The state of client side authentication is abysmal, and has been since the 90s, for a number of reasons. The UI is bad, there's no way to log out, and the serve

The state of client side authentication is abysmal, and has been since the 90s, for a number of reasons. The UI is bad, there's no way to log out, and the server has no control of how and when dialogs pop up. Things started to go sideways when web developers wanted to exercise control over login form presentation, which just makes it very hard to prevent scripts to tamper with them, and the heavyweights that control web browser development simply has had no interest. I'd like to see the above implemented, it's also time to get SRP in there, and an opportunity for servers to serve pre-filled CSRs, just like the article describes. I just don't know how to get there. Perhaps the bigger institutions such as CERN (they certainly have the respect required) can take a more active part in web browser development. In the mean time, we still have Kerberos (and HTTP Negotiate). It works well for always online internal applications, and you don't have to mess about with revocations.