4 ms·
Yes. A great, practical and scalable example is found in ssh: http://en.wikipedia.org/wiki/Secure_Shell#Key_management http://en.wikipedia.org/wiki/Secure_Shell
by nnnnnnnn 14y ago
Yes. A great, practical and scalable example is found in ssh: http://en.wikipedia.org/wiki/Secure_Shell#Key_management http://en.wikipedia.org/wiki/Secure_Shell#Key_management I'll try to explain how it works in non-technical terms (so please don't nitpick as I'm glossing over details)
User generates a public and private keypair. The public key is given to the remote site (such as LoL or Linkedin), but the public key is not secret -- it is public. You can post it on your blog, whatever. You can use it for multiple accounts without concern.
The public key allows one to encrypt some data, but the public key cannot decrypt the data.
The private key can decrypt the data.
When the user wishes to log in the remote site, using the public key, encrypts a random string and sends it to the user. If the user manages to successfully decrypt this random string and send it back then the remote site can infer that the user holds the private key -- because only the private key can perform the decryption.
The private key is never sent to a remote party. Only meaningless random strings are communicated over the wire.
The (significant) drawback to this method is that the user will have to have the private key with them in order to perform the authentication. But perhaps mobile devices will solve that problem for us.
- astrodust 14y agoI would love to see an ssh-like key exchange built into browsers. You add your key to the site, GitHub style, and then you use that for auth. No more nonsense with OAuth or "remember my password" or the remote site having your password just because they grabbed the DB. It's just a useless public key to them.
- Zash 14y agoSSL Client certificate authentication has existed in browsers for a long time. Browsers even have built in key generation, but noone uses it. Probably because the UI is not very good. Mozillas new BrowserID scheme is pretty similar to this too.
- nnnnnnnn 14y agoPKI as implemented by SSL Certs is needlessly complicated, which is a big part of why no one has adopted it for end user authentication. Compare what I described above to the mess described here: http://en.wikipedia.org/wiki/Public-key_infrastructure http://en.wikipedia.org/wiki/Public-key_infrastructure A decentralized key system as ssh provides is much more appropriate for end users.
- sirn 14y agoTLS Client Authentication[1]? I believe this is what StartSSL[2] is using for user to access their control panel. The biggest problem is it is so user unfriendly. [1]: http://www.browserauth.net/tls-client-authentication http://www.browserauth.net/tls-client-authentication [2]: http://www.startssl.com/ http://www.startssl.com/
- jrockway 14y agoIt's built in. Many companies use it internally. In fact, I can't think of any VPN I've ever connected to that didn't require a machine certificate. Cisco VPNs I've used require it, as does my own personal VPN.