New answers tagged

1

By 'Client Certificate' do you mean in SSL/TLS and (thus) HTTPS? If so, 8446 (for TLS1.3) references 5280 for cert validation, although earlier versions were not explicit, and libraries generally implement this (or at least its predecessors; in OpenSSL for example the cert validation code didn't change much from about 2000 to about 2015). Typically a server ...


1

DIDs needn't necessarily have a backing verifiable data registry (e.g., blockchain, decentralized ledger). So that isn't a requirement -- and the use case you highlight may be a good case where one is not necessary. However, also consider that even in some one-to-one relationships, the relying/verifying party may trust a verifiable data registry's view of ...


2

One answer (which was cross-posted to the W3C DID WG Issues page where this question was also cross-posted): There is always some correlation risk when an individual entity uses the same identifier for themselves, for interactions with multiple other entities, or even for multiple interactions with one other entity. Multiple strategies are used to minimize ...


1

You made me watch a 80 minute video... And there's a blockchain. Not one, but more than one. There's 5 categories of DID: Ledger based DID: the original DID Ledger middleware (Layer-2) DID: uses a storage layer over the DID blockchain. It should work like the Layer-2 protocols on Ethereum blockchain. Peer DIDs: it's like a permissioned blockchain. A ...


0

As designed, this makes your system significantly less secure. That's because you've turned a token which authenticates an entire session and embedded it into a URL, where it is much more likely to be exposed, such as in browser history or in logs. If that token is exposed, so is access to the entire user session. What would be more secure is if you you ...


1

First, as Steffen's comment points out, you don't send credentials (certainly not complete ones, suitable for authentication) in JWTs. I mean, you could, but that both completely misses the point of a JWT and is totally useless. In my years of reviewing many, many web apps and services I have never seen this pattern. I'm really curious where you got the ...


0

There are a couple different approaches one can take to authentication. In your question, you mention Basic authentication. If this is a username and a user-chosen password, then the downside to this is that users pick bad passwords, and ultimately in many cases, those are easy to guess and frequently reused. Thus, any solution which avoids user-generated ...


Top 50 recent answers are included