This process makes any application using OpenID Connect for authentication much more secure without any other changes. OpenPubkey is transparent to users and OpenID providers. An OpenID provider can not even determine that OpenPubkey is being used. This makes OpenPubkey fully compatible with existing OpenID providers. This compatability includes Google, Azure/Microsoft, Okta, OneLogin, and Keycloak. This project is not adding any new OpenID Connect trusted parties.
OpenPubkey is already being used to authenticate signed messages and identities for users with accounts on Google, Microsoft, Okta, and OneLogin. By augmenting OpenID Connect, OpenSubkey will enable users and workloads to sign artifacts under their OpenID identity. This capability is instrumental for applications requiring secure remote access and software supply chain security features, including signed builds, deployments, and code commits.
Also: 6 simple cybersecurity rules to live by
That level of application all sounds good in practise, but you should keep in mind that even OpenPubkey’s reference implementation is a work in progress. For example, the OpenPubkey client still needs support for the Github OpenID Provider, the Azure OpenID Provider (OP).
Jim Zemlin, the Linux Foundation’s executive director, is enthusiastic about hosting the OpenPubkey Project: “This initiative is poised to be a cornerstone in enhancing the security fabric of the open-source software community.” Zemlin extended an invitation to developers and organizations to join hands in this collaborative venture aimed at amplifying software supply chain security.
TestifySec, a prominent cybersecurity player. has endorsed the initiative. Cole Kennedy, CEO of TestifySec, commended the OpenPubkey approach of enabling easy and reliable signing: “The collaboration between Docker and BastionZero has our unwavering support. We are optimistic about the immense benefits the broader community stands to gain.”
Also: Linux tries to dump Windows’ notoriously insecure RNDIS protocol
Interested in learning more about getting OpenPubkey ready for production? Check out the OpenPubkey GitHub page and get to work. This is an authentication and security project that shows a lot of promise.
Featured
iPhone 15 Pro review: Prepare to be dazzled
Generative AI will far surpass what ChatGPT can do. Here’s everything on how the tech advances
Google Pixel 8 vs. Google Pixel 8 Pro: Which one is right for you?
The best USB-C cables for the iPhone 15: What the experts recommend
iPhone 15 Pro review: Prepare to be dazzled
Generative AI will far surpass what ChatGPT can do. Here’s everything on how the tech advances
Google Pixel 8 vs. Google Pixel 8 Pro: Which one is right for you?
The best USB-C cables for the iPhone 15: What the experts recommend
Article source: https://www.zdnet.com/article/new-cryptographic-protocol-aims-to-bolster-open-source-software-security/#ftag=RSSbaffb68