
TrustBearer OpenID - Two-Factor Authentication With OpenID - pius
http://openid.trustbearer.com/
======
wmf
I like this. (Although I would prefer a SecurID-type dongle rather than
smartcard-type.) Rather than complaining about how OpenID reduces security,
they're finding a case where OpenID increases it. Most Web sites will never
support smartcard login, but if they support OpenID they get it for free.

~~~
JustinBastress
I'd be interested in hearing why you prefer OTP over asymmetric
crypto...because the way I see it, one huge problem with OTP is that the
authenticator needs to know the 'shared secret' on the device...Smart cards
and similar devices using public key encryption have no such requirement.

I guess one benefit of OTP tokens is that they don't need to be physically
connected to the computer (hence no software to install period), but when it
comes right down to it, they're really not much better than just
username/password when it comes to phishing or real-time keylogging
attacks...not to mention the fact that you have to type that huge number /in
addition to/ your regular credentials...

~~~
wmf
My objection is just installing the client software. Public key is definitely
superior for all the reasons you gave.

