make PGP key authentication more user-friendly

[lafleurdeboum]

Hello

I followed instructions at https://indielogin.com/setup#pgp and succeeded in uploading my public key to my website and linking it (I had to export it with gpg --export --armor --output key.txt lafleur@boum.org).

Now I'm trying to authenticate at https://indieauth.com/ ; the page presents a very rewarding green button called GPG. When I click on it, a popup tells me to "sign this text with my private key".

So I tried gpg --clearsign, pasting the text, hitting enter and then Ctrl-D, and got big block as follows :

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZSI6Imh0dHA6Ly93d3cubGFmbGV1ci5tYXJzbmV0Lm9yZy8iLCJwcm9maWxlIjoiaHR0cDovL3d3dy5sYWZsZXVyLm1hcnNuZXQub3JnL2xhZmxldXIua2V5LnR4dCIsInJlZGlyZWN0X3VyaSI6Imh0dHBzOi8vaW5kaWVhdXRoLmNvbS9zdWNjZXNzIiwic3RhdGUiOiIiLCJzY29wZSI6IiIsIm5vbmNlIjoyNTY2ODEsImNyZWF0ZWRfYXQiOjE2MDM0ODU3ODR9.kWy4heagPI-G2CHzA8Cko24GKvJ7smo8uZRovlXwcIU
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEbrTHqcZS5xuwcz+KSU4i7yXZm5QFAl+TQBwACgkQSU4i7yXZ
m5SDrAf/bqFJeSqyxfi9WHW0LHtCCiW11nGLb5yuyjhswk7rAvEKEss3gEU0Au2E
OyQG04fUHbexijkH3Ljj0FZYQ1EsTvOhjdufMcOtXhFTS2lfZuf8x3kNrQGVz6KZ
HVFsw9sP4x2MlJHh1NzsBNX8OVdN0RAh0KBXJx1YHeWgJza4XUzwe3cvHEreMyFw
fkA0PfJQbh3QUi3/IGrOxcBUVeoPTUK+vV5/D1CH2wjjPKVxGHQLH7H3WBlYqxGv
leWQoyUvQOwSzLTAtoYnEttY/XsJJE82Ysu+tMepSuSdlAiUEwlpJTrnomQCrpfn
ZQntiLpYEGTI7g0NxQ84HTv+kQwMww==
=aiXw
-----END PGP SIGNATURE-----

Alas, I was not able to log in, either pasting the whole block back in the popup, or pasting only the block between the ---BEGIN PGP SIGNATURE--- and the ---END PGP SIGNATURE---, or appending the same block after the text with the surrounding ---BEGIN and ---END (the three more obvious ways I could think of).

I think the popup should mention precisely what it's expecting. The site did succeed in guiding me until there quite nicely, but the PGP Verification popup is really under the level of accessibility that IndieAuth.com had achieved so far.

Hope this help in making the world a better place :-)

[aaronpk]

Thanks for the note! Have you tried the PGP option on indielogin.com? I don't remember if it's got the same usability problem you're describing here. indieauth.com is a different project and one that I'm eventually going to get rid of.

[lafleurdeboum]

Hello, I just tried indielogin.com and it seems more user-friendly to me. I was able to unlock the "Verify" button by pasting the whole gpg signing message, as returned by :     $ echo THE_PHRASE_TO_SIGN | gpg --clearsign But the UI fails saying "There was a problem ! Please go back to the application and try again". This error isn't very useful to me but that's still one step forward ! Just to be very explicit, I did produce my public key with the gpg command stated in the initial issue ; then I uploaded it to my site under `lafleur.key.txt`, and linked it in the body of the index page as such :     <a href="lafleur.key.txt" rel="pgpkey authn">PGP Key</a> Feel free to ask for any other information indeed Le vendredi 23 octobre 2020 à 14:22 -0700, Aaron Parecki a écrit :

…

Thanks for the note! Have you tried the PGP option on indielogin.com? I don't remember if it's got the same usability problem you're describing here. indieauth.com is a different project and one that I'm eventually going to get rid of. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[mmm111mmm]

I'm still having this problem with indielogin.com.

I paste in the result of echo THE_PHRASE_TO_SIGN | gpg --clearsign with a key that is rsa3072.

And the resultant page, in both firefox and chrome, after trying multiple times, says:

The session expired

Can anyone help?

(indieauth.com works fine stragely...)

[u0nel]

I'm always using echo THE_PHRASE_TO_SIGN | gpg --sign --armor

[AndrewKvalheim]

I’ve just tried using IndieLogin.com for the first time and also am getting stuck at:

There was a problem!

I’m sure there is a problem but I have no idea what it is.

[sp1ff]

Setup pgp authn on indieauth.com just fine. Here I'm just told "the session expired".

[aaronpk]

Sorry, I'm having trouble getting things working with PGP keys so I'm just disabling it entirely for now.