4 ms·
Also, forgot to mention: If you were to use WebCrypto, it ought to be possible to securely (with respect to cross-origin policy) store a user's private key usi
by skibz 9y ago
Also, forgot to mention:
If you were to use WebCrypto, it ought to be possible to securely (with respect to cross-origin policy) store a user's private key using IndexedDB.
- jeswin 9y agoBeing able to transfer private keys between devices owned by a user might be a necessary feature. Otherwise accounts will be tied to a single device. Not sure what would be a good way to do this though.
- skibz 9y agoAbsolutely, yeah. WebCrypto has support for keypairs that can have the private key data extracted (there are limits, though, which I cannot accurately remember) from the JavaScript object in which they are contained. So it ought to be possible to extract the key data, encrypt it (also using WebCrypto) and sync it (somehow) to another device.
- joantune 9y agoKeybase had something for that if I'm not mistaken
- jeswin 9y agoThe other option will be to generate a new key pair on the new device, and then add the public key to an account via an already registered key. Add key for <user@website> at <utcmillisecs>: <new_public_key_goes_here>;<sign>
- jeswin 9y agoOr maybe just do it with a UI, after logging in with the original key. However, That would restrict the user to adding new devices only from trusted machines. Again, having a command ("Add key ..." as in parent message) for this would make this feature accessible to password/key managers.