[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <d607ad25-1381-aa74-c0af-0fb14463abcb@bestmx.net>
Date: Sun, 17 Dec 2017 14:14:06 +0100
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Re: Authentication vs identification
On 12/17/2017 02:01 PM, Denny O'Breham wrote:
> «still, when i provide ma passport to a party that wants to ID me, i
> do not ID myself, they do it to me.»
>
> I could say the same thing about authentication:
no you can't.
this party has no means of doing the auth.
in the asymmetric situation they do not have your key.
in the symmetric situation they know they are not you (if they initiate
auth it will be an attempt to fool themselves through and through -- not
real auth (of course you can include this scenario into the term "auth",
it will make the definition of "auth" useless, but i can not forbid you
creating useless definitions))
> The proof about that is that even if I correctly give the right
> password, one could still refuse to authenticate me.
no. they can refuse to give you access to their resources or whatever
goal of the auth it was.
giving you access is not auth.
> «the original claim was about the auth requiring smthng.»
>
> But to ID someone, I'm required to give something too: my name for
> example.
no.
they can obtain your identifiers without your participation.
this is the characteristic feature of identifiers -- they are not
secret: your name, for example, is not a secret.
thus your participation IS NOT REQUIRED.
you you seriously misunderstood the word "required".
> What is the difference in my level of "participation" in giving my ID
> or my password?
you are supposed to be the only man on Earth in possession of your
password. (besides the service provider, but we have already established
the fact they are not you)
> The true difference is that my ID can be known by anyone and my
> password is only known to me.
it makes you the only person who can initiate auth.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
