4 ms·
Isn't the issue with PKI the 'I', rather than the PK? In the case of replacing passwords at a website, the issue of 'credibility' or 'trust' is irrelevant - yo
by count 13y ago
Isn't the issue with PKI the 'I', rather than the PK?
In the case of replacing passwords at a website, the issue of 'credibility' or 'trust' is irrelevant - you have no trust or credibility with a u/p, so why do you need that with a PK?
If I'm just replacing user/pass with a PK, why do I need a CA and all the infrastructure around that? The goal is to put something serverside that cannot be used against me elsewhere - a 'public' token that lets us communicate in secret.
The only concern is one of tampering, which would be a problem in either direction anyway.
- Spearchucker 13y agoMostly because you need the "I". Unless you start accumulating PKs as we do passwords. Some sites will require access revocation, others not. Some require known identities, others not. Unless an identity system is ubiquitous it won't gain widespread adotpion. For it to be adopted it needs to address every scenario that an identity meta system faces.
- count 13y agoWhy can't I just use the same PK everywhere? The whole point is it's not reversible to the Private key. Nothing else about how passwords are handled would have to change.
- qu4z-2 13y agoPublic key auth works pretty okay for ssh with a single keypair. I don't see why it wouldn't work for websites too. (As count also mentions) the entire point is that you can prove your identity without giving the entity you're proving to the ability to do the same.