HACKER Q&A
📣 politician

Were SSH keys ever considered for browser authentication?


Was support for authenticating to websites using SSH keys ever considered by any of the standards bodies or browser vendors (esp. Firefox)? If so, is there any documentation or historical record of why support was never implemented?


  👤 gvb Accepted Answer ✓
Browsers already support certificate based authentication equivalent to SSH key based authentication. In practice, it is difficult to prevent (and impossible to detect) an unauthorized user from misusing the authentication either by stealing the browser certificate or simply using an unattended browser window for unauthorized access.

https://www.ssl.com/how-to/configuring-client-authentication...

https://medium.com/@sevcsik/authentication-using-https-clien...

And, if you click the links above, it is very cumbersome to set up.


👤 arthurcolle
Where would these keys be stored? In some browser-internal keystore? Or on your machine outside of the browser?

👤 franzwong
Something like fido?