What I don&#x27;t understand about authentication over HTTPS is, though, why not making login a part of the protocol? Wouldn&#x27;t it be much better to authenticate a user with a public key of the user like in SSH, instead of password authentication over the public key of the server? It&#x27;d be more resistant to attacks such as MITM or stealing the private key of the server. If a user can register a password on a website, why does it have to be a password rather than a public key? The only hindrance is the fact that the protocol doesn&#x27;t support it.<p>I have no idea why this easy change hasn&#x27;t been made in the protocol.