Conversation

Notices

1. Embed this notice
   Janneke (janneke@todon.nl)'s status on Tuesday, 21-Jan-2025 23:14:22 JST Janneke

   Stupid question: I've been waiting for over 25y for websites to start supporting (something much like) ssh public-private key logins.

   Why isn't that happening?

   Yeah, there's all kinds of Facebook/Google login crap that's possibly even worse.

   Most of us have several passwords in public databases because web admins are apparently so incredibly stupid as to store passwords in plaintext.

   • Embed this notice
     Janneke (janneke@todon.nl)'s status on Wednesday, 22-Jan-2025 00:25:44 JST Janneke

     in reply to

     • wlo

     @wizard well, the technical know-how of how to use telnet or interpret HTML is also way above the head over normal computer users, yet they manage to send emails and view web pages? Probably because someone wrote a program to help them with that.

     I'm not saying that I expected that using a password should be removed as an option, I just don't understand why it seems there's no sane, (reasonably/much more) safe, free way being developed/adopted to log into websites.

   • Embed this notice
     wlo (wizard@xyzzy.link)'s status on Wednesday, 22-Jan-2025 00:25:47 JST wlo

     in reply to
     @janneke the technological know-how of managing encryption keys is way above the head of most computer users. backup and usage across multiple devices become exponentially more complicated than just asking people to remember a phrase in their head and emailing them if they can't do that.
   • Embed this notice
     wlo (wizard@xyzzy.link)'s status on Wednesday, 22-Jan-2025 01:20:14 JST wlo

     in reply to

     • wlo
     @janneke actually now that i look at it, there is some prior art for using a ssh key as a virtual fido device for webauthn: https://github.com/bulwarkid/ssh-passkey
   • Embed this notice
     wlo (wizard@xyzzy.link)'s status on Wednesday, 22-Jan-2025 01:20:15 JST wlo

     in reply to
     @janneke there are ways that work sort of like this though, like fido2 or u2f. i'm not actually super sure of any technical reason why an ssh key specifically couldn't be used in this case, but i think it mostly has to do with web standards and commonly adopted APIs to access that stuff. it would require support from every browser vendor to implement it.
     Janneke repeated this.
   • Embed this notice
     Janneke (janneke@todon.nl)'s status on Wednesday, 22-Jan-2025 01:21:21 JST Janneke

     in reply to

     • wlo

     @wizard interesting! Would be great to have that in #Mastodon!