6

As an alternative to using passwords, customers could be provided with individual asymmetric-encryption key pairs (i.e. a private key with associated public key), which could be used to validate their identity on login.

Can someone tell me if this would be a good idea and what would be the disadvantages of this approach?

4
  • Are you talking about Password-less SSH login? – Krishna Pandey Jan 13 '16 at 18:43
  • In short, it's inconvenient. Being suitable for the human mind is the only advantage of passwords that I can think of. – Arminius Jan 13 '16 at 18:54
  • I think this question needs some clarification. Are you talking about SSH? SSL? A custom protocol? – Neil Smithline Jan 13 '16 at 19:02
  • I'll note that this method will still require TLS/SSL to ensure the key is delivered to only the client that requested the account and the server for authentication, otherwise it would be trivial to intercept and login as the client in the same way a plaintext password sent to a server would be. – sethmlarson Jan 13 '16 at 20:09
4

It's generally a good idea...

Asynchronous encryption comes with the advantage of not needing someone to remember a complex password. This is an upside because people tend to choose passwords that aren't complex or if they are forced to use passwords that are technically complex but are for real made up from their name, company name, some birth date and a random special char.

... But there are still some things you should think about.

Asynchronous encryption requires awareness too

You can of course give someone a pair of keys and a software that uses these keys but this won't make the connection more secure in any case. This is because in asynchronous encryption you need to keep the private key private but most people out there don't even know what asynchronous encryption is and they for sure don't know what a private key is and why they should hide it from other people. You need to educate them so they don't give the private key to anyone asking for it without knowing what it is or even putting it on a PC that is publicly accessible.

Asynchronous encryption needs to be implemented in a useable way

It relies on your audience if and how you can use it. If its mainly tech guys you can use it for sure and also in a way that requires some knowledge but if your audience is made up of people who think a String is a piece of underwear for women you might get in trouble using it.

You can observe this when it comes to online banking in the business area. Every time there is a new accountant who needs access to the online banking system they will call the IT guy because they aren't able to follow the instructions given by their bank to configure the client software which uses async encryption. So you'd better make it easy to exchange or update key pairs.

1
  • 2
    asymmetric not asynchronous. And to be exact asymmetric cryptography not asymmetric encryption, because asymmetric encryption does not authenticate anybody. – dave_thompson_085 Jan 14 '16 at 7:38
2

Assuming you are talking about SSH login, public key authentication is better approach given that you choose a strong password for private key and keep it safe.

Have a look at following links: https://serverfault.com/questions/334448/why-is-ssh-password-authentication-a-security-risk and Are passwordless SSH logins more secure?. I also found a great deal of explanation at http://zaman4linux.blogspot.in/2009/10/passphrase-less-authentication-and.html

2

The main disadvantage is that your users will still want to log in when they don't have access to their private key, because they've forgotten or mislaid the physical device on which it is stored. The great advantage of passwords is that they can in theory be kept in the user's head, so the user always has access to them. The more minor disadvantage is that users are no good at security, and will do things that risk the compromise of their private keys, such as using them on a shared computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.