#authentication

Passwords are broken. Inspired by Justin Balthrop's article Passwords are Obsolete token-based one-time password (OTPW) authentication is faster to deploy, better for your users, and more secure.

Passwords are broken. Inspired by Justin Balthrop's article Passwords are Obsolete token-based one-time password (OTPW) authentication is faster to deploy, better for your users, and more secure.

User Management and Authentication for Developers

User Management and Authentication for Developers

A simple Google Authenticator app written in HTML

So I started wondering - what if we just created a real user for every person who visited the site? Django already has support for creating users with unusable passwords - so if we just create a user with an unusable password every time a new person comes along, log them in, and then at some future point (presumably once they've fallen in love with your site) they can set themselves up with a real username and password. And as a bonus, all that data that they created while messing about with the site sticks around, and carries over into their 'real' user.

The Google Authenticator project includes implementations of one-time passcode generators for several mobile platforms, as well as a pluggable authentication module (PAM). One-time passcodes are generated using open standards developed by the Initiative for Open Authentication (OATH) (which is unrelated to OAuth).

"A clean, simple, and unobtrusive ruby authentication solution."

"Google and Yahoo! (and likely Microsoft to follow) are ultimately competing with one another to become the branded single sign-on solution for the web. The good news for users is that by using the same underlying technology, most relying parties will able to turn on support for any new OpenID provider fairly easily. The bad news for users is that since none of the major providers are also relying parties, using services at each of these site still requires multiple accounts. Further, a sign in box with 100 different logos for 100 different providers isn’t a great user experience."

"What if you could say, "by default, trust whatever my buddy Pete trusts"? Or, "trust the consensus of my set of friends; only ask me if there's disagreement"? Or more prosaically, "trust what my local IT department says"."

"This document defines an XMPP protocol extension that enables verification of an HTTP request via XMPP."

"To maintain a high level of security, the Authentication Proxy interface, AuthSub, enables the application to get an authentication token without ever handling the user's account login information."

"Wouldn’t it be great if you could use the same account to log in to multiple sites and applications, without having to trust them all with your password?"

"This document specifies an HTTP authentication scheme based on cryptographic hashes."

"A few months ago a fellow named Jean-Michel Hiver posted that you could in fact do a clean and modern log-in browser interface using only AJAX methods."