4 ms·
There is a major difference - a password is known by the host. Of course they salt and hash and use bcrypt to secure their storage of it, but ultimately, a pas
by lukev 16y ago
There is a major difference - a password is known by the host. Of course they salt and hash and use bcrypt to secure their storage of it, but ultimately, a password is a shared secret between you and the site.
A private key is fundamentally different - it is private. You never send it to anyone, ever. So it's safe to use just one, because nobody else will ever see it.
As you alluded to, the problem then becomes managing that key securely, and also generating & distributing keys for non-technically inclined users.
- mquander 16y agoOK, but bcrypt works! As far as anyone knows, the best you can do is just brute-force it, which is the same situation we're in with public key cryptography. The only substantiative difference is that passwords are often of a length and complexity that actually permits brute force or a dictionary attack -- meaning we're back to, is it small and memorizable, or a big binary blob, as being the distinguishing property.
- axiak 16y agoYou're assuming that the web sites use bcrypt. From the perspective of a web user, public/private keys allow me to not trust the web sites.
- endtime 16y agoThat's true, you don't share a private key with an authenticator, so it's unlike a password in that sense - but it's still what-you-know authentication, and any what-you-know authentication that a user can't actually know/remember is impractical.
- lukev 16y agoGiven the current infrastructure, yes, it's impractical. But a correct infrastructure could be easier to use and an order of magnitude more secure. And it wouldn't have to be rolled out all at once. I really wish my bank gave me the option of signing in with a private key today.
- dedward 16y agoA private key (or client cert) is generally more of a "something you have" than a "something you know" credential. (unless you memorized your key - it's something you have, not something you know)
- endtime 16y agoWell, it's data. I guess it does reduce to "what you have" given that it's not memorable, but as we all know, "what you have" is less convenient than "what you know".
- espennilsen 16y agoWhat if your iphone/android device helped you manage your private key? A website could send a push-notification to your phone. You as a user would then have to say "Yes Its me logging in" and voila your in.