"The users must not have to trust anyone with their identity." That'll be a problem. Can you elaborate more on what you mean by that? Also, why does TOTP have better security than Username/Password? (I would argue the opposite in most cases, but it's usually just a 2nd factor, so...) Why is Username/Password considered "poor security"?

@browsermator For any of UN/PW, TOTP, DID and PGP the user can create a unique identifier for each site/account. This would prevent the server being able to identify that the accounts were controlled by the same individual. AIUI this is not possible with PassKey without having one piece of authentication hardware for each account.

so, a username...

@browsermator "why does TOTP have better security than Username/Password" because an attacker who gets access to one password cannot use it after 30 seconds have past. "Why is Username/Password considered "poor security"" the answer to this includes MITM and database loss. Perhaps that is a question of its own?

@User65535 I think what you're saying then is username/password + TOTP together have better security that username/password on it's own? Not that TOTP on it's own is necessarily better than username/password?

@andycaine My understanding is the UN + TOTP is better than UN + static password.

I just watched a doc on the "cyberbunker" which you might want to check out. The problem became that people trusted the employees of the bunker to not leave the bunker un-attended. Even if they hadn't done that if a guv'ment wanted in, they'd have blasted it open. (or laid siege) So a lot of what you are getting at would be the physical security of the ISP/web host.

@browsermator A critical example of privacy is dark web marketplaces. They operate with high security while not requiring any trust in the marketplace's physical security. They tend to use PGP, which demonstrates the real world utility of this sort of log in system.

yes, well that's the cyberbunker... I guess their plan was to self-destruct all servers before the guv got in, but they messed up and left it unattended. This still fails your first requirement of not trusting your identity to anyone.

TOTP usually has all sorts of security problems... often sent through e-mail (insecure), opens up phishing attacks, if server hacked attacker could generate their own, etc... etc... but some 2nd factor is usually better than none.

TLS usually relies on a third party and only allows one way authentication.

mTLS provides for authentication of both parties. And no, TLS does not require trusting third parties, but pre-distributed root CA's makes things more convenient. You're free to roll your own CA if you want.

@vidarlo mTLS is apparently too complex to work as a general solution as address in the question. Home rolled TLS is used, but frequently supplemented with PGP because that is more secure.

How on earth is PGP more secure? And mTLS is not too complex in many scenarios; I use it everyday at work. It's fairly simple; issue a certificate for the user, and happy days. It's not more complex than PGP. Rather opposite, as browsers support it directly.

@vidarlo Is I go to a site on the dark web that has home rolled TLS I do not know who is controlling it, the URI changes constantly because of DOS. When they provide me with the password the message is signed with their PGP key which is the same on all URI's and was added when I registered. That provides significant security that the site is controlled by a consistent entity. Cloudflare say mTLS is too complicated.

A certificate with the same private issuing CA would provide exactly the same assurance as PGP. PGP is made for e-mail, TLS is made for M2M communication. They serve two different purposes. Cloudflare notes that mTLS is to complex for general use, but what you intend is clearly not general use, but a set of registered users. If you consider PGP as sane, and dismiss mTLS as too complex you have no idea what you're talking about.

In fact, that's exactly the problem a private root CA solves; you can trust that everyone with a cert from that root CA is sanctioned by the same entity as the issuer of the root cert. The browser will even automagically check and verify it for you - which it won't with your PGP signed messages.

@vidarlo I do not know what I am talking about, but I do know that if i register at aesnmw337g2websaewfhjljxnfmr7ctv5xncy71ut3aecybvkgcnx4qd.oni‌​on and the next day go to qvfvjcl6jcz5vrkvoydaztligpxh4zeo7pp1m9arie4wgen22o6ldqqd.oni‌​on I have no way to know if they are controlled by the same entity. If they both demonstrate control of the same PGP keys I know they are. To do this I need no tools that did not come with my OS. There is else nothing I know about that allows that.

That's the purpose of a CA. All certificates issued by the same CA are issued by the same entity! In short issuing a certificate is basically the same as using a PGP key to sign a message; the root CA signs the certificate of the website.

As a remark: you have a moving target. You suddenly introduce changing site URL and mutual authentication as requirement. That pretty much rules out anything but mTLS.

@vidarlo The multiple site thing is one example where it seems TLS fails but PGP does not. It is not a requirement for me, and mTLS may well be the answer.

Why do you keep repeating that TLS fails, when I pointed out exactly how TLS does not fail in that scenario?

@vidarlo I understand it is because I do not know what I am doing, but it is because nothing tells me those two domains have the same controller.