Conversation

Notices

1. Embed this notice
   Evan Prodromou (evan@cosocial.ca)'s status on Saturday, 16-Mar-2024 04:23:23 JST Evan Prodromou

   • blaine

   @blaine one of my favourite sayings of yours about web authentication goes something like, "If your architecture goes as far as public key infrastructure, you need to turn around and go back to find another way." Have you written that down anywhere? I need to have a reference to quote it in the ActivityPub book.

   • Embed this notice
     blaine (blaine@mastodon.social)'s status on Saturday, 16-Mar-2024 09:37:46 JST blaine

     in reply to

     • Dr. Brandon Wiley

     @brandon @evan my main observation here is that end-users should never have to think about or manage their keys, because (1) they don't care and (2) ultimately they will lose their keys.

     For those reasons alone, key management is a hard problem, and will always remain a hard problem.

     If an architectural solution depends on keys, service providers need to be prepared to reissue those keys on behalf of their users, and the architecture should be capable of handling disjointed key rotation.

   • Embed this notice
     Dr. Brandon Wiley (brandon@mastodon.blanu.net)'s status on Saturday, 16-Mar-2024 09:37:46 JST Dr. Brandon Wiley

     in reply to

     • blaine

     @blaine @evan I agree with you that users shouldn't manage their keys directly. I have developed several production PKI systems and take pride in the fact that the documentation never mentions the word "key" at all.

   • Embed this notice
     Dr. Brandon Wiley (brandon@mastodon.blanu.net)'s status on Saturday, 16-Mar-2024 09:37:54 JST Dr. Brandon Wiley

     in reply to

     • blaine

     @evan @blaine But then who does the public key infrastructure?