Difference between revisions of "Talk:Viewer Authentication Critique"

From Second Life Wiki
Jump to navigation Jump to search
(Removing all content from page)
Line 1: Line 1:
== Security ==


=== Pros ===
* Viewer does not have to process (and "see") username and password
=== Cons ===
* Viewer still involves running trusted code on the computer and could initiate other attacks e.g.
** Silently buy L$ and pass onto another account
** Pass token onto bot, and drop the users connection
* Potential for phishing websites to entice users to enter username and password and then pass control to SL website and viewer.
* Possibility some third party clients will retain the existing UI in order to make it easier for people with alts and multiple clients, and do appropriate GETs and POSTs on the SL to initiate a logon and get the token (thus defeating the original purpose)
* Too reliant on browser/OS implementations
* Relies on browser security, and uses a mechanism often disabled due to security concerns
=== Alternatives ===
* One time passwords
== Flexibility ==
=== Pros ===
* Enables username/password authentication to work on third party sites without them having to "see" username and password
=== Cons ===
=== Alternatives ===
* Use this mechanism for websites (including third party) only but not for viewers
* OpenID
* CardSpace
* Identity Metasystem
== Persistence ==
=== Pros ===
=== Cons ===
* Inconvenient for those with alts
** Cumbersome to change alts and logon with multiple alts
** Those with alts, often have a primary account which is used for forums and logged on permanently to forums even when the alt is online in SL
* Inconvenient for those with multiple clients
* Danger on public or multi-user machines that the user will log out of the client, but not log out of the website properly allowing the next user to access their account.
=== Alternatives ===
* Is this really needed?
----
--[[User:Matthew Dowd|Matthew Dowd]] 11:27, 29 September 2007 (PDT)

Revision as of 10:37, 29 September 2007

Retrieved from "https://wiki.secondlife.com/w/index.php?title=Talk:Viewer_Authentication_Critique&oldid=33688"