Comment by AlotOfReading
8 days ago
SSH doesn't prevent key sharing (and hence, phishing), so it's fundamentally different in the context of this discussion.
8 days ago
SSH doesn't prevent key sharing (and hence, phishing), so it's fundamentally different in the context of this discussion.
> ...sharing (and hence, phishing)
Sharing and phishing are on two different axes. You can have shareable credentials that are phishing-resistant when used.
You can have hardware-backed SSH keys that are not cloneable. You would need the browser to prevent phishing while still using SSH agent as its underlying signature mechanism (implied by my "in a consumer package").
Right, which is why Passkeys are consumer-minded enhancement to SSH keys in that browsers are asked to require that every domain gets a different passkey. I've seen SSH agents with that requirement, but yes very few users of SSH use more than one public key per device at a time, and many even use the same private key across multiple devices rather than enroll multiple SSH public keys.