Alternate ID name?


Status
Not open for further replies.

shanedk

Well-known member
May 20, 2018
412
107
The SQRL spec allows for an Alternate Identity Name specified by the user to create a separate login for that website. On Steve's client, this is achieved by clicking Options at the password prompt and typing in the alternate ID name.

I don't see this option anywhere in the Android client. Has it been implemented yet? If not, it should be before the proper release. If so, it should be more prominent, in the Options button at the password screen.
 

Steve

Administrator
Staff member
May 6, 2018
1,011
304
www.grc.com
Right, Shane. As we know, SQRL is very different from any other website login systems. Until a general awareness of the way SQRL operates becomes widely recognized and understood, we want to help users to do the right thing. (Actually, we always want to help users to do the right thing, but it's much more crucial in the early days since people will quickly become frustrated and tangled up in unnecessary excess identities if we do not strongly discourage that. We even see people HERE, who understand this system, being reluctant to use a single identity.

So we need to STRONGLY discourage the creation of additional identities. And for that matter, the Alt-ID facility must be available, but it, too, should be located so that it's not part of a user's typical flow.

I respect and understand the opinions of those who think that my client is overly wordy... and I'm certainly interested in making those words clearer. But many of those words are deliberately aimed at educating SQRL's early users and helping them to use the system the way its designers know it should be. A perfect example is "all the words" I put into proactively discouraging the creation of a new identity. It's almost NEVER what the user should be doing.
 

Dave

Well-known member
May 19, 2018
466
97
Gardner, MA
Hi @shanedk and @Steve

Thank you for bringing this detail to my attention.

I looked around for details of the implementation of this feature. Didn't find anything at http://grc.com/sqrl/* or in the newsgroups talking about alternative id so I guess the actual implementation details are documented else were.

Best regards
Daniel
Subject: Rethinking "Alternate Identities"
From: Steve Gibson <news007_@_grc.com>
Message-ID: <MPG.34e556a3e7d155154c6@4.79.142.203>
Newsgroups: grc.sqrl

Steve said:
The system I designed is complex, confusing, and non-intuitive
to non-techies because, as we know, it simply tacks ANYTHING the
user supplies onto the end of the domain name string that's
being hashed to create new effective identity domains. The cool
thing about this is that alternate identities can be named to
have meaning. But there are liabilities to this power, freedom
and flexibility.

I KNEW I had read that somewhere!
 
Last edited:

Steve

Administrator
Staff member
May 6, 2018
1,011
304
www.grc.com
I looked around for details of the implementation of this feature. Didn't find anything at http://grc.com/sqrl/* or in the newsgroups talking about alternative id so I guess the actual implementation details are documented else were.
Right. Any string the user supplies is directly appended to the domain name + domain extension string that's being hashed. It's just concatenated directly, thus creating an effectively different domain to HMAC for the site-specific private key.
 

shanedk

Well-known member
May 20, 2018
412
107
So, if the domain is example.com and the user types in private, what gets hashed is example.comprivate?
 

TecMunky

Member
Mar 8, 2019
10
2
In my opinion, using Alternate IDs is perfectly acceptable. I have multiple accounts on many different websites - I refer to these as Alter Egos.

Without the availability of Alternate IDs, I would need to create multiple identities in SQRL. This should definitely be discouraged. The only way to effectively discourage multiple identities is to make the use of alternate identities relatively effortless.

Not only that, but being able to store these Alternate Identity Strings in the Android App would be extremely beneficial. For instance, in Steve's Windows App, you have to manually enter the string into a form. This method is prone to errors during login. Did I enter the ID exactly the same way I did it before? I played around a little with the Demo SQRL page, and mistakenly entered the wrong alternate ID a couple times (forgot to capitalize a word). Storing used Alternate IDs would be a good way to ensure these IDs are entered consistently. I don't see how doing this will reduce security in any manner.

Steve: Adding the ability to select previously stored alternate IDs in your app seems appropriate to me as well. I can see a use case where a person would use ONLY Alternate IDs. In Fact I have been considering doing just that for my logins once SQRL becomes ubiquitous. (OK maybe I am too optimistic about it's success).


Let me re-iterate:
I use Alter Egos in many places.
I am sure many others do as well.
Please make using Alternate IDs easier.

----------
Also, as an aside - I have been listening to SecurityNow since the beginning - thanks for the good work.
PS - Please get on updating SpinRite.
 
Last edited:

shanedk

Well-known member
May 20, 2018
412
107
@kalaspuffar, is this going to be implemented soon? In the Options, you appear to have it under "Alternative ID" but this really just asks for the name and password of a different SQRL identity. IMO, this is where Alt-ID should be implemented.

