Re:Cutting the Gordian Knot of Web Identity
by lsc on Tuesday September 06, 2011 @10:33AM
(#2965715)
wouldn't some sort of public-key auth largely solve the problem of authenticating a user? I mean, I could give every site I use the same public key without worrying that they could then impersonate me to other sites.
Assuming I give them the public key rather than relying on some sort of CA system, we've also removed the problems inherent to authenticating through a third party.
As far as I can tell, the only problem with this approach is poor browser support. To my knowledge, the only public key systems that have wide browser support are tied up with certificate authorities and other stuff for actually verifying a real identity, which is a separate (and much more difficult) problem. It seems to me that if we just had something that worked like OpenSSH public keys that worked in a web browser, we'd at least have solved the problem of coming up with secure passwords for every site.
Assuming I give them the public key rather than relying on some sort of CA system, we've also removed the problems inherent to authenticating through a third party.
As far as I can tell, the only problem with this approach is poor browser support. To my knowledge, the only public key systems that have wide browser support are tied up with certificate authorities and other stuff for actually verifying a real identity, which is a separate (and much more difficult) problem. It seems to me that if we just had something that worked like OpenSSH public keys that worked in a web browser, we'd at least have solved the problem of coming up with secure passwords for every site.