<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Cryptosmith &#187; authentication</title>
	<atom:link href="http://www.cryptosmith.com/archives/tag/authentication/feed" rel="self" type="application/rss+xml" />
	<link>http://www.cryptosmith.com</link>
	<description>Authentication, crypto, information security, and life with gadgets - Rick Smith</description>
	<lastBuildDate>Sun, 08 Aug 2010 19:00:24 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=abc</generator>
		<item>
		<title>Time &#8211; Again &#8211; For Trustworthy Computing</title>
		<link>http://www.cryptosmith.com/archives/734</link>
		<comments>http://www.cryptosmith.com/archives/734#comments</comments>
		<pubDate>Fri, 21 Aug 2009 14:41:22 +0000</pubDate>
		<dc:creator>Dr. Rick Smith</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[assurance]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[tokens]]></category>
		<category><![CDATA[trustworthy computing]]></category>
		<category><![CDATA[worms]]></category>

		<guid isPermaLink="false">http://www.cryptosmith.com/?p=734</guid>
		<description><![CDATA[Saul Hansell of the Washington Post has posted an article about real time attacks on one-time password tokens like SecurID and SafeWord. The strategy is to steal a user&#8217;s one-time password after it is typed in and redirect it to a hacker to exploit immediately. The attack relies on Trojan software that has installed itself [...]]]></description>
		<wfw:commentRss>http://www.cryptosmith.com/archives/734/feed</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Another plea for password sanity</title>
		<link>http://www.cryptosmith.com/archives/729</link>
		<comments>http://www.cryptosmith.com/archives/729#comments</comments>
		<pubDate>Sat, 15 Aug 2009 17:54:28 +0000</pubDate>
		<dc:creator>Dr. Rick Smith</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[password cracking]]></category>
		<category><![CDATA[passwords]]></category>
		<category><![CDATA[policy]]></category>
		<category><![CDATA[strong passwords]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://www.cryptosmith.com/?p=729</guid>
		<description><![CDATA[Here&#8217;s a recent posting on password problems that suggests 10 hard-to-follow rules. The author highlights an important problem: attackers can do systematic trial-and-error guessing attacks against on-line sites. She focuses on a Google Gmail problem recently reported on Full Disclosure. Here&#8217;s the point: use strong protection on high-value targets. Take the time to protect your [...]]]></description>
		<wfw:commentRss>http://www.cryptosmith.com/archives/729/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Revising OpenID for WordPress</title>
		<link>http://www.cryptosmith.com/archives/325</link>
		<comments>http://www.cryptosmith.com/archives/325#comments</comments>
		<pubDate>Sun, 21 Sep 2008 16:35:18 +0000</pubDate>
		<dc:creator>Dr. Rick Smith</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[OpenID]]></category>
		<category><![CDATA[SSL]]></category>

		<guid isPermaLink="false">http://www.cryptosmith.com/?p=325</guid>
		<description><![CDATA[Will Norris is working on a revision to OpenID for WordPress. This is good, and I have some observations and suggestions. At the moment the OpenID plugin works pretty well &#8211; I have separate logins delegated through domains I own. I routinely log in through OpenID for both routine and administrative activities. I&#8217;ll briefly note [...]]]></description>
		<wfw:commentRss>http://www.cryptosmith.com/archives/325/feed</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>&#8220;Design Patterns&#8221; for Identity Systems</title>
		<link>http://www.cryptosmith.com/archives/300</link>
		<comments>http://www.cryptosmith.com/archives/300#comments</comments>
		<pubDate>Thu, 18 Sep 2008 21:05:32 +0000</pubDate>
		<dc:creator>Dr. Rick Smith</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[OpenID]]></category>
		<category><![CDATA[patterns]]></category>
		<category><![CDATA[public-key certificates]]></category>
		<category><![CDATA[RADIUS]]></category>
		<category><![CDATA[TACACS]]></category>

