4 ms·

Client-side certificates are pretty much a requirement within the U.S. DoD space. And the CAC (smartcard used for logins and ID) are widely deployed right now

Client-side certificates are pretty much a requirement within the U.S. DoD space. And the CAC (smartcard used for logins and ID) are widely deployed right now and used for authentication to such sites. To say that we need to do away with cert auth is a non-starter, given how much gov't buy-in and money has been used to roll these out. The real solution is to fix the support and standards in the various browsers to make all of these "issues" a moot point. If you've got a TRUSTED certificate authority (your definition of "trust" may vary) and secure key storage (PKCS#11 smartcard, etc.) then certificate-based authentication gives you a tremendous amount of authentication security.

geofft 11y ago
Well, the primary thing being deprecated right now is <keygen>, not certificate auth as a whole, so if you have a CAC you don't care about <keygen>. But also -- why does it make sense that any website on the public internet can potentially find your US-government-signed identity? That's not even a thing the government wants. You can just do logins against a single government-run service and limit authentication to that one origin, and have it produce signed, encrypted statements that you can pass to other authorized servers. And then you also get auditing, revocation, etc. through that single service.
- zrail 11y ago
  Typically you'd only insert your CAC on sites already trusted by your machine, and your machine only has those DoD certs if it's been provisioned by DoD.
  - geofft 11y ago
    What does it mean to insert it "on" a site? I have two dozen tabs open; how should Chrome know that my authentication information should go to the government but not to Hacker News? It seems to me like you necessarily want a custom solution and custom software here; I'm not understanding how the removal of client-cert support from public builds of Chrome or Firefox would be a problem. (I've never used a CAC, so this might be a dumb question.)
    - zrail 11y ago
      When you go to a DoD CAC-enabled site, typically you'll first see a click-wrapper page saying "This is a DoD site, blah blah perjury, prison, blah". This page will present a certificate signed with a DoD CA that only DoD-provisioned machines have. The DoD has a whole suite of CAs for different departments and security levels, which keeps things compartmentalized. When you click through, you'll be directed to a page that, via standard SSL, requests a client certificate which triggers the browser prompt. At this point, you insert your CAC and select the certificate it contains. After you enter your PIN to unlock the certificate, your browser sends your client cert back and the site verifies that your CAC was issued by the CAC CA and that it hasn't been revoked, then HTTPS proceeds as normal. The trick is that CAC certificates can't be used blindly, since you have to enter your PIN every time it gets used in a new session. Public sites can't just request a client cert without triggering the prompt and making you re-enter your PIN, and typically the CAC isn't inserted when you're not using DoD sites or on the DoD VPN.
  - pharaohgeek 11y ago
    Actually, the CAC is being used for desktop login into Active Directory in a lot (all?) cases, so it's reasonable to assume that the CAC is already in the reader when you fire up the web browser.

geofft 11y ago

Well, the primary thing being deprecated right now is <keygen>, not certificate auth as a whole, so if you have a CAC you don't care about <keygen>. But also -- why does it make sense that any website on the public internet can potentially find your US-government-signed identity? That's not even a thing the government wants. You can just do logins against a single government-run service and limit authentication to that one origin, and have it produce signed, encrypted statements that you can pass to other authorized servers. And then you also get auditing, revocation, etc. through that single service.

zrail 11y ago
Typically you'd only insert your CAC on sites already trusted by your machine, and your machine only has those DoD certs if it's been provisioned by DoD.
- geofft 11y ago
  What does it mean to insert it "on" a site? I have two dozen tabs open; how should Chrome know that my authentication information should go to the government but not to Hacker News? It seems to me like you necessarily want a custom solution and custom software here; I'm not understanding how the removal of client-cert support from public builds of Chrome or Firefox would be a problem. (I've never used a CAC, so this might be a dumb question.)
  - zrail 11y ago
    When you go to a DoD CAC-enabled site, typically you'll first see a click-wrapper page saying "This is a DoD site, blah blah perjury, prison, blah". This page will present a certificate signed with a DoD CA that only DoD-provisioned machines have. The DoD has a whole suite of CAs for different departments and security levels, which keeps things compartmentalized. When you click through, you'll be directed to a page that, via standard SSL, requests a client certificate which triggers the browser prompt. At this point, you insert your CAC and select the certificate it contains. After you enter your PIN to unlock the certificate, your browser sends your client cert back and the site verifies that your CAC was issued by the CAC CA and that it hasn't been revoked, then HTTPS proceeds as normal. The trick is that CAC certificates can't be used blindly, since you have to enter your PIN every time it gets used in a new session. Public sites can't just request a client cert without triggering the prompt and making you re-enter your PIN, and typically the CAC isn't inserted when you're not using DoD sites or on the DoD VPN.
- pharaohgeek 11y ago
  Actually, the CAC is being used for desktop login into Active Directory in a lot (all?) cases, so it's reasonable to assume that the CAC is already in the reader when you fire up the web browser.