Re: Devilish: Forget about DNS

On Mon, Feb 09, 2004 at 11:26:50AM -0800, Jeff_Silverman wrote:
>
> So why not use kerberos, which was designed to authenticate things?
>


For several reasons:

- This is about authorization, not authentication
- There is no world wide kerberos network. There's only
  DNS. That's why I still propose to use DNS to find the
  server providing the authorization record.
- Kerberos requires interaction of the authenticating user.
  We don't have him here. It's a store and forward service.
  Of course, you could authenticate relays against each other, 
  but what would this take to work?
- With kerberos, you trust the machine you're authenticating to.
  That's not the case.

But your question is not bad or wrong. Your way of thinking is
correct. Don't stick to DNS as the holy grail. Ask what you 
want to do and find the appropriate service.

Present your proposal about how to use kerberos and let's discuss it. 

regards
Hadmut