Authentication Roundup
As a follow-up, I wanted to summarize the key points between the authentication schemes described in my last post. Comparisons are difficult because each scheme is so unique, and small details have major implications. But we can identify some of the more recognizable differences in this brief comparison matrix:
table { border: 1px solid black; } table tr td { border: 1px solid black; text-align: center; vertical-align: middle; } table tr td.heading { width: 15%; } table tr td.label { text-align: left; }
LastPass YubiKey Mozilla Persona OneID CryoKey Technology Password Hardware Certificate Certificate Certificate (Optional Hardware) Identity Any Any E-Mail E-Mail? E-Mail Authority Local Local/Central Central Central Central Feasible as Second Factor No Yes Yes Yes Yes External (Non-Browser) Functionality No Capable No No Capable Personal Data Form Fill None None Form Fill None Setup and Management Local Token Identity Provider Account OneID Account Existing E-Mail Account Internet Access Optional Important Required Required Optional Cost Structure Optional Subscription Per-Token Free Free (Optional Paid Services) Free (Optional Paid Services) Client Integration Dedicated Software Hardware Driver Browser Capability Browser Capability OS and Browser Capabilities Service Integration Pre-Existing Web API Web API Web API SSL Client Certificate (Web API Available)
Notes:
CryoKey works with the operating system certificate repository and the SSL protocol. Operating system certificate repositories such as MS Cert Store or Apple Keychain are very secure, and available to other local applications. SSL authentication flows are also very secure, having been thoroughly vetted over the years. Servers use SSL authentication extensively (seen by the padlock icon in the address bar for HTTPS sites). On the other hand, client certificates, to date, have been used only in government, military, and academia because of their relative complexity.
In contrast, LastPass, YubiKey, Persona, and OneID all work on a higher level. They manage their own credentials and verify security after the lower level protocols complete the connection. Therefore, CryoKey can actually augment these schemes, because CryoKey can authenticate the very communication protocols that the other schemes build upon.
Some people may say, "why is Persona listed as a centralized authority when it's actually distributed/federated?" We consider it centralized because you can't really distribute authentication. For example, you can't use Google servers to verify your Yahoo identity. Like OpenID, Persona acts more as a conduit for users to access the centralized authority of their choice. To the end user, the act of logging in using Persona certainly feels centralized.
LastPass and YubiKey (and also CryoKey) have the ability to work offline. Local authentication is useful in environments with limited network connectivity (due to security or other constraints). For ideal authentication, YubiKey needs access to the YubiCo servers. But YubiKey can work independently as a strong random password generator as well as other yet-to-be-developed functionality. LastPass only needs network access to update or retrieve from the centralized repository (to synchronize the passwords for multiple devices). Theoretically, it should work on local web applications even without a network.
Again, keep in mind that all authentication schemes are relevant. Multiple schemes are best because using multiple schemes allows one method to make up for any limitations of another. But if you have to pick only one, you should base it on your own values (or the preferences of your typical users).
What do you consider important from an authentication service? Do you value privacy and basic information, or do you prefer to establish more thorough credentials? Do you prefer a solution that still makes passwords available? What do you think about carrying around hardware tokens?