6

Most of the time you access Linux machines you'll use SSH with a private key. You add your public key to ~/.ssh/authorized_keys and done, you can login using your private key and passphrase.

To serve HTTPS traffic, you use your private key to create a certificate signing request. You submit the request to a certificate authority and receive a certificate in return. The certificate is basically a stamp of approval on your private key.

Today I noticed that the certificate authority I use (http://startssl.com/) also acts as an OpenID provider. If I log on to Stack Overflow using https://yourname.startssl.com, I can log on using just my private key, just like an SSH server.

It seems really easy to use. One time import of the certificate, and no need to remember the password unless you reinstall the machine.

Is this way of logging on a good idea?

Improve this question
4

1 Answer 1

Reset to default
5

I think it is a good idea. As long as your browser is secure there is no problem. This is exactly what OpenID was meant to be: a way for you to choose your security level.

I have thought about setting up my own OpenID provider which could log me in automatically for example if I'm on my home computer. Other means of authorization may be to require a fingerprint, two different passwords or perhaps sending out an SMS code which you must provide as proof that you have the phone associated with the account. All this is possible without Stack Exchange intervention and I think it opens up for great freedom once OpenID is in more widespread use!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .