I see that password based authentication is out of favor today, and Internet is moving toward RSA keys-based authentication.
Coming from that fact, I am wondering if there would be a real benefit to widespread its use for regular websites? I see the usage as follows, and it's exactly the same as you would normally expect:
- When signing-up onto a web-resource, User's browser generates the public-private pair, as well as scope she/he is willing to give to this key (not
- Browser encrypts the private key, and User communicates the public key to the web-resource
For all other requests, User is automatically logged in thanks to the private key stored in browser. Note that the user could (should) also sign-in (sign-up) with a federated profile, and only this method would provide the
root/admin-like scope. This
root user will be able to revoke key-pairs if they are compromised.
Wouldn't it resolve the 'N passwords for N websites' problem which everyone is facing, since only 1 admin password exists (which is not known by the web-resource)?
Yes, I kinda feel like reinvening the wheel, and if this is so obvious, why nobody seems to use it?