3 ms·
There is a solution to this problem. Websites should allow people to log in with their public key. You can create a new, internet-only identity with a public ke
by Astrohacker 15y ago
There is a solution to this problem. Websites should allow people to log in with their public key. You can create a new, internet-only identity with a public key. This would be a little cumbersome at first, but if browsers supported this ability, it could be just as easy as logging in with a password.
Here's how it could work: There could be metatags that specify where to submit the public key. The website will then send back a message that can only be decrypted with the private key. The browser has the user type in the password to access their private key, decrypts the message, and sends it back to the website. The user has now started a session with their public key.
Since you would use the same public key on all websites, your identity would be the same. This would not require a central server like OpenID.
- thwarted 15y agoSSL client certificates are a possibility, but there is very little UX to manage them and present them on a per-site basis.
- barkmadley 15y agoI imagine simply assigning your users a unique key as a cookie would get you 90% of the way there. The chances are good that if a person is returning to your website then they are using the same browser. The 10% you miss are cleared cookies and different browsers/private browsing. This could be seen as a feature however since extra anonymity is gained through existing means.