4 ms·
I had a similar idea, for an "auth box" that would could be hosted by a third party or ran at home on the end of a consumer connection. Whenver you log in or s
by epscylonb 14y ago
I had a similar idea, for an "auth box" that would could be hosted by a third party or ran at home on the end of a consumer connection.
Whenver you log in or sign up to a site, a request is made to this device which can authenticate the user and return the result to the site.
A big drawback to this scheme is that stealing the box could become profitable. It would also require a more mature network than we have now.
Passwords are crap and key management is hard, who really wants to do 2 factor auth every time they want to log into gmail?.
- icebraining 14y agoAn existing implementation of that are Smart Cards. They contain a Public-Private key pair, and they will actually perform the crypto themselves (when plugged into a reader), so the private key never leaves the card. Here in Portugal our new ID cards (Citizen Card) are already smart cards, so we can log in to e.g. our IRS using it, at least with browsers which support PKCS#11, like Firefox.
- epscylonb 14y agoWhat happens if you lose the ID card?.
- icebraining 14y agoYou need to ask for a new one, with its own key pair (and the old one will be revoked). As for a possible attacker that found your card: The card has a PIN and locks out after three failed tries. After locking out, you can only unlock it by going to an IRS office where they authenticate you using photo/fingerprint/etc and then using their machine and inserting an unblocking code that only you have. If you don't know the code, you need to ask for a new card.