Re: [Opensc-devel] Google introduces Web-based smart card

[Alon Bar-L. <alo...@gm...>]

Yes, at first read I thought there is nothing new, we can do this with
existing smartcards...

But then read:
"""
Initial Signup: Site sends Javascript call to browser asking for
public key for user. Browser finds activated U2F, asks it for public
key to remember for user. U2F returns signed public key (signature is
by U2F vendor). Site (optionally) verifies public key signature to
ensure its an accepted vendor and saves public key + attached blob
(encrypted private key).
"""

So it is a meter of trust, same as PKI... only that you are forced to
trust the manufacturer... which is totally wrong.

Initially I thought that each registration will create its own key
pair... which could have been nice if  the device has enough memory.
Even single key pair is OK if you would like to share it between
services.

Regards,
Alon

On Fri, Jun 14, 2013 at 11:41 AM, helpcrypto helpcrypto
<hel...@gm...> wrote:
>
> I love the big brother.
>
>
> On Tue, Jun 11, 2013 at 6:59 PM, Anders Rundgren <and...@te...> wrote:
>>
>> https://sites.google.com/site/oauthgoog/gnubby
>>
>> I think it is actually good that I finally have a competitor!
>>
>> Smart Card middleware will be a thing of the past.  Hooray!
>>
>> Anders
>>
>> ------------------------------------------------------------------------------
>> This SF.net email is sponsored by Windows:
>>
>> Build for Windows Store.
>>
>> http://p.sf.net/sfu/windows-dev2dev
>> _______________________________________________
>> Opensc-devel mailing list
>> Ope...@li...
>> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Windows:
>
> Build for Windows Store.
>
> http://p.sf.net/sfu/windows-dev2dev
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>