Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
As an alternative to using passwords, customers could be provided with individual asymmetric-encryption key pairs (i.e. a private key with associated public key), which could be used to validate their identity on login.
Can someone tell me if this would be a good idea and what would be the disadvantages of this approach?
It's generally a good idea...
Asynchronous encryption comes with the advantage of not needing someone to remember a complex password. This is an upside because people tend to choose passwords that aren't complex or if they are forced to use passwords that are technically complex but are for real made up from their name, company name, some birth date and a random special char.
... But there are still some things you should think about.
Asynchronous encryption requires awareness too
You can of course give someone a pair of keys and a software that uses these keys but this won't make the connection more secure in any case. This is because in asynchronous encryption you need to keep the private key private but most people out there don't even know what asynchronous encryption is and they for sure don't know what a private key is and why they should hide it from other people. You need to educate them so they don't give the private key to anyone asking for it without knowing what it is or even putting it on a PC that is publicly accessible.
Asynchronous encryption needs to be implemented in a useable way
It relies on your audience if and how you can use it. If its mainly tech guys you can use it for sure and also in a way that requires some knowledge but if your audience is made up of people who think a String is a piece of underwear for women you might get in trouble using it.
You can observe this when it comes to online banking in the business area. Every time there is a new accountant who needs access to the online banking system they will call the IT guy because they aren't able to follow the instructions given by their bank to configure the client software which uses async encryption. So you'd better make it easy to exchange or update key pairs.
Assuming you are talking about SSH login, public key authentication is better approach given that you choose a strong password for private key and keep it safe.
Have a look at following links: https://serverfault.com/questions/334448/why-is-ssh-password-authentication-a-security-risk and Are passwordless SSH logins more secure?. I also found a great deal of explanation at http://zaman4linux.blogspot.in/2009/10/passphrase-less-authentication-and.html
The main disadvantage is that your users will still want to log in when they don't have access to their private key, because they've forgotten or mislaid the physical device on which it is stored. The great advantage of passwords is that they can in theory be kept in the user's head, so the user always has access to them. The more minor disadvantage is that users are no good at security, and will do things that risk the compromise of their private keys, such as using them on a shared computer.
