Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signing in to websites with SSH

vtllf.org

Post reply on HN
Print view View original

21–30 of 169 posts

Re: Signing in to websites with SSH

#21

Post by silon3 »

ams6110 wrote: post #15

I've worked in support of computing clusters that are widely used by researchers. By far the most common problem people had with using these systems was grokking ssh keys. Masters and PhD Computer Science people are routinely baffled by them, provide their private keys instead of their public keys, or provide both, etc. People in general just don't get public/private key pairs. Any solution that requires any awarenes…

Yup, it's not really specific to SSH. The same problems occur using SSL X509 client certificates. Non-technical users will get confused unless they have a smart card/token that secures their private key.

Re: Signing in to websites with SSH

#22

Post by ZoFreX »

ams6110 wrote: post #15

I've worked in support of computing clusters that are widely used by researchers. By far the most common problem people had with using these systems was grokking ssh keys. Masters and PhD Computer Science people are routinely baffled by them, provide their private keys instead of their public keys, or provide both, etc. People in general just don't get public/private key pairs. Any solution that requires any awarenes…

> provide their private keys instead of their public keys

I see this quite frequently from developers, as well. Hands down one of the worst design decisions of OpenSSH was to make private keys tab complete before public keys.

Re: Signing in to websites with SSH

#23

Post by a3_nm »

justinsb wrote: post #2

An SSH key is equivalent to a (self-signed) SSL client certificate. I would love to see an easy way to use your SSH key as a client certificate - either an external tool or the browser itself could support this.

There is a related project to connect the web of trust of OpenPGP keys, SSH keys, and SSL certificates: http://web.monkeysphere.info/

Re: Signing in to websites with SSH

#24

Post by geographomics »

derefr wrote: post #13
brutos wrote: post #11

Earlier quoted context omitted.

Have you ever used that? The user experience is horrible. Here [1] are a few more reasons why client certificate right now are just plain bad. [1] http://www.browserauth.net/tls-client-authentication

So why are people trying to replace the algorithm, when what we need to do is to replace the UX? Patches could be submitted for both Chromium and Firefox to give them a better client-cert flow, but I don't see anyone working on the problem; just a constant parade of restyling on tab-strip and toolbar and notification banner UX. I mean, ideally, a client cert would be treated pretty much exactly like a cookie: generat…

How is this better than using cookies? I don't really see the advantage of moving session identification down a layer.

Re: Signing in to websites with SSH

#25

Post by tormeh »

ams6110 wrote: post #15

I've worked in support of computing clusters that are widely used by researchers. By far the most common problem people had with using these systems was grokking ssh keys. Masters and PhD Computer Science people are routinely baffled by them, provide their private keys instead of their public keys, or provide both, etc. People in general just don't get public/private key pairs. Any solution that requires any awarenes…

It could work, but it's a bit hard to wrap your head around public/private keys. Cryptographic keys has to either be an everyday encounter or something we never do. I don't think such a weird thing can be anything in between.

Re: Signing in to websites with SSH

#26

Post by skratlo »

This is brilliant. Here a full-fledged solution: the same way every OS supports users, it should support identities attached to the user account (~/.ssh). Upon OS installation / user creation, it would prompt the user to either generate new identity, or import existing one (from a flash drive, from a cloud, etc.). This would be the key pair. And the browser would automatically use this, without any terminal session or any such non-sense. Brilliant, right? No, because user accounts are commonly shared: here, can I check my mail on your computer? Yes, password won again :P

Re: Signing in to websites with SSH

#29

Post by Sarien »

geographomics wrote: post #24
derefr wrote: post #13

Earlier quoted context omitted.

So why are people trying to replace the algorithm, when what we need to do is to replace the UX? Patches could be submitted for both Chromium and Firefox to give them a better client-cert flow, but I don't see anyone working on the problem; just a constant parade of restyling on tab-strip and toolbar and notification banner UX. I mean, ideally, a client cert would be treated pretty much exactly like a cookie: generat…

How is this better than using cookies? I don't really see the advantage of moving session identification down a layer.

It's better because your browser doesn't have a button to clear your ssh private keys. Cookies simply aren't meant for storing important data.

Re: Signing in to websites with SSH

#30

Post by jimktrains2 »

geographomics wrote: post #24
derefr wrote: post #13

Earlier quoted context omitted.

So why are people trying to replace the algorithm, when what we need to do is to replace the UX? Patches could be submitted for both Chromium and Firefox to give them a better client-cert flow, but I don't see anyone working on the problem; just a constant parade of restyling on tab-strip and toolbar and notification banner UX. I mean, ideally, a client cert would be treated pretty much exactly like a cookie: generat…

How is this better than using cookies? I don't really see the advantage of moving session identification down a layer.

A correctly done client cert provides mutual authentication (the server's ssl cert and priv key it had when you signed up with it is the one needed to sign in in the future).
Post reply on HN