Ask HN: Why do we still use passwords instead of public/private keys?

Re:Ask HN: Why do we still use passwords instead of public/p... by Artlav on Wednesday December 20, 2017 @05:04AM (#15968372)

Ideally, passwords are in the heads of users, not accessible from a device. A key would, necessarily, be stored on a device, easily stolen by viruses or by stealing the device.

Also, it takes more discipline and understanding to handle keys than it takes to handle passwords.

Practically, there is no salvation anyway.

[ Parent | on HN ]

Re:Ask HN: Why do we still use passwords instead of public/p... by hunter2_ on Wednesday December 20, 2017 @10:31AM (#15970375)

A user who is worried about theft of their private key could put a long [0] passphrase on it, but alas, the service provider who supports key auth can't enforce that keys be passphrase-protected [1]. A user who does this is effectively creating a 2FA requirement for their account. But to your second point, the onus is on the user which isn't ideal.

[0] It can be brute-forced offline -- https://security.stackexchange.com/questions/62455/find-pass... -- so unlike online password checking that can be rate-limited, length is essential.

[1] https://serverfault.com/questions/589680/disallow-ssh-keys-w...

[ Parent | on HN ]