3 ms·

You seem obsessed with one implementation. Passwords themselves are obsolete. Actually the problem is already solved for at least a decade: Certificate based a

You seem obsessed with one implementation. Passwords themselves are obsolete. Actually the problem is already solved for at least a decade: Certificate based authentication. Browsers support it. Try StartSSl registration, for example.

bigiain 10y ago
Yeah - but that's like saying "email security and integrity has been solved for two decades", while _technically_ true, how many of you have talked your mom through setting up PGP and had her then "just use it"? (or tried to handhold a less-than-technical colleague through getting a StartSSL account?) I'm pretty sure if any service less-technical than a CA authority starts pushing wide-spread user-driven in-browser certificate-based authentication, within days there'll be scammers and phishers faking the setup process to install untrustworthy ssl root certs so they can mitm Paypal/Facebook/everybody... How would _you_ explain to your mom the difference between installing Pinterest's new authentication certificate, and installing, say, the Charles Proxy ssl MITM cert?
- drdaeman 10y ago
  > How would _you_ explain to your mom the difference between installing Pinterest's new authentication certificate Actually, even with current terrible UIs, there's a reasonably big difference between installing client certificate (there even used to be a <keygen> HTML tag for those - although it's unsurprisingly marked as "deprecated" now) and trusted CAs.
- theandrewbailey 10y ago
  > (or tried to handhold a less-than-technical colleague through getting a StartSSL account?) I tried getting one myself a few years ago, and I couldn't. The process was too obtuse and obscure for me to follow along the entire way.
drdaeman 10y ago
Sadly, it's only theoretically solved. Browser vendors have refused to touch that for years, so everything PKI-related has a cryptic UI hidden beneath 3+ clicks deep in the most obscure settings dialog areas. And some pieces are completely missing, like session state management (it's just like with HTTP auth - there are hacks to implement it, but they're hacks). Another issue is, with current implementations not really fancying the idea of CA-less self-signed client certificates, so you'll most probably need a certificate-per-site approach. And with a ton of certificates (even if they all for the same public key), you'll need to automatically sync them to another devices somehow. (The usual reasoning for not doing anything I saw was "no one uses this". Sure thing, given it's barely usable.)
pjc50 10y ago
Client certificates tie the user to a specific device, which is terrible. It just moves the problem back to "account recovery".
- kodfodrasz 10y ago
  You can add multiple client sertificates to a single account for example in case of git hosting services. Why would it be impossible for other services?

bigiain 10y ago

Yeah - but that's like saying "email security and integrity has been solved for two decades", while _technically_ true, how many of you have talked your mom through setting up PGP and had her then "just use it"? (or tried to handhold a less-than-technical colleague through getting a StartSSL account?) I'm pretty sure if any service less-technical than a CA authority starts pushing wide-spread user-driven in-browser certificate-based authentication, within days there'll be scammers and phishers faking the setup process to install untrustworthy ssl root certs so they can mitm Paypal/Facebook/everybody... How would _you_ explain to your mom the difference between installing Pinterest's new authentication certificate, and installing, say, the Charles Proxy ssl MITM cert?

drdaeman 10y ago
> How would _you_ explain to your mom the difference between installing Pinterest's new authentication certificate Actually, even with current terrible UIs, there's a reasonably big difference between installing client certificate (there even used to be a <keygen> HTML tag for those - although it's unsurprisingly marked as "deprecated" now) and trusted CAs.
theandrewbailey 10y ago
> (or tried to handhold a less-than-technical colleague through getting a StartSSL account?) I tried getting one myself a few years ago, and I couldn't. The process was too obtuse and obscure for me to follow along the entire way.

drdaeman 10y ago

Sadly, it's only theoretically solved. Browser vendors have refused to touch that for years, so everything PKI-related has a cryptic UI hidden beneath 3+ clicks deep in the most obscure settings dialog areas. And some pieces are completely missing, like session state management (it's just like with HTTP auth - there are hacks to implement it, but they're hacks). Another issue is, with current implementations not really fancying the idea of CA-less self-signed client certificates, so you'll most probably need a certificate-per-site approach. And with a ton of certificates (even if they all for the same public key), you'll need to automatically sync them to another devices somehow. (The usual reasoning for not doing anything I saw was "no one uses this". Sure thing, given it's barely usable.)

pjc50 10y ago

Client certificates tie the user to a specific device, which is terrible. It just moves the problem back to "account recovery".

kodfodrasz 10y ago
You can add multiple client sertificates to a single account for example in case of git hosting services. Why would it be impossible for other services?