3 ms·

Hi! I wanted to check out the browser extension that is mentioned, but the site is returning 404. Mostly, I wanted to find out whether the extension is using

by skibz 9y ago

Hi! I wanted to check out the browser extension that is mentioned, but the site is returning 404. Mostly, I wanted to find out whether the extension is using WebCrypto for the key generation, signing, verification, etc, and how the private key is being stored. Can you please elaborate on this?

jeswin 9y ago
As I mentioned on the top, it isn't ready yet. I just wanted to put a spec out there for discussion. I also wanted to take ideas on implementation, such as what you just provided. I'll keep you posted on progress, if your email is in your profile. Hoping to have everything (plug-in and serverside examples) ready in a week or two.
- skibz 9y ago
  Sorry, I missed that. I love the idea. It reminds me of something I read on HN a few years back where somebody proposed using SSH auth for web authentication.
- skibz 9y ago
  Also, forgot to mention: If you were to use WebCrypto, it ought to be possible to securely (with respect to cross-origin policy) store a user's private key using IndexedDB.
  - jeswin 9y ago
    Being able to transfer private keys between devices owned by a user might be a necessary feature. Otherwise accounts will be tied to a single device. Not sure what would be a good way to do this though.
    - skibz 9y ago
      Absolutely, yeah. WebCrypto has support for keypairs that can have the private key data extracted (there are limits, though, which I cannot accurately remember) from the JavaScript object in which they are contained. So it ought to be possible to extract the key data, encrypt it (also using WebCrypto) and sync it (somehow) to another device.
    - joantune 9y ago
      Keybase had something for that if I'm not mistaken
  - jeswin 9y ago
    The other option will be to generate a new key pair on the new device, and then add the public key to an account via an already registered key. Add key for <user@website> at <utcmillisecs>: <new_public_key_goes_here>;<sign>
    - jeswin 9y ago
      Or maybe just do it with a UI, after logging in with the original key. However, That would restrict the user to adding new devices only from trusted machines. Again, having a command ("Add key ..." as in parent message) for this would make this feature accessible to password/key managers.

by skibz 9y ago

jeswin 9y ago

As I mentioned on the top, it isn't ready yet. I just wanted to put a spec out there for discussion. I also wanted to take ideas on implementation, such as what you just provided. I'll keep you posted on progress, if your email is in your profile. Hoping to have everything (plug-in and serverside examples) ready in a week or two.

skibz 9y ago
Sorry, I missed that. I love the idea. It reminds me of something I read on HN a few years back where somebody proposed using SSH auth for web authentication.
skibz 9y ago
Also, forgot to mention: If you were to use WebCrypto, it ought to be possible to securely (with respect to cross-origin policy) store a user's private key using IndexedDB.
- jeswin 9y ago
  Being able to transfer private keys between devices owned by a user might be a necessary feature. Otherwise accounts will be tied to a single device. Not sure what would be a good way to do this though.
  - skibz 9y ago
    Absolutely, yeah. WebCrypto has support for keypairs that can have the private key data extracted (there are limits, though, which I cannot accurately remember) from the JavaScript object in which they are contained. So it ought to be possible to extract the key data, encrypt it (also using WebCrypto) and sync it (somehow) to another device.
  - joantune 9y ago
    Keybase had something for that if I'm not mistaken
- jeswin 9y ago
  The other option will be to generate a new key pair on the new device, and then add the public key to an account via an already registered key. Add key for <user@website> at <utcmillisecs>: <new_public_key_goes_here>;<sign>
  - jeswin 9y ago
    Or maybe just do it with a UI, after logging in with the original key. However, That would restrict the user to adding new devices only from trusted machines. Again, having a command ("Add key ..." as in parent message) for this would make this feature accessible to password/key managers.