3 ms·
Passwords are PSKs and are the overwhelming default authentication mechanism for Internet scale systems. Storing, distributing, and synchronizing billions of s
by colmmacc 9y ago
Passwords are PSKs and are the overwhelming default authentication mechanism for Internet scale systems.
Storing, distributing, and synchronizing billions of small blobs is actually a solved problem and not that big a deal. I wouldn't be so quick to write it off, because it has a real, working, easily understood invalidation and revocation story, which PKI does not.
A system that combines asymmetric crypto public-private key pairs with the distributed-whitelist properties of simple passwords, by treating the public keys as PSKs, has a lot of compelling benefits.
- CiPHPerCoder 9y ago> Passwords are PSKs and are the overwhelming default authentication mechanism for Internet scale systems. Not for HTTPS, which is what we're talking about. For WPA2-PSK, okay, you have a small n, it might work. For user authentication against a local database, you're not encrypting, you're using validating against a password hash and then elevating the user's privilege for the duration of their session. That's far removed from what we mean when we say PSK (pre-shared keys), where encryption is implied.
- late2part 9y agoTo be fair, that’s what you’re talking about. I am mostly talking about SSH access.
- IncRnd 9y agoAre you aware of what forms of asymmetric crypto are broken by quantum computing?
- tscs37 9y agoPasswords are largely stored in servers with enough storage to deal with the users of them. However, distributing a PSK to every device is not friendly. 10 Million Passwords will at minimum take about 80 MB, some phones and IoT devices have only ten times of that as permanent storage or less. Passwords work mostly because the other side has the storage and cpu capacity to operate with them