3 ms·

How so?

greatgib 4y ago
You will probably have one public/private key set per device or browser to be able to connect to the website. At the opposite, if you share your private keys on all your devices with probably automatic sync. It might defeat it's purpose in term of security. Imagine if you were to copy your ssh private key on all your machines instead of having one per device. Now, if I'm trying to connect with public key 1234 to Facebook, it will be that I'm connecting from my home computer Firefox. If I try to connect with public key 6754, then I'm definitely on my work computer chrome.
- stetrain 4y ago
  Well yes, the site you are signing into would know which key pair you are using. But that isn’t shared across websites so I’m not sure that’s any violation of privacy.
  - greatgib 4y ago
    Facebook will know that you for sure that you connected from a new computer/ phone. Facebook will know that you are on your iphone A. Facebook will know for sure that you are on the computer (work) were you look at funky business pages... Even if less dangerous, your employer will know for sure that you connected from your personal computer to download X from Google workspace or specific work site even if nothing was explicitly setup for you like a VPN.
    - stetrain 4y ago
      Facebook will know that you are on Device 1 or Device 2. They can already probably determine that via a combo of user agent, IP, and other fingerprinting. And if you want to use different accounts on the same device, Facebook wouldn’t know that it’s the same device. Google already tracks which devices you are signed in on, and alerts you if you sign in from one that isn’t already trusted. I’m not sure what the issue is here. It’s not like there is a device identifier that can correlate your device logins across different sites or services.
      - greatgib 4y ago
        They are other ways that you can fight, and officially browsers are adding feature to protect against them. But this add another level of fingerprinting. This is my point.
        stetrain 4y ago
        Fair enough, but unlike most fingerprinting techniques used for ad targeting this doesn’t correlate across different apps or websites. And if it reduces the usage of systems like “Sign in with Facebook” or “Sign in with Google” across sites then that is also a privacy win.

How so?

You will probably have one public/private key set per device or browser to be able to connect to the website. At the opposite, if you share your private keys on all your devices with probably automatic sync. It might defeat it's purpose in term of security. Imagine if you were to copy your ssh private key on all your machines instead of having one per device. Now, if I'm trying to connect with public key 1234 to Facebook, it will be that I'm connecting from my home computer Firefox. If I try to connect with public key 6754, then I'm definitely on my work computer chrome.

stetrain 4y ago
Well yes, the site you are signing into would know which key pair you are using. But that isn’t shared across websites so I’m not sure that’s any violation of privacy.
- greatgib 4y ago
  Facebook will know that you for sure that you connected from a new computer/ phone. Facebook will know that you are on your iphone A. Facebook will know for sure that you are on the computer (work) were you look at funky business pages... Even if less dangerous, your employer will know for sure that you connected from your personal computer to download X from Google workspace or specific work site even if nothing was explicitly setup for you like a VPN.
  - stetrain 4y ago
    Facebook will know that you are on Device 1 or Device 2. They can already probably determine that via a combo of user agent, IP, and other fingerprinting. And if you want to use different accounts on the same device, Facebook wouldn’t know that it’s the same device. Google already tracks which devices you are signed in on, and alerts you if you sign in from one that isn’t already trusted. I’m not sure what the issue is here. It’s not like there is a device identifier that can correlate your device logins across different sites or services.
    - greatgib 4y ago
      They are other ways that you can fight, and officially browsers are adding feature to protect against them. But this add another level of fingerprinting. This is my point.
      - stetrain 4y ago
        Fair enough, but unlike most fingerprinting techniques used for ad targeting this doesn’t correlate across different apps or websites. And if it reduces the usage of systems like “Sign in with Facebook” or “Sign in with Google” across sites then that is also a privacy win.