Monday, December 9, 2013

Paid Password Reset and 3rd Party Authenticator

 In modern age average person has to keep in memory dozens of passwords. And i noticed that some of rarely used websites i even don't bother to remember password and go straight to password reset. Which brought me to thought that others probably are experiencing same nuisances with passwords on rarely used web sites.

So one way to solve the problem is to install Password Manager on your computer and let it intercept all your password entry and store them securely. But downside of this approach is privacy concern - web  plug-in, installed by software vendor, can easily violate privacy and gather TMI (too much information) about consumer.

So idea came up to outsource password management to 3rd party if you cannot remember your password when accessing website. There 2 options:
  1. one is that 3rd party can reset password for fee, that is shared with website owner. This way website owner can make small cash as reward to introduce 3rd party password reset.
  2. second option is that 3rd party takes responsibility of authentication and then pass authorization token to website to grant access
 Obviously there were plenty of attempts to build outsourced authentication and authorization- oldest, i believe, was Microsoft Passport introduced in 1999. But downside of those attempts is that website may loos control over customer data. Mixed mode, where web site ultimately controls consumer identity, but outsource password reset to 3rd party with option to upgrade to 3rd party authentication and authorization, provides best of both worlds.

If 3rd party password management can add functionality similar to Google Authenticator to add 2nd factor authentication, then value of service is increased even more by offering NFC-authentication. For example, with presence of cell phone with installed Authenticator all i need to access web site is enter unlock sequence for mobile app. As oppose to Google Authenticator that is showing numeric sequence that i need to manually enter on website.

There must be option to combine convenience of entering login and password directly to website; as well as option to simplify password reset or even need for password without privacy concern with password managers.

best regards,
Roman Havrylyak

12/9/2013

No comments:

Post a Comment