This post is by Axel Nennker
Click here to view on the original site: Original Post
Current login mechanisms suffer from missing support by browsers and sites.
Browsers offer in-browser password storage but that's about that.
Standardized authentication methods like HTTP Digest Authentication and HTTP Basic Authentication
were never really accepted by commercially successful sites. They work but the user experience is bad especially if the user does not have an account yet.
So most sites are left with form-based authentication were the site has full control over the UI and UX. Sadly the browser has little to offer here to help the site or the user other then trying to identify signup and login forms through crude guesses based on password field existence.
There is no standardized way for sites and browsers to work together.
Here is a list of attempts to solve some of the above issues:
Federations have their drawbacks too. Even Facebook login went dark for 4h a while ago which left sites depending on Facebook without user login.
In general there is this chicken-egg problem:
Why should sites support new-mechanism-foo when there is no browser support.
Why should browsers support new-mechanism-foo when there are no sites using it.
Then there are password stores. I use passwordsafe to store my password in one place. If I do not have access to that place (PC) then I can't login. Bummer.
Others use stores hosted on the Internet and those usually support most browsers and OSses through plugin/addons and non standard trickery.
I never could convince myself to trust the providers.
I started to work on a mechanism that has a password store on the mobile which allows you to login on your PC using your PC's camera.
The user story is as follows:
- browse to a site's login page e.g. https://github.com/login
- have my Firefox addon installed
- click on the addon's icon
- present your credential-qrcode to the PC's camera
- be logged in
Here is an example qrcode containing the credentials as a JSON array
The qrcode could be printed on paper or generated by your password store on your mobile. To help the user with the selection of the matching credentials the addon presents a request-qrcode to be read by the mobile first. This way the mobile ID-client can select the matching credentials.
(If you don't like to install addons to test this and for a super quick demo of the qrcode reading using your webcam please to to http://axel.nennker.de/gum.html
and scan a code)
What are the benefits?