IMO, the client shouldn't show you ANY options for alternate SQRL identity files unless the user has specifically created one. Then, it could be shown in a drop-down similar to how it is on Steve's client. But since this is something that should only be done in rare edge cases, I think it should be de-emphasized and the Alt-ID the method shown in options.
 

ramriot

Well-known member
May 24, 2018
127
14
BTW: Elsewhere on the SQRL newsgroup this is being discussed see:-
http://www.GRC.com/groups/sqrl:22195 & http://www.GRC.com/groups/sqrl:22207

Something to note, which was mentioned in passing above is that because the ALT_ID is concatenated onto the Realm {FQDN + x=n chars) it is possible that the site specific keys for one site could be identical to the keys for another, which holds a small risk of deanonymization. e.g

(no ALT_ID) sqrl://www.example.co === (ALT_ID = "m") sqrl://www.example.com

BTW the use of ALT_ID could be very useful if you have for example multiple Twitter accounts to manage as should they support SQRL you can just type your twitter username as the ALT_ID each time to authenticate & twitter could not (excluding an IP match) know you were the same entity.
 

Steve

Administrator
Staff member
May 6, 2018
1,011
304
www.grc.com
IMO, the client shouldn't show you ANY options for alternate SQRL identity files unless the user has specifically created one.
I think that's the PERFECT solution... and I'm going to adopt it in my client, too. Unless there is something to select there should be no option to select something.
 

Steve

Administrator
Staff member
May 6, 2018
1,011
304
www.grc.com
Something to note, which was mentioned in passing above is that because the ALT_ID is concatenated onto the Realm {FQDN + x=n chars) it is possible that the site specific keys for one site could be identical to the keys for another, which holds a small risk of deanonymization. e.g

(no ALT_ID) sqrl://www.example.co === (ALT_ID = "m") sqrl://www.example.com
Huh? Gary, you should specify the likelihood of that occurrence. We're talking about 256-bit collisions, right? So it's no different that ANY of the other collision probabilities throughout our (and everyone else's) 256-bit crypto systems, right?
 

ramriot

Well-known member
May 24, 2018
127
14
I think that's the PERFECT solution... and I'm going to adopt it in my client, too. Unless there is something to select there should be no option to select something.
I would agree but I think we are getting confused between, alternate SQRL identities because the soft and sessionless ALT_ID feature & multiple SQRL identities via creating them on a single device which retains those as local storage.
 

Steve

Administrator
Staff member
May 6, 2018
1,011
304
www.grc.com
Well, I know that we're talking about actual identities. And Daniel should (and doubtless will) eventually get his terminology aligned with the SQRL spec. ;)
 

PHolder

Well-known member
May 19, 2018
1,160
188
You do realize that there's only one of me, right?
Steve:

My opinion counts for little, I realize, but IMHO you have done way more for SQRL than anyone could have expected. I think, at this point, it needs to be treated as a V1 product... and akin to a young adult... set free from home to make its own way into the world... to sink or swim on its own merits. Personally I suggest you pick a date in the near future as the last day you will work full time on SQRL and then take a break from it. I fear, without such a deadline, you will continue, indefinitely, to tweak and polish. Some projects are never "done" but at some point, good enough has to be good enough.
 

ramriot

Well-known member
May 24, 2018
127
14
Huh? Gary, you should specify the likelihood of that occurrence. We're talking about 256-bit collisions, right? So it's no different that ANY of the other collision probabilities throughout our (and everyone else's) 256-bit crypto systems, right?
Precisely, thus any occurance at a level higher than that suggests an alternate cause, though this is still very edge & I see no issues (not that there may not be).

BTW I just saw a banner notice about proposed changes in the ALT_ID section of the protocol but I see no explanation of what the change is, can you document that in a post for brief discussion for stakeholders before it gets made (you can time limit discussion any way you want).
 

Steve

Administrator
Staff member
May 6, 2018
1,011
304
www.grc.com
My opinion counts for little, I realize, but IMHO you have done way more for SQRL than anyone could have expected. I think, at this point, it needs to be treated as a V1 product... and akin to a young adult... set free from home to make its own way into the world... to sink or swim on its own merits. Personally I suggest you pick a date in the near future as the last day you will work full time on SQRL and then take a break from it. I fear, without such a deadline, you will continue, indefinitely, to tweak and polish. Some projects are never "done" but at some point, good enough has to be good enough.
I was talking about exactly this issue, this morning with my mate, Lorrie. The short version is: I agree 100%. If nothing else, the fact that SpinRite v6.0 is now 15 years old shows that once I finish with something and put it down I really do switch my focus to something else. And I am desperately excited that my return to SpinRite is approaching. But I'm also supremely patient. The forums are in place. GRC's "Proof of Concept" client is very very close to being at v1.0. And the only thing needed now is for the original descriptive pages at GRC to be updated to reflect the result that we have achieved here. Once that's done it really will be up to the world to decide whether this system is enough better than alternatives to be worthy of adoption.

And I am SO GRATEFUL and GLAD that there is such a community here, into whose charge I can release this, while I get back to the long neglected SpinRite! :)
 
Status
Not open for further replies.