Ask HN: Why hasn't the public key taken off as a general identity mgmt solution? | Hacker News Reader

Ask HN: Why hasn't the public key taken off as a general identity mgmt solution?

16 pointsgushogg-blake14 comments

Why don't more companies take advantage of existing mechanisms for authentication via public key, e.g. using SSH as a way to interface with SaaS/web services? Some reasons that come to mind are a) most people don't know how to create and share a public key and b) there isn't very good integration between public keys and browsers, which are obviously necessary to use services that have complex GUIs. But given the benefit of not having to rely on a third party identity provider like Google, why aren't there more people focused on solving those problems?

View on HN

The average user will always choose ease of use over strict security. Having to maintain your key files is asking a lot of people who can't even be bothered to use different passwords. Then what happens if their laptop dies and they lose their private key?

Something low friction, like Sign in with google/Facebook/github whatever, where somebody else manages your identity for you, is going to be much lower friction.

for saavy users, there is the question of trust to. Google owns too much of my life already that losing my personal gmail would be debilitating for my daily operations.

Same here. It's scary how much Google owns of my life.

I suppose it's a tradeoff. I can accept the small risk of a huge inconvenience (if my Google account were shut down) in exchange for the daily usefulness of Gcal, mail, docs, etc. I wish they'd just move to a paid plan.

Maybe it is paranoia on my end, but it’s not as small of a risk as it may seem. A couple of years ago, I attempted to pay for an app on Google Play, which didn’t work, so I tried a different payment method, but I put in my number wrong, and so I tried one more time, and on the third attempt, my entire Gmail was temporarily banned for a few days.

It was in that moment that I decided the risk was unacceptable and that I’d switch to my own domain for all emails. It’d just be so devastating losing access to my email.

Like WebAuthn or DID? People are working on it, it takes time, and we don't know if these will become popular or not.

I'd certainly like to log in with my yubikey

Thanks, I'll check out WebAuthn

https://news.ycombinator.com/item?id=31643917

https://developer.apple.com/documentation/authenticationserv...

I really thought Keybase had potential to take over this space. It was easy to set up, came with encrypted messaging and file storage, and gave end users ways to assert their identity that didn't rely on traditional certificate authorities. I wish they had found a way to make Keybase a sustainable business instead of selling to Zoom.

As a corollary to this, I often wonder how much companies could save on, for example, collaboration tools if they invested some time training their employees to use version control and file transfer utilities. Or am I biased by my own comfort level on a command line as a software dev, and this would actually be infeasible?

Google Docs and Drive solve those issues well enough for a lot of use cases and don't require the command line, much less Git.

I think, for the general non-IT crowd, exposing them to those systems is likely to cause more harm than good. Even most dev types struggle with using git effectively...

Key generation is trivial. Key management and distribution have its own issues and challenges.

At some level you start requiring certificate authorities (central trust). The DID-core W3C proposal seems to be putting down some of the pieces required to enable rolling your own identity authority. But it is still a long way to go even after around 4+ years.

One trouble with it is that it needs centralization to prove you are who you say you are.

I'm assuming the public key/SSH auth would be sufficient for that, after you'd shared your public key in a trusted setting (in person, over email, etc).

The public key by definition is public. For eg: the recipient needs to know that public key to validate a signature made with that public key.

The issue is if you are emailing a counterparty with whom you have no trust established yet, there is no way for them to trust your public key (or for you to trust their public key) unless you have somehow exchanged keys in a secure manner. This is the key distribution problem.

Certificate authorities help manage this by notarizing your public key with theirs and if the CA is trusted by the counterparty, they can use it to validate the public key is from you.

Having said that, it would be great if mobile operating systems had services that could support key notarization and if you could configure say 4-5 of your trusted contacts to act as notaries and they vouch for your public key automatically. With DID-core, this may become possible.

Reply on news.ycombinator.com