Every sign-in, now encrypted
A significant upgrade to the triauth protocol encrypts every answer that your authenticator sends to a website, and every request that follows.
Today we are releasing a significant privacy upgrade to the triauth protocol. Every answer that your authenticator sends to a website is now encrypted, and so is every request that a website makes after you sign in.
Why
When you sign in, your authenticator sends the website a signed answer. Until now, that answer traveled as plain text. A copy of it is of no use for signing in as you, but it shows your identifier, and servers, proxies, and error trackers often keep copies of what passes through them. Also, later requests, such as a document to sign, traveled the same way, and your browser kept them in its history in readable form.
Encrypted answers
Now your authenticator seals its answer with a cryptographic key, so that only the website that made the request can open and read it. Anything that logs the answer along the way sees only encrypted text.
One secret for everything after
The cryptographic process behind sealing and opening the answer gives the website and your authenticator the same secret, which they use to establish an encrypted channel between them. Every other operation that follows the sign-in is now encrypted with that secret. Your browser's history holds only encrypted text, so the documents that you sign and the attestations that you make stay private, and do not leak through the browser history to your other devices or to the browser's vendor.
What you need to do
Nothing, if you sign in with triauth. The hosted authenticator at auth.triauth.org has the upgrade. A website that updates may ask for your approval again at your next sign-in.
If you run a website with triauth, update to the latest triauth-js. The sign-in result now gives you a session key in place of tokens, and the stored challenge now holds the key that unlocks the answer, so keep it out of logs. See Sessions and sign-out and Extensions and permissions.
If you self-host the authenticator, update your copy. See Self-host the authenticator.
A more private web
Privacy is a part of how triauth is built, from identities that you own to records that show no more than you choose. This upgrade is one more step in that direction. We hope you enjoy it, and we would love to hear what you think.
Sign in with your own domain. No passwords.
triauth is free and decentralized. Create your identifier in a minute, or add “Sign in with triauth” to your own app in an afternoon.