0

Are you familiar with a protocol that allows private individuals to identify themselves by their own DNS address and SSL certificate? I know about client side certificates but I'm talking about something that would be simpler to use than carrying around a private key.

For example, in order to authenticate myself and login to a website I will just provide my "ID" site: https://my-first-name.last-name.my-private-domain.com where a server would be available with a valid SSL certificate for my specific subdomain. The DNS address can also include a whois record and phone/email address etc. Or any data in the TXT record for that matter.

The site could then identify me in several ways, it can email me, text me or simply encrypt my data with my own public key.

Did someone do this anywhere? Research it?

  • Sounds a bit complex and I am not so sure this offers any form of identity, but creative nonetheless. Maybe if you changed the subdomain to a random UUID or hashed key it would work better? – Yorick de Wid Sep 5 '16 at 11:04
  • 2
    This would have been a solution for the internet of 10 years ago. But nowadays few private people have own domains but most people have accounts on social media websites. That's why OAuth exists to solve this problem (aka the "Login with Facebook|Twitter|Google|Whatever" buttons). – Philipp Sep 5 '16 at 11:05
  • @Philipp This could also be an internal system, OAUTH works well over the internet and is more useful to access resources, not to identify an object. – Yorick de Wid Sep 5 '16 at 11:11
  • Personal X.509 certificates already exist and are wildly used to sign/encrypt emails. They can be used in TLS if the server is setup to accept them. They were never popular even for internal apps due to the complexity of issuing certificates, so I don't see the point of inventing a more complicated wheel. – billc.cn Sep 5 '16 at 15:19
0

You need more than just a URL or whois record which publishes information about you. What's to stop me asserting that I am Amir Mehler simply by providing the URL or DNS name to a site requiring authentication?

That means there has to be some negotiation between the the user, device, the authenticating site and the URL offered as a proof of identity. That's what openid does

The site could then identify me in several ways, it can email me, text me or simply encrypt my data with my own public key.

Those are different services than authentication. And available elsewhere.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.