I see no advantage.
Well, the difference is that if someone manages to steal the user password by observing the server software, they can later pretend to be the user as long as the user does not change the password. (Typically, the client sends the password over a TLS-encrypted connection. The server prepends/appends the salt it has stored to the password, and hashes the resulting plaintext, and compares the resulting hash to the hash stored along with the salt.)
No matter how thoroughly you observe what the server software does, you can't pretend to be the user, when public key pairs are used.
Most companies detect and react to intrusions into their machines rather quickly. It is the informing their users part that they fumble, because it is Bad For Business. With public key pairs, as soon as the server is re-secured,
future user information is safe. Nothing an attacker could find out on the server lets them pretend to be the user afterwards, unlike when passwords are used. With passwords, attackers might continue to have access to user information afterwards by pretending to be users, using passwords they observed being used while having access to the server, until users change their passwords.
But in most other ways, both passwords and halves of public keys can be considered as authenticating tokens: authentication is just verification of possession of the token.
Home
Help
Search
Login
Register
