Re: Authentication

[Sam Ruby <rubys@xxxxxxxxxxxxxxxx>]

Simon Fell wrote:
> Joe Gregorio wrote:
>
>  > How should authentication and security be handled? Are Basic and 
> Digest good enough?
>
> An alternative question would be, if we cook up a custom solution, would 
> it be any easier to code, deploy, use or be any more secure ?
>
> I see no reason to specify anything more than use HTTP's existing 
> options for authentication, confidentiality and tamper proofing as 
> required. With perhaps something that points out guidelines and/or best 
> practices.

This is not an either/or.

There are existing solutions that allow application level 
authentication.  For example:

http://www-106.ibm.com/developerworks/library/ws-trust/#Challenges
http://www-106.ibm.com/developerworks/library/ws-trust/#PasswordBasedKeyExchange

And not to name drop, but look at the author list on this specification.

The issue with transfer level authentication is that it is difficult to 
mandate given the number of weblogs which are deployed to simple CGI 
based servers.  This would create support issues for products like 
MovableType.

> Cheers
> Simon
> www.pocketsoap.com

- Sam Ruby