I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing?
Let me explain why I am interested in this: When you register to a website, you don't know what happens with your password, it may very well be stored as plain text in a DB. Any admin can see your username/password combination (plus e-mail or any other information) and just try them in other services et voilà, clean access to your e-mail, Facebook, Stackoverflow, etc. The password, even if not stored, can be sent non-encrypted over the wire to the server and caugtht by a man in the middle. All this is easily solved using an approach like the one implemented by SSH, for instance (or having a different, password for every service, but my memory has severe limitations).
Therefore, how can I implement such a strategy for logging into a website? I couldn't find no browser extensions nor instructions on how to do it. For the time being, my objective is to have a website to serve ~10 people (colleagues, all in the same network) and whom I can convince to do some extra work (like installing an extension or generating the key pair).