3 ms·
I would argue that using a client certificate would be a much more practical way for web authentication. This would eliminate the need to start a SSH session wh
by joopxiv 11y ago
I would argue that using a client certificate would be a much more practical way for web authentication. This would eliminate the need to start a SSH session when trying to login.
- detaro 11y agoMy university uses client certs for some services. It's a pain with tons of odd error cases. With a technical user base, this might actually have better worst-case experiences (but worse average-case, when client-side certs work and you always use one machine they are smooth). It would be awesome if YubiKeys or other SmartCard-like devices were more widespread and better supported in browsers, because it would make client-cert workflows way easier. It's really mostly an UX issue.
- joopxiv 11y agoI can agree with this, but I think the hardware tokens compared to regular client certificates have the same issue: better average case (if it works it much easier to use it on multiple machines) but worse worst-case (a missing driver will completely shut you out).
- detaro 11y agoIt should be possible to build tokens that work without special drivers, requiring "just" application support. (Many 2FA tokens emulate HIDs/keyboards)