Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So then you're just back to the even more basic problem of "is the person using this device the same person that the payload was signed on behalf of?"


Yep. But in my mind that's being mitigated by the real measure for identity proof, which is some type of electronic ids.


Which a) has a whole host of other concerns associated with it, and b) still does not solve that problem, because it's not at all hard for a child (especially a teenager!) to sneak their parent's ID, use it to authenticate for a service, then put it back.

After all, are most services going to require the ID to be present for every session? Or are they going to require a one-time authentication for the account?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: