the technical problem is "create secure tokens and distribute them in authenticated messages to N clients that have not established trust" whereas the business problem is "we want a user login system".
The core problem is really that passwords suck and should never be the entirety of authentication. Time for hardware tokens! (admittedly there are some big problems when people lose tokens, but at least that's not a problem of insecurity ;-))
There is a depressing lack of open standards with these off-the-shelf physical tokens. It's unfortunate that a company's security can rely on the APIs of another company which could go bankrupt and disappear at any time.
Or (3) implement an universal TLS standard to abstract logins away into hardware tokens... but that's exactly what we have but don't use super-widespread. Estonia has demonstrated the solution scales easily into millions, Latvia is working on it, Finland as well and a few other countries, but they're 15 years behind from Estonia, rest of the world is at least two decades behind. I've always wanted to make wild predictions, now I can try, I think such personal hardware tokens will become wildly mainstream in 25 years, totally replacing passwords.
I hold some tokens from a project I worked on for 2 years (I hold everything on-chain) and also from my own project which I built (and designed the signature algorithm from scratch) so it's hard to get more security than that.
People lose their tokens and need a way to recover their account access. People don't want to have to go into a physical branch to verify ID and reset it. The security of everyone suffers to increase the convenience for a few.
I think the panacea is dedicated hardware that can produce secure tokens (a signed message) without having to expose my key to the machine I plug into. But existing systems still require that level of trust; I'm doing no worse than someone with a password typing it into a possibly insecure machine.
The standard person today isn't capable of managing multiple secure tokens, and actually keeping them separate.
One smashed phone, and truly secure accounts would be lost forever, or require significant resources on the part of the provider to re-verify people's identities.
reply