4 ms·
For SSH it's common to use private keys to communicate securely with servers using public key cryptography. This is convenient and protects against key loggers.
by Bootvis 13y ago
For SSH it's common to use private keys to communicate securely with servers using public key cryptography. This is convenient and protects against key loggers.
What are the possibilities of using public key cryptography in the browser? For example, I upload my public key to some website, create an account which is locked to my private key. I get the convenience of not having to log in manually and some extra safety.
- mikeash 13y agoI believe what you're describing is encompassed by SSL client certificates. They're supported, but roughly nobody uses them for some reason.
- Bootvis 13y agoWhat a shame, maybe now something will change. I won't miss typing in passwords at all.
- tjohns 13y agoStartCom is the only site I know of that uses them for user authentication. The biggest problem is that the client-side UI is rather confusing, and you still need a separate authentication system in case the user loses their certificate (or switches devices).
- mikeash 13y agoYou're right, I actually have an account with them and remember setting up the client-side certificate. I completely forgot about it afterwards. I would say that "rather confusing" is a deep understatement. The process, at least on the Mac, is atrocious and makes this method only suitable for the most advanced users, and even then only if you're willing to take on only the most enthusiastic.
- dfc 13y agoIt is possible and has been for some time. Like many other PKI systems it is a pain in the ass to configure on the server (atleast it was with apache) and teaching/getting users to generate keys is a nightmare.