Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-24 Thread Bruce A. Mah
If memory serves me right, Randy Bush wrote: > is there a freebsd pam tacacs+ hack? Yep. Haven't actually used it though. PAM_TACPLUS(8) FreeBSD System Manager's Manual PAM_TACPLUS(8) NAME pam_tacplus -- TACACS+ authentication PAM module Bruce. signature.asc Description: OpenP

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-22 Thread Christopher Morrow
On Sat, Nov 21, 2009 at 10:45 PM, Scott Howard wrote: > On Sat, Nov 21, 2009 at 6:38 AM, John Levine wrote: > >> > Are passwords still the only lowest-common-denominator? >> >> There's OpenID, where a provider can use any verification process it >> wants, but all the OpenID providers I know use o

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-22 Thread Sean Donelan
On Sat, 21 Nov 2009, Joel Jaeggli wrote: Since this plays nicely with eap-tls, 802.1x. ike, ssl/tls, and s/mime it seems like a shoe-in, once you have a uniform authentication system one is inclined to use it for everything. obviously being involved in several of these with with multiple ca's is

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Joel Jaeggli
cards and tokens are a proxy for the use of a certificate authentication system... You can in fact do certificate auth without the use of cards or tokens or mix and match physical tokens and other private key storage depending on need with the same authentication backend (typically ldap). Since t

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Randy Bush
is there a freebsd pam tacacs+ hack? randy

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Scott Howard
On Sat, Nov 21, 2009 at 6:38 AM, John Levine wrote: > > Are passwords still the only lowest-common-denominator? > > There's OpenID, where a provider can use any verification process it > wants, but all the OpenID providers I know use ordinary passwords. > http://yubico.com/developers/openid/ I'

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Matthew Palmer
On Sat, Nov 21, 2009 at 04:58:27PM -0500, Jeffrey Lyon wrote: > So it works as a standalone password vault also? I don't know. My only experience with it has been as an OpenID endpoint/provider/whatever, and it was on that basis that I replied originally. - Matt

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Jeffrey Lyon
So it works as a standalone password vault also? Jeff On Sat, Nov 21, 2009 at 4:55 PM, Matthew Palmer wrote: > On Sat, Nov 21, 2009 at 04:06:48PM -0500, Jeffrey Lyon wrote: >> I was pretty excited about this post until I found out that myvidoop >> only works on older version of FF. > > I can onl

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Matthew Palmer
On Sat, Nov 21, 2009 at 04:06:48PM -0500, Jeffrey Lyon wrote: > I was pretty excited about this post until I found out that myvidoop > only works on older version of FF. I can only find something about the plugin not working on FF 3.5, but I don't use the plugin since I only use it as an OpenID en

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Jeffrey Lyon
I was pretty excited about this post until I found out that myvidoop only works on older version of FF. Jeff On Sat, Nov 21, 2009 at 12:31 PM, Matthew Palmer wrote: > On Sat, Nov 21, 2009 at 02:38:32PM -, John Levine wrote: >> > Are passwords still the only lowest-common-denominator? >> >> T

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Stefan
[Sightly off-topic - solution specific] Some European countries have long figured out logistics of smartcard distribution and management in their healthcare systems - some being at the second generation, already. In fact this is a subject "dear" to my heart, as I've researched and attempted a prop

RE: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Adam Stasiniewicz
Sadly, passwords are the least common denominator. The biggest problems with 2 factor devices (smart cards, OTPs, etc) is having to buy, configure, and distribute them; plus get them to work with all the myriad of applications. Certificates that are issued to computers/web browsers suffer from

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Matthew Palmer
On Sat, Nov 21, 2009 at 02:38:32PM -, John Levine wrote: > > Are passwords still the only lowest-common-denominator? > > There's OpenID, where a provider can use any verification process it > wants, but all the OpenID providers I know use ordinary passwords. myvidoop.com does OpenID auth base

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread Jack Bates
John Levine wrote: Are passwords still the only lowest-common-denominator? There's OpenID, where a provider can use any verification process it wants, but all the OpenID providers I know use ordinary passwords. Yeah, and every ISP would probably use key authentication, except there's not a

Re: Smartcard and non-password methods (was Re: Password repository)

2009-11-21 Thread John Levine
> Are passwords still the only lowest-common-denominator? There's OpenID, where a provider can use any verification process it wants, but all the OpenID providers I know use ordinary passwords. R's, John