Pubkey Authentication for the Web

The dominant form of authentication on the web is passwords. Has public key authentication ever been realized? I would imagine out of convenience, the browser will have to play a hands-on role here, where the web server sends a challenge to sign some payload, that the browser does automatically. Currently the most impact from a data breach are leaked passwords, which would be useless to authenticate if services only had public keys. The highest danger I see is fingerprinting based on the same pubkey leaked from mutliple services, which would be mitigated by generating a subkey on your keyring for each website, though surveillance capitalism is probably much more problematic even without mitigations. What are everyone's thoughts on this? I see the GnuPG user manual has a few vague references to a browser socket -- has this been realized before? If you had it your way, how should services figure out whether you control your identity?

>>19314 I've made exactly this as a prototype before. The server sends a request to the user to sign some random string with their private key, the user inputs the signature and sends it to the server, the server then verifies the signature and lets the user through.

>>19315 This is exactly what I was thinking. Did you use this challenge for a website, or something else? I wonder if it could be made stateless like a JWT -- the challenge could be some server-signed text that includes a challenge expiration date, the user who wants to authenticate (or maybe smart-detect based on pubkey creds?) and a random number chucked in there for good measure. I'm not sure how pubkey challenges are given in practice right now. I expect it's stateful since the server giving the challenge is usually the one verifying it too -- load balancers and other tools for behemoth websites wouldn't exist at that level.

there's similar thing for gemini pleroma frontend

>>19316 I think I used it once on my personal website as a login for editing blog articles but I've replaced my entire website a while ago. I hope someone creates a better solution than I did. >>19318 Totally forgot gemini already had client-server public key authentication, maybe something to look into.

>>19314 Yes. Public key authentication has been present in browsers since forever. Nobody really uses it though. https://www.ssl.com/how-to/configuring-client-authentication-certificates-in-web-browsers/

there is already an entire internet built around this concept called Zeronet

>>19314 yeah it's in X.509 but it's the most braindamaged b oo mer garbage on earth like every part of X.509 and you might as well just use passwords at that point

>>19314 You mean like this? https://webauthn.io/ It's a good idea but it's new and almost nobody wants to bother implementing it.

>>19314 Web3 dapps are all built on pubkey authentication. Your wallet address is your public key. This is one of the things I love about web3. No need to create accounts or link any personal information. Just click "connect" and select the pseudonymous wallet address you want to use, and you're in.

>>19468 >Web3 dapps are all built on pubkey authentication. Your wallet address is your public key. This is basically the thing that brought pub key auth to the masses. I think building off of it becomes better >>19468