3 ms·
I had a small discussion about this idea[1] and I believe that it is worthwhile: Make private key based authentication useful for logging in to websites. I don
by Bootvis 13y ago
I had a small discussion about this idea[1] and I believe that it is worthwhile:
Make private key based authentication useful for logging in to websites. I don't have the chops but introducing private key based auth as an extra can be very worthwhile for some users. So start there and improve the UI until your grandmother can use it.
I believe the biggest hurdle will be private key management. The advantage of using private keys for authenticating with web services that if the keys become unrecoverable the keys can actually changed by the service provider (after sufficient diligence).
[1]: https://news.ycombinator.com/item?id=7553882 https://news.ycombinator.com/item?id=7553882
- earthrise 13y agoSteve Gibson is working on a system called "SQRL" that does exactly that, and should be very usable: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm edit: forgot some words
- locacorten 13y agoCheck out virtual smart cards, a very cool feature: http://www.windowsecurity.com/articles-tutorials/authentication_and_encryption/Using-Virtual-Smart-Cards-Windows-8.html http://www.windowsecurity.com/articles-tutorials/authenticat...
- jlgaddis 13y agoYou know client certificates can be used for this, right?
- IanChiles 13y agoHaving spend the last week or so working with client certificates, they could be so much more if browsers implemented a proper interface for managing them, or at least a much more intuitive one than they do at the moment. They work spectacularly for building closed APIs where you control both sides, however. They're just a bit tricky for the end user most of the time
- Bootvis 13y agoYes, see the linked discussion. I think the hard part is getting people to use them.