4 ms·
Ah. Shoot - hadn't thought of that edge case. Keeping the private key on a third party host would negate the whole point of _having_ a private key. I suppose
by bdunbar 14y ago
Ah. Shoot - hadn't thought of that edge case.
Keeping the private key on a third party host would negate the whole point of _having_ a private key. I suppose one could dodge this by encrypting the encryption, or have it stored 3rd party and then download it where you need ...
But that's two sides of the same coin. And making it way more complicated than userid/password.
Which right there is enough to make the entire deal unworkable. Dang.
Thanks.
- curiouscats 14y agoCouldn't you have the keys on a device (USB stick, smart phone, dick tracy/apple watch ...) that went with you everywhere? Seems like some version of user verification that relies on something like this is likely in the fairly near future. Google is looking at the idea of using hardware rather than username/password http://www.wired.com/wiredenterprise/2013/01/google-password/all/ http://www.wired.com/wiredenterprise/2013/01/google-password...
- wmf 14y agoSure, just modify every browser to support hardware tokens out of the box. Being logged in simultaneously from multiple devices (like a computer and phone) is also problematic with hardware key storage.
- bdunbar 14y ago> Couldn't you have the keys on a device An issue with those is that's just one more thing to keep track of. And, hardware costs money, and that's just one more thing to keep any solution from being adopted.