> If a machine is compromised is a client cert really any better than a cookie? I'd say that currently, it's actually worse. At least a cookie can be easily i

> If a machine is compromised is a client cert really any better than a cookie? I'd say that currently, it's actually worse. At least a cookie can be easily invalidated and regenerated, and typically expires after a relatively short time. Invalidating a cert is easy enough from the server side -- just stop accepting it. But how do you invalidate it and regenerate a new one on the client side? Well, currently, you ask the user to go into scary menus and do scary operations to delete the existing one. Then you can request the browser to generate a new one. I think this is exactly the heart of the question that the article is asking. How do we make certificates a better form of authentication cookies?