{"action":"created","issue":{"url":"https://api.github.com/repos/solid/solid/issues/22","repository_url":"https://api.github.com/repos/solid/solid","labels_url":"https://api.github.com/repos/solid/solid/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/solid/solid/issues/22/comments","events_url":"https://api.github.com/repos/solid/solid/issues/22/events","html_url":"https://github.com/solid/solid/issues/22","id":127230303,"number":22,"title":"Develop additional authentication mechanisms to run alongside WebID+TLS","user":{"login":"dmitrizagidulin","id":947005,"avatar_url":"https://avatars.githubusercontent.com/u/947005?v=3","gravatar_id":"","url":"https://api.github.com/users/dmitrizagidulin","html_url":"https://github.com/dmitrizagidulin","followers_url":"https://api.github.com/users/dmitrizagidulin/followers","following_url":"https://api.github.com/users/dmitrizagidulin/following{/other_user}","gists_url":"https://api.github.com/users/dmitrizagidulin/gists{/gist_id}","starred_url":"https://api.github.com/users/dmitrizagidulin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmitrizagidulin/subscriptions","organizations_url":"https://api.github.com/users/dmitrizagidulin/orgs","repos_url":"https://api.github.com/users/dmitrizagidulin/repos","events_url":"https://api.github.com/users/dmitrizagidulin/events{/privacy}","received_events_url":"https://api.github.com/users/dmitrizagidulin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":36,"created_at":"2016-01-18T13:52:40Z","updated_at":"2016-02-05T15:08:45Z","closed_at":null,"body":"Develop an alternative mechanism to the current in-browser-only certificate-based WebID authentication workflow.\r\n\r\nNote: This is part of a two-pronged approach - 1) continue to improve the browser's certificate management UI and overall user experience (possibly get in touch with the browser vendors), and 2) (this issue here) develop a short-term alternative to WebID-TLS. \r\n\r\n### Friction points with current approach\r\n\r\n* Firefox bug requiring browser restart when first signing up for a WebID\r\n* User unfamiliarity with certificate management\r\n* Lacking or limited support in several browsers (Internet Explorer, mobile browsers, etc)\r\n* Lack of Log Out capability\r\n* No good story for use on public/shared computers\r\n* Limited or confusing UI for many use cases: \r\n  - no good way of determining which app/browser tab is requesting a certificate (the UI only shows what datastore is being accessed)\r\n  - difficulty in managing multiple identities, once a user has a handful of certificates\r\n  - initial confusion when first using a Solid app, before a user has a WebID\r\n* Current browser-centric focus makes it difficult for non-Javascript programming languages to interact with Solid\r\n\r\n### Possible Approaches (Proposals so far)\r\n\r\n1. Username & Password authentication to a user's pod, and [WebID Delegated Requests](https://github.com/solid/solid/pull/65) to other pods\r\n  - see [\"Extending the WebID Protocol with Access Delegation\"](http://bblfish.net/tmp/2012/08/05/WebID_Delegation.pdf) paper\r\n2. [WebID RSA proposal](https://github.com/solid/solid/blob/master/proposals/auth-webid-rsa.md)\r\n  - http://caniuse.com/#feat=cryptography\r\n3. [Use HTTP-Signature instead of WebID-RSA](https://github.com/solid/solid-spec/issues/52)\r\n  - [IETF Draft 5 - Signing HTTP Messages](https://tools.ietf.org/html/draft-cavage-http-signatures-05)\r\n  - [node-http-signature](https://github.com/joyent/node-http-signature) - Joyent's Node.js implementation of HTTP Signatures (see also their [http_signing.md](https://github.com/joyent/node-http-signature/blob/master/http_signing.md) doc)\r\n  - [solid/spec/issue #5](https://github.com/solid/solid-spec/issues/5) for more HTTP Signature discussions\r\n4. Sandro's [Spot](https://github.com/sandhawke/spot/blob/master/spec.md) spec. (See also JSON Web Tokens & W3C Capability URL Recs)\r\n4. [indieauth](https://indieauth.com/) / [distributed-indieauth](https://indiewebcamp.com/distributed-indieauth)\r\n  - https://indiewebcamp.com/IndieAuthProtocol\r\n  - see also: [indiecert/auth](https://github.com/indiecert/auth) and [Introducing IndieCert blog post](https://www.tuxed.net/fkooman/blog/indiecert.html)\r\n  - https://indiewebcamp.com/authorization-endpoint\r\n5. [WebDHT](http://opencreds.org/specs/source/webdht/)\r\n6. [YouID](http://youid.openlinksw.com/) \r\n7. [JSON Web Tokens](https://jwt.io/introduction/)\r\n\r\n#### Related / Helpful Reading\r\n\r\n**[The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes](http://research-srv.microsoft.com/pubs/161585/QuestToReplacePasswords.pdf)** - a remarkable paper evaluating 20 years' worth of authentication schemes, and rating them on various criteria (security, usability, ease of deployment, etc).\r\n\r\n**W3C [Credential Management Level 1](http://w3c.github.io/webappsec-credential-management/)** recommendations\r\n\r\nWikipedia entries: https://en.wikipedia.org/wiki/Single_sign-on and https://en.wikipedia.org/wiki/List_of_single_sign-on_implementations\r\n\r\n**W3C [FIDO 2.0 Platform Specifications](https://www.w3.org/Submission/2015/02/)** (see [W3C Welcomes the FIDO 2.0 Member Submission](https://www.w3.org/blog/2015/11/w3c-fido/) post)\r\n- [FIDO 2.0: Web API for accessing FIDO 2.0 credentials](https://www.w3.org/Submission/2015/SUBM-fido-web-api-20151120/)\r\n- [FIDO 2.0: Key Attestation Format](https://www.w3.org/Submission/2015/SUBM-fido-key-attestation-20151120/)\r\n- [FIDO 2.0: Signature format](https://www.w3.org/Submission/2015/SUBM-fido-signature-format-20151120/)\r\n\r\n**W3C [Good Practices for Capability URLs](http://w3ctag.github.io/capability-urls/)**"},"comment":{"url":"https://api.github.com/repos/solid/solid/issues/comments/180393964","html_url":"https://github.com/solid/solid/issues/22#issuecomment-180393964","issue_url":"https://api.github.com/repos/solid/solid/issues/22","id":180393964,"user":{"login":"deiu","id":346820,"avatar_url":"https://avatars.githubusercontent.com/u/346820?v=3","gravatar_id":"","url":"https://api.github.com/users/deiu","html_url":"https://github.com/deiu","followers_url":"https://api.github.com/users/deiu/followers","following_url":"https://api.github.com/users/deiu/following{/other_user}","gists_url":"https://api.github.com/users/deiu/gists{/gist_id}","starred_url":"https://api.github.com/users/deiu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deiu/subscriptions","organizations_url":"https://api.github.com/users/deiu/orgs","repos_url":"https://api.github.com/users/deiu/repos","events_url":"https://api.github.com/users/deiu/events{/privacy}","received_events_url":"https://api.github.com/users/deiu/received_events","type":"User","site_admin":false},"created_at":"2016-02-05T15:08:45Z","updated_at":"2016-02-05T15:08:45Z","body":"Sure, but this was not a question about Solid. It was about WebID-TLS."}}