5 ms·

Because it's not user friendly? Especially across devices

tex0 10y ago
It's also not very developer/ops friendly. Quite hard to set up currently. Not that this couldn't be fixed (as the client side), but no one is doing this.
- drdaeman 10y ago
  Can you elaborate please? A simplest form (equivalent of basic auth, but secure) is mere "ssl_client_certificates file.pem; ssl_verify_client on;" or equivalent - one just have to tell "ask for certificate" and "here are my trusted issuers". I guess, the only thing that's probably lacking is pluggable modules for popular web frameworks (issuing certs and matching them to users in DB).
gnur 10y ago
I would argue the opposite, the only problem that has to be fixed is a method for distributing certificates, I use client certs for all my self hosted services, and a certificate is much more usable then typing passwords on any mobile device.
- dreistdreist 10y ago
  I don't even know how to install a cert on my phone in the first place, and I'm a programmer. Yes I could figure it out. But what about my grandmother? She can handle passwords, but definitely not certs.
cp9 10y ago
it's incredibly surprising that this isn't the top answer. even a hardware token like a yubikey or CAC has a bunch of problems and they are by far the "best" way to do something like this.
- lazylester 10y ago
  What problems do you see with yubikey? I just finished deploying an app with FIDO 2FA using yubikey and it went pretty well. Had to restrict users to Chrome, though, but in my scenario this wasn't a problem. My biggest problem was adapting my (rspec/capybara) integration test suite. Do you know of issues that I may not yet have seen?
  - cp9 10y ago
    well I mean for broad adoption, in particular. For example, you hit on one of them. Users want to use all different browsers, restricting people to Chrome isn't viable for plenty of reasons. I think the biggest problem is that I have an iPhone sitting next to me and no way to use a yubikey with it. Many (most?) Android phones are the same way.

tex0 10y ago

It's also not very developer/ops friendly. Quite hard to set up currently. Not that this couldn't be fixed (as the client side), but no one is doing this.

drdaeman 10y ago
Can you elaborate please? A simplest form (equivalent of basic auth, but secure) is mere "ssl_client_certificates file.pem; ssl_verify_client on;" or equivalent - one just have to tell "ask for certificate" and "here are my trusted issuers". I guess, the only thing that's probably lacking is pluggable modules for popular web frameworks (issuing certs and matching them to users in DB).

gnur 10y ago

I would argue the opposite, the only problem that has to be fixed is a method for distributing certificates, I use client certs for all my self hosted services, and a certificate is much more usable then typing passwords on any mobile device.

dreistdreist 10y ago
I don't even know how to install a cert on my phone in the first place, and I'm a programmer. Yes I could figure it out. But what about my grandmother? She can handle passwords, but definitely not certs.

cp9 10y ago

it's incredibly surprising that this isn't the top answer. even a hardware token like a yubikey or CAC has a bunch of problems and they are by far the "best" way to do something like this.

lazylester 10y ago
What problems do you see with yubikey? I just finished deploying an app with FIDO 2FA using yubikey and it went pretty well. Had to restrict users to Chrome, though, but in my scenario this wasn't a problem. My biggest problem was adapting my (rspec/capybara) integration test suite. Do you know of issues that I may not yet have seen?
- cp9 10y ago
  well I mean for broad adoption, in particular. For example, you hit on one of them. Users want to use all different browsers, restricting people to Chrome isn't viable for plenty of reasons. I think the biggest problem is that I have an iPhone sitting next to me and no way to use a yubikey with it. Many (most?) Android phones are the same way.