4 ms·

A private key with an associated public key signed by one or more entitities that have verified the owner of the private key.

by u801e 7y ago

pjc50 7y ago
And how many people have those? With appropriate knowledge of how to generate, store, sign, backup, and secure the keys? On the front page of HN at the moment we have "we lost millions of dollars of Oracle DB due to key management issues". Key management is hard. Every few months a crypto exchange discovers this by either leaking or entirely losing their keys. It's basically just people with Estonian e-identity cards and a handful of people with organisational PKI.
- u801e 7y ago
  > With appropriate knowledge of how to generate, store, sign, backup, and secure the keys? I believe this could be solved by improving the interface used to accomplish these tasks (rather than using openssl req directly). Web browsers ask to save passwords and other sensitive information. There's no reason why they cannot relatively securely store a private key and the associated certificates. > Key management is hard That is true, but requiring key/certificate based auth in addition to the username and password for authentication means that attacks would have to be distributed amongst the users of a given website and the website itself rather than just attacking the website or some 3rd party used for 2FA (email or cell phone). And breaches where backend databases are compromised and user credentials are retrieved also happen. But due to people re-using credentials on multiple services, they also get compromised on unrelated services. Using a private key and a certificate per service, it would be much harder to do something like that.
  - pjc50 7y ago
    > There's no reason why they cannot relatively securely store a private key and the associated certificates. The big ones have supported this for two decades: https://www.digicert.com/managing-client-certificates.htm https://www.digicert.com/managing-client-certificates.htm Hardly anywhere uses it.
reaperducer 7y ago
signed by one or more entitities Sounds like another opportunities for the advertising companies like Google and Facebook to uniquely identify us.
- drdaeman 7y ago
  There are blind signature schemes.

A private key with an associated public key signed by one or more entitities that have verified the owner of the private key.

by u801e 7y ago

A private key with an associated public key signed by one or more entitities that have verified the owner of the private key.

pjc50 7y ago

And how many people have those? With appropriate knowledge of how to generate, store, sign, backup, and secure the keys? On the front page of HN at the moment we have "we lost millions of dollars of Oracle DB due to key management issues". Key management is hard. Every few months a crypto exchange discovers this by either leaking or entirely losing their keys. It's basically just people with Estonian e-identity cards and a handful of people with organisational PKI.

u801e 7y ago
> With appropriate knowledge of how to generate, store, sign, backup, and secure the keys? I believe this could be solved by improving the interface used to accomplish these tasks (rather than using openssl req directly). Web browsers ask to save passwords and other sensitive information. There's no reason why they cannot relatively securely store a private key and the associated certificates. > Key management is hard That is true, but requiring key/certificate based auth in addition to the username and password for authentication means that attacks would have to be distributed amongst the users of a given website and the website itself rather than just attacking the website or some 3rd party used for 2FA (email or cell phone). And breaches where backend databases are compromised and user credentials are retrieved also happen. But due to people re-using credentials on multiple services, they also get compromised on unrelated services. Using a private key and a certificate per service, it would be much harder to do something like that.
- pjc50 7y ago
  > There's no reason why they cannot relatively securely store a private key and the associated certificates. The big ones have supported this for two decades: https://www.digicert.com/managing-client-certificates.htm https://www.digicert.com/managing-client-certificates.htm Hardly anywhere uses it.

reaperducer 7y ago

signed by one or more entitities Sounds like another opportunities for the advertising companies like Google and Facebook to uniquely identify us.

drdaeman 7y ago
There are blind signature schemes.