3 ms·
Better yet: use encryption keys to verify identity.
by jasonhansel 7y ago
Better yet: use encryption keys to verify identity.
- TheDong 7y agoI don't think encryption keys actually are useful for the average case here. Currently, developers store npm tokens which may be stolen because they're often stored on disk or as environment variables. Requiring developers to store encryption keys makes almost no difference: the private key will still be stored on disk and will still be vulnerable to effectively the same attacks. There are some differences of course. Security-conscious users could use hardware tokens to store their encryption keys, and they could password protect the private key in either case. This is not the large majority of users though, so in the average case, it won't matter.