4 ms·
That's true, you don't share a private key with an authenticator, so it's unlike a password in that sense - but it's still what-you-know authentication, and any
by endtime 16y ago
That's true, you don't share a private key with an authenticator, so it's unlike a password in that sense - but it's still what-you-know authentication, and any what-you-know authentication that a user can't actually know/remember is impractical.
- lukev 16y agoGiven the current infrastructure, yes, it's impractical. But a correct infrastructure could be easier to use and an order of magnitude more secure. And it wouldn't have to be rolled out all at once. I really wish my bank gave me the option of signing in with a private key today.
- dedward 16y agoA private key (or client cert) is generally more of a "something you have" than a "something you know" credential. (unless you memorized your key - it's something you have, not something you know)
- endtime 16y agoWell, it's data. I guess it does reduce to "what you have" given that it's not memorable, but as we all know, "what you have" is less convenient than "what you know".