5 ms·

I am very curious why public private key auth is not a thing for websites and applications. I would rather have a single password to the server that publicly ho

I am very curious why public private key auth is not a thing for websites and applications. I would rather have a single password to the server that publicly hosts my public key then I can simply point websites and applications to that address during signup. Every app/site would check the server every 5-20 mins for changes to my public key in case I need to change it. Then I can use my private key to authenticate to all these sites/apps instead of trying to keep track of 500 damn passwords.

ReactiveJelly 5y ago
Because storage media can be shared and lost. If you're logging in from a library computer, you don't want the hassle of putting your privkey file on it and wiping it later. (Or connecting a USB drive, which may be a security hazard for the library) If you lose your computer, you still remember your password, but your only copy of your privkey may be lost. Losing hard drives is common for non-power users, because they don't do regular backups, and they often don't know that you can trivially recover files from, e.g. a laptop with a broken screen that won't boot. And computerized cell phones are actively trying to convince those non-power users that files don't even exist, to protect their profits.
- whoomp12342 5y ago
  cloud/vaults for all
thinkharderdev 5y ago
I really hope that password managers are a step in this direction. Once they become ubiquitous then everyone effectively already has a "master password" for all their online identities. It wouldn't even really need to be a 3rd party service. The password managers could hold the keys locally and websites could just use WebAuthn for authentication.
tialaramex 5y ago
Your idea is basically "What if I was 100% trackable everywhere" which, if you're comfortable with that you're a rare exception - and if you didn't realise that was what you just proposed, well, now you know why we don't do that. Now, public key cryptography is indeed promising, but you see something rather more sophisticated to deliver privacy and security and that's what WebAuthn is.
Zamicol 5y ago
I agree. Public key authentication is mature. It just needs to be adopted. I'm not clear on the password part (I'm assuming it was a typo).
jandrese 5y ago
You sit down at a public machine with no accessible ports. I hope you memorized your public key so you can type it in.
- nybble41 5y ago
  It's probably a bad idea to authenticate on a public machine to begin with. How can you possibly know what that machine might do with your account once you log in? But let's say you want to do it anyway. There is no need to memorize or type the entire key; a site-specific private/public keypair can be derived from a memorized master password and the domain name (for uniqueness) via a KDF. The site never needs to see the master password, so in the event of a breach all your other logins remain secure, and there are no key files to synchronize, just a single password for access to all your accounts. You do need to trust that the PC you're using to log in is secure, though, since it has access to the master password; I'm not sure how you would get around that without involving some other trusted piece of hardware, and if you have that you could just use it to access the site instead.

ReactiveJelly 5y ago

Because storage media can be shared and lost. If you're logging in from a library computer, you don't want the hassle of putting your privkey file on it and wiping it later. (Or connecting a USB drive, which may be a security hazard for the library) If you lose your computer, you still remember your password, but your only copy of your privkey may be lost. Losing hard drives is common for non-power users, because they don't do regular backups, and they often don't know that you can trivially recover files from, e.g. a laptop with a broken screen that won't boot. And computerized cell phones are actively trying to convince those non-power users that files don't even exist, to protect their profits.

whoomp12342 5y ago
cloud/vaults for all

thinkharderdev 5y ago

I really hope that password managers are a step in this direction. Once they become ubiquitous then everyone effectively already has a "master password" for all their online identities. It wouldn't even really need to be a 3rd party service. The password managers could hold the keys locally and websites could just use WebAuthn for authentication.

tialaramex 5y ago

Your idea is basically "What if I was 100% trackable everywhere" which, if you're comfortable with that you're a rare exception - and if you didn't realise that was what you just proposed, well, now you know why we don't do that. Now, public key cryptography is indeed promising, but you see something rather more sophisticated to deliver privacy and security and that's what WebAuthn is.

Zamicol 5y ago

I agree. Public key authentication is mature. It just needs to be adopted. I'm not clear on the password part (I'm assuming it was a typo).

jandrese 5y ago

You sit down at a public machine with no accessible ports. I hope you memorized your public key so you can type it in.

nybble41 5y ago
It's probably a bad idea to authenticate on a public machine to begin with. How can you possibly know what that machine might do with your account once you log in? But let's say you want to do it anyway. There is no need to memorize or type the entire key; a site-specific private/public keypair can be derived from a memorized master password and the domain name (for uniqueness) via a KDF. The site never needs to see the master password, so in the event of a breach all your other logins remain secure, and there are no key files to synchronize, just a single password for access to all your accounts. You do need to trust that the PC you're using to log in is secure, though, since it has access to the master password; I'm not sure how you would get around that without involving some other trusted piece of hardware, and if you have that you could just use it to access the site instead.