CommerceNet fellow Lisa Dusseault will be presenting on emerging authentication solutions in Austin, Oct 13, at ApacheCon.
Passwords are notoriously insecure and yet we use them hundreds of times daily. What can we replace them with? We’ve seen certificates, PKIX, various “Single Sign-on” schemes, and Shibboleth, but delegated user authentication hasn’t spread to Internet-scale, and there are still a few unmet requirements, particularly for HTTP-based applications. Some current standards work includes SAML profiles (Liberty Alliance), TLS Attribute Certificate extensions, and tying Kerberos into more protocols. This talk will cover use cases, various possible requirements, security threats, possible solutions, and the current status of various standardization efforts.