4 ms·
Ask HN: Were SSH keys ever considered for browser authentication?
Was support for authenticating to websites using SSH keys ever considered by any of the standards bodies or browser vendors (esp. Firefox)? If so, is there any documentation or historical record of why support was never implemented?
- arthurcolle 6y agoWhere would these keys be stored? In some browser-internal keystore? Or on your machine outside of the browser?
- politician 6y ago$HOME/.ssh, alongside all of our other keys.
- jolmg 6y agoThat's not part of any standard or spec, though. It's just where one implementation of SSH stores the keys. gpg-agent (which handles ssh keys when behaving as an SSH agent) stores them elsewhere. I imagine Putty and Filezilla do, too. It's possible that the storage format of the keys is not standard either, because I think I remember it being different between OpenSSH and Putty.
- gvb 6y agoBrowsers already support certificate based authentication equivalent to SSH key based authentication. In practice, it is difficult to prevent (and impossible to detect) an unauthorized user from misusing the authentication either by stealing the browser certificate or simply using an unattended browser window for unauthorized access. https://www.ssl.com/how-to/configuring-client-authentication-certificates-in-web-browsers/ https://www.ssl.com/how-to/configuring-client-authentication... https://medium.com/@sevcsik/authentication-using-https-client-certificates-3c9d270e8326 https://medium.com/@sevcsik/authentication-using-https-clien... And, if you click the links above, it is very cumbersome to set up.
- politician 6y agoI'm familiar with TLS client certificates and how cumbersome they are. It's a shame because command-line ssh is so simple.
- franzwong 6y agoSomething like fido?