3 ms·
Makes sense, and then you're getting into something akin to SSH key pairs, and I know from experience that many users can't manage that especially across multip
by ams6110 9y ago
Makes sense, and then you're getting into something akin to SSH key pairs, and I know from experience that many users can't manage that especially across multiple client devices.
- jrochkind1 9y agoThere are probably ways to make it reasonable UX, but they probably require built-in browser (or other client) support. Someone in another part of this thread mentioned the "Web Authentication API" for browsers, which I'm not familiar with, but is possibly trying to approach this?
- tehbeard 9y agoWeb Auth API (authn) does try to make it usable. It ties in with the credential management API (A way to have the browser store login credentials for a site, a much less heuristic based approach than autocomplete on forms) and basic principle is generate a key pair, pass back public key to be sent to server during registration. On login generate a challenge value for the client to sign. I don't think iirc the JS code ever sees the private key, only the browser sees it.
- kevin_thibedeau 9y agoUseless unless browsers get their act together and encrypt their autocomplete data. I would never trust any API loosely associated with it.
- jrochkind1 9y agoHow does Web Auth API and Credentials Management API address the "manage across multiple client devices" issue?