Hacker News Reader

It’s not the same because you have to actually tell the websites your password, while with this, like with certificates, you only have to prove that you have access to the private key. So, if the server is hacked they don’t get a dump of encrypted passwords and if the hack persists they can’t sniff your password. Because the server never gets your password.

View on HN

But this is irrelevant if you use a password manager.

Not entirely. If I MITM your connection to a website that uses a password, I have access until the breach is detected. If I MITM a public/private key log in, I only have access to the session (which can be made arbitrarily short if logging in is painless/automatic).

But you can't, because TLS.

No, because if the server gets hacked and the attacker can intercept your password, your password manager is managing a password that is, unbeknownst to it, known to an attacker. Who can now use that password to just login to the service.

Reply on news.ycombinator.com