- Bob generates a key pair for this example.
Bob registers at example dot com where he provides his public key.
When Bob will try to log in, example dot com will ask him to sign a random string of a few characters with his private key.
- If the signature is successfully verified, it is indeed Bob (or Alice who stole Bob's private key, eh what can you do?) and access will be granted.
This sounds so simple. Why has this not been done before?