2 ms·

> Chrome stored my client cert from Startcom in a file in my home directory. I gather that you don't have a smart card attached to your system? This [0] indica

> Chrome stored my client cert from Startcom in a file in my home directory. I gather that you don't have a smart card attached to your system? This [0] indicates that Chrome uses Mozilla's NSS to store certificates. The documentation for NSS indicates that it's happy to work with certs stored on (or to store certs on) a smart card. :) Granted, the UI "sucks" for this, but that's part of my point. > I got the point about client certs being more convenient at the point of authentication. That's not what I was saying. Client certs are unguessable, the authenticating partner has no need to store any significant information about the cert, and certs typically rest in the most secure storage the OS can provide. [1] Certs are leaps and bounds safer than passwords. Right now, certs are typically harder to use than than passwords. > For client certs to have any hope of wide usage, the non authentication issues need to be solved... I'm not trying to be confrontational, but didn't you see that this was exactly what I was saying in my previous two comments? No need to write four 'graphs that largely restate what I already said. :) Thing is, if noone uses a thing, the UI for that thing will never get better. You frequently have to offer the thing as an option so that people will start using it before UI design teams will deign to make the UI for that thing better. > A trivial number of the people who get them right, also don't bother with PGP for email because that is even more painful. This is kind of a tangent, but: I guess those people don't use email clients that have adequate support for PGP. Enigmail makes key management, selection, and use trivial. [0] https://chromium.googlesource.com/chromium/src/+/master/docs/linux_cert_management.md https://chromium.googlesource.com/chromium/src/+/master/docs... [1] User mishandling notwithstanding.

rogerbinns 11y ago
> I'm not trying to be confrontational ... I am having trouble understanding what you are saying. The wording and tense seems to switch between what is really happening today, versus what could happen today given sufficient effort and implementation. I believe that other than small niches (eg startcom, some smartcard use in corporate and DOD), client certs are essentially unused by the vast majority of users. And I believe that even if everywhere accepted them, the logistical issues around ensuring a user has their certs in the relevant places are far too hard to overcome no matter how big the magic wand :-) > I gather that you don't have a smart card attached to your system? Nope. I could get the smart card reader when I buy Thinkpads, but don't. And I use Linux, Windows, Mac, Android and iOS. Having a smartcard reader on one machine wouldn't really help. > Certs are leaps and bounds safer than passwords. Only if the user is perfect. All it takes is them emailing it themselves, putting in Dropbox, being careless with backups or any number of other scenarios and it has the same "safety" as a password. (That is assuming your magic wand doesn't appear and somehow put smart card readers in every device overnight. :) > Enigmail makes key management, selection, and use trivial. Enigmail is indeed exactly what I use. Your statement above is true, but doesn't address the big picture. Every time I install a new system, I have to do copious amounts of googling to figure out exactly where my certs are installed, and then copy them over to the new machine, and get them imported. I'm never sure if I have done it right, haven't left myself open to compromise etc. A somewhat distant friend works in security, and once asked several people to email him their public keys. Virtually every response was a private key. We've had decades of certs for PGP, everyone using it wants to be secure, and everyone wants it to be better and "user friendly". The effort has been a dismal failure.

rogerbinns 11y ago

> I'm not trying to be confrontational ... I am having trouble understanding what you are saying. The wording and tense seems to switch between what is really happening today, versus what could happen today given sufficient effort and implementation. I believe that other than small niches (eg startcom, some smartcard use in corporate and DOD), client certs are essentially unused by the vast majority of users. And I believe that even if everywhere accepted them, the logistical issues around ensuring a user has their certs in the relevant places are far too hard to overcome no matter how big the magic wand :-) > I gather that you don't have a smart card attached to your system? Nope. I could get the smart card reader when I buy Thinkpads, but don't. And I use Linux, Windows, Mac, Android and iOS. Having a smartcard reader on one machine wouldn't really help. > Certs are leaps and bounds safer than passwords. Only if the user is perfect. All it takes is them emailing it themselves, putting in Dropbox, being careless with backups or any number of other scenarios and it has the same "safety" as a password. (That is assuming your magic wand doesn't appear and somehow put smart card readers in every device overnight. :) > Enigmail makes key management, selection, and use trivial. Enigmail is indeed exactly what I use. Your statement above is true, but doesn't address the big picture. Every time I install a new system, I have to do copious amounts of googling to figure out exactly where my certs are installed, and then copy them over to the new machine, and get them imported. I'm never sure if I have done it right, haven't left myself open to compromise etc. A somewhat distant friend works in security, and once asked several people to email him their public keys. Virtually every response was a private key. We've had decades of certs for PGP, everyone using it wants to be secure, and everyone wants it to be better and "user friendly". The effort has been a dismal failure.