Signing in to websites with SSH • Hacker News Board

Re: Signing in to websites with SSH

#31

Post by jasonkester » Fri, Jan 30, 2015, 1:29 PM UTC

"SSH is near-universally loved among developers."

Really? Which developers?

SSH is one of those things you get forced to deal with a couple times a year for some irritating task, and it involves firing up Putty, figuring out where you left your key file, trying to remember how to actually load that key file, and a bunch of following steps on some website just to get connected to what you were trying to connect to.

It is not something that I love.

If you force me to use it just to log in to your website, I will decline to do so.

Re: Signing in to websites with SSH

#32

Post by rakoo » Fri, Jan 30, 2015, 1:30 PM UTC

geographomics wrote: post #24

derefr wrote: post #13

Earlier quoted context omitted.

So why are people trying to replace the algorithm, when what we need to do is to replace the UX? Patches could be submitted for both Chromium and Firefox to give them a better client-cert flow, but I don't see anyone working on the problem; just a constant parade of restyling on tab-strip and toolbar and notification banner UX. I mean, ideally, a client cert would be treated pretty much exactly like a cookie: generat…

How is this better than using cookies? I don't really see the advantage of moving session identification down a layer.

Because HTTP is stateless and session-less, and cookies are a hack to make it stateful. We introduced the notion of a session where we already had one, in the form of TLS sessions.

Note that it would also make APIs much simpler by moving the authentification, authorization and session logic in the certificate, where it actually already is.

Re: Signing in to websites with SSH

#33

Post by neaanopri » Fri, Jan 30, 2015, 1:32 PM UTC

What does "PTY allocation request failed on channel 0" mean?

Re: Signing in to websites with SSH

#34

Post by Sarien » Fri, Jan 30, 2015, 1:32 PM UTC

jerinaw wrote: post #18

What about this solution? https://www.grc.com/sqrl/sqrl.htm

It's pretty much the same thing but using QR codes.

One thing that SQRL has is automatic management of different keys for each site. It wouldn't be hard to add that to the ssh version, though.

Using QR codes for getting the challenge is also nice because you can just read them with your phone on an untrusted computer.

Re: Signing in to websites with SSH

#35

Post by IgorPartola » Fri, Jan 30, 2015, 1:33 PM UTC

I am not sure about this. First, there is a built in MITM attack here. First time you connect to sshd, the server has no idea who you are. I suppose this could be mitigated by using HTTPS as the out-of-band channel for verifying client and server fingerprints. Second, ssh keys are somewhat limited. You can only have one public key for a private key. You cannot embed identity info in the public key. I would much rather see hog keys used for this. For developer types that should be just as easy. For real people the UI would still have to be developed but could actually include useful features, such as user identities.

Re: Signing in to websites with SSH

#36

Post by ddebernardy » Fri, Jan 30, 2015, 1:34 PM UTC

I'm suspicious that this is any better than TLS and client certificates.

Plus, it's not entirely clear what's supposed to happen when your family and friends are using your computer, or when your laptop is simply stolen.

Re: Signing in to websites with SSH

#37

Post by IgorPartola » Fri, Jan 30, 2015, 1:34 PM UTC

jasonkester wrote: post #31

"SSH is near-universally loved among developers." Really? Which developers? SSH is one of those things you get forced to deal with a couple times a year for some irritating task, and it involves firing up Putty, figuring out where you left your key file, trying to remember how to actually load that key file, and a bunch of following steps on some website just to get connected to what you were trying to connect to. It…

I think I found the Windows developer :). It is loved by pretty much everyone but Windows developers because it really is the best thing since sliced bread.

Re: Signing in to websites with SSH

#38

Post by IgorPartola » Fri, Jan 30, 2015, 1:35 PM UTC

ddebernardy wrote: post #36

I'm suspicious that this is any better than TLS and client certificates. Plus, it's not entirely clear what's supposed to happen when your family and friends are using your computer, or when your laptop is simply stolen.

Surely you passphrase protect your id_rsa!

Re: Signing in to websites with SSH

#39

Post by IgorPartola » Fri, Jan 30, 2015, 1:36 PM UTC

nodata wrote: post #17

slyley wrote: post #6

Wow. I just have one question for you: why? Have you ever heard of TLS and client certificates? Every browser and every decent web server supports TLS with a client certificate for auth.

Because client certificates have been around for donkeys years and almost nobody uses them. Even technical people! But technical people do use ssh keys .

Feels like the case for that XKCD about standards.

Re: Signing in to websites with SSH

#40

Post by bogdansolga » Fri, Jan 30, 2015, 1:38 PM UTC

IgorPartola wrote: post #37

jasonkester wrote: post #31

"SSH is near-universally loved among developers." Really? Which developers? SSH is one of those things you get forced to deal with a couple times a year for some irritating task, and it involves firing up Putty, figuring out where you left your key file, trying to remember how to actually load that key file, and a bunch of following steps on some website just to get connected to what you were trying to connect to. It…

I think I found the Windows developer :). It is loved by pretty much everyone but Windows developers because it really is the best thing since sliced bread.

I'll second to that :)