		<guid isPermaLink="false">http://www.cryptosmith.com/?p=300</guid>
		<description><![CDATA[These are design patterns in the Christopher Alexander sense rather than the object oriented design sense: they address the physical and network environment rather than focusing on software abstractions. The patterns were introduced in my book Authentication. There are four patterns: local, direct, indirect, and off-line. Here is a brief description of each authentication pattern: [...]]]></description>
		<wfw:commentRss>http://www.cryptosmith.com/archives/300/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Password Resetting Considered Harmful &#8211; duh!</title>
		<link>http://www.cryptosmith.com/archives/274</link>
		<comments>http://www.cryptosmith.com/archives/274#comments</comments>
		<pubDate>Mon, 01 Sep 2008 19:38:54 +0000</pubDate>
		<dc:creator>Rick (l) Smith</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[password resetting]]></category>
		<category><![CDATA[passwords]]></category>

		<guid isPermaLink="false">http://www.cryptosmith.com/?p=274</guid>
		<description><![CDATA[It used to be that the default password was your mother&#8217;s maiden name, your SSN, your birthdate, or something like that. Now you have to pick a password, and your &#8216;password recovery&#8217; questions are based on those old stand-by questions. So you can still break in to a person&#8217;s accounts by answering those classic questions. [...]]]></description>
		<wfw:commentRss>http://www.cryptosmith.com/archives/274/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>OpenID Delegation on WordPress</title>
		<link>http://www.cryptosmith.com/archives/255</link>
		<comments>http://www.cryptosmith.com/archives/255#comments</comments>
		<pubDate>Sun, 17 Aug 2008 17:49:04 +0000</pubDate>
		<dc:creator>Rick (l) Admin</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[OpenID]]></category>
		<category><![CDATA[PIP]]></category>
		<category><![CDATA[Verisign]]></category>

		<guid isPermaLink="false">http://www.cryptosmith.com/?p=255</guid>
		<description><![CDATA[Thanks to Gary Krall, tech director of PIP at Verisign, I have a recipe for &#8220;works every time&#8221; OpenID delegation with their free PIP service. First, what is OpenID delegation? Delegation lets you use your very own URL as your identity URL for logging in with OpenID. For example, I can use http://www.cryptosmith.com/ to log [...]]]></description>
		<wfw:commentRss>http://www.cryptosmith.com/archives/255/feed</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>OpenID Works!</title>
		<link>http://www.cryptosmith.com/archives/227</link>
		<comments>http://www.cryptosmith.com/archives/227#comments</comments>
		<pubDate>Wed, 13 Aug 2008 02:34:10 +0000</pubDate>
		<dc:creator>Rick (l) Smith</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[OpenID]]></category>

		<guid isPermaLink="false">http://www.cryptosmith.com/?p=227</guid>
		<description><![CDATA[Thanks to the help of Will Norris, one of the authors of the WordPress OpenID plugin, I&#8217;ve managed to get it to work. I will include some notes on using OpenID in a permanent page.]]></description>
		<wfw:commentRss>http://www.cryptosmith.com/archives/227/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Penalizing Unauthenticated SSL Certificates</title>
		<link>http://www.cryptosmith.com/archives/203</link>
		<comments>http://www.cryptosmith.com/archives/203#comments</comments>
		<pubDate>Tue, 05 Aug 2008 15:14:40 +0000</pubDate>
		<dc:creator>Rick (l) Smith</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[crypto]]></category>
		<category><![CDATA[Mozilla]]></category>
		<category><![CDATA[net neutrality]]></category>
		<category><![CDATA[policy]]></category>
		<category><![CDATA[public-key certificates]]></category>
		<category><![CDATA[SSL]]></category>

		<guid isPermaLink="false">http://www.cryptosmith.com/?p=203</guid>
		<description><![CDATA[Mozilla, like most responsible web browsers, pops up a warning if someone visits a secure web site where the site&#8217;s crypto credentials have not been countersigned by a recognized certificate authority. In Slashdot, Chandon Seldon arues that the Mozilla SSL Policy is Bad For the Web., which links to material by Nat Tuck saying, again, [...]]]></description>
		<wfw:commentRss>http://www.cryptosmith.com/archives/203/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
