Subject: [http-auth] A more complete HOBA draft

From: Paul Hoffman <[email-masked]>
Date: Fri, 5 Oct 2012 15:09:09 -0700

Greetings again. Stephen and Michael and I wanted to get this to the list early so that discussion might be incorporated into a -03 before the cutoff.

Note that this is still a very rough proposal. As we say in the draft, we want to have just one set of mechanisms that can be used both for the HTTP authentication and the JavaScript authentication; we'll see how close we can get to each other.

The high-order bits are: get rid of passwords, and make this a drop-in replacement for current password use on web sites.

--Paul Hoffman

Begin forwarded message:

> From: [email-masked]
> Subject: I-D Action: draft-farrell-httpbis-hoba-02.txt
> Date: October 5, 2012 2:38:34 PM PDT
> To: [email-masked]
> Reply-To: [email-masked]
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
> 	Title           : HTTP Origin-Bound Authentication (HOBA)
> 	Author(s)       : Stephen Farrell
>                          Paul Hoffman
>                          Michael Thomas
> 	Filename        : draft-farrell-httpbis-hoba-02.txt
> 	Pages           : 20
> 	Date            : 2012-10-05
> 
> Abstract:
>   HTTP Origin-Bound Authentication (HOBA) is a design for an HTTP
>   authentication method with credentials that are not vulnerable to
>   phishing attacks, and that does not require a server-side password
>   database.  The design can also be used in Javascript-based
>   authentication embedded in HTML.  HOBA is an alternative to HTTP
>   authentication schemes that require passwords with all the negative
>   attributes that come with password-based systems.  HOBA can be
>   integrated with account management and other applications running
>   over HTTP and supports portability, so a user can associate more than
>   one device or origin-bound key with the same service.  We also
>   describe a way in which the HOBA design can be used from a Javascript
>   web client.  When deployed, HOBA will be a drop-in replacement for
>   password-based HTTP authentication or JavaScript authentication.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-farrell-httpbis-hoba
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-farrell-httpbis-hoba-02