ssh3

Everything you've said is true for web authentication, and almost nothing of what you said is true for HTTP authentication. This is HTTP authentication: https://httpd.apache.org/docs/2.4/mod/mod_auth_basic.html https://github.com/francoismichel/ssh3/blob/5b4b242db02a5cfb... https://www.iana.org/assignments/http-authschemes/http-auths... Note the OAuth listed there is OAuth 1.0. Support for "native" HTTP authentication was removed in OAuth 2.0. This discussion is about using HTTP authentication. I specifically said HTTP authentication in the root post. If you want to do SSH + web authentication, that's a different thread. Rule of thumb: if you need HTML in any step of it —and that includes as part of generating a token— it's web auth, not HTTP.

> This seems like dubious statement. SSH authentication does not need to be key based. Let's say you just use an ID Token as a bearer token to authenticate to SSH. The SSH server now has the secret you used to authenticate with. Doesn't this introduce replay attacks where the SSH server can replay your ID Token to log into other SSH servers? Whereas if your ID Token functions like a "certificate" issued by your IDP binding your identity to a public key, it is no longer a secret. You can just use your public key to prove you are you. No secrets leave your computer. My motto: always use public key rather than a bearer secret if possible. > I understand the practicality of their approach, but I would have preferred this to be proper first-class authentication method instead of smuggling it through publickey auth method Me too. I have a PR op

>However, we cannot yet endorse its appropriateness for production systems without further peer review. [0] Not an alternative and won't be for the foreseeable future. [0]: https://github.com/francoismichel/ssh3?tab=readme-ov-file#-s...

You might want to check out my project OpenPubkey[0] with uses OIDC ID Tokens inside SSH certs. For instance this let's you SSH with your gmail account. The ID token in SSH certificate expires after a few hours which makes the SSH certificate expire. You can also do something similar with SSH3 [1]. [0] OpenPubkey - https://github.com/openpubkey/openpubkey/ [1] SSH3 - https://github.com/francoismichel/ssh3

There is now an open issue: https://github.com/francoismichel/ssh3/issues/79