or digital display that I possess, and a password that I know or have stored in a file. Cheers, mark -- [EMAIL PROTECTED] / [EMAIL PROTECTED] / [EMAIL PROTECTED] __________________________ . . _ ._ . . .__ . . ._. .__ . . . .__ | Neighbourhood Coder |\/| |_| |_| |/ |_ |\/| | |_ | |/ |_ | | | | | | \ | \ |__ . | | .|. |__ |__ | \ |__ | Ottawa, Ontario, Canada One ring to rule them all, one ring to find them, one ring to bring them all and in the darkness bind them... http://mark.mielke.cc/ ---------------------------(end of broadcast)--------------------------- TIP 9: In versions below 8.0, the planner will ignore your desire to choose an index scan if your joining column's datatypes do not match