4 ms·
All(well all the ones anyone ever uses) the browsers now are OSS and nobody has done the work. As for doing public key crypto, that's exactly what webauthn doe
by zie 4y ago
All(well all the ones anyone ever uses) the browsers now are OSS and nobody has done the work.
As for doing public key crypto, that's exactly what webauthn does. It doesn't use X.509 and TLS under the hood, but it essentially is a public key crypto system. It works in reverse of what you are saying though. The device(TPM, Yubikey, etc) stores the private key, the website just does verification checks that the device really does have the secret key. Note: there are lots of details I skipped over on purpose.
- u801e 4y agoThe problem I have with webauthn is the fact that it depends on the HTTP application protocol. TLS works regardless of the application protocol used. If I'm using Thunderbird to read and send email over IMAP and SMTP respectively, there shouldn't be a requirement that I use HTTP for authentication.