3 ms·

I would like to extend the question: is any startup/company working on something that would simplify the client certs process? Why haven't we really moved beyo

I would like to extend the question: is any startup/company working on something that would simplify the client certs process? Why haven't we really moved beyond password-based logins yet?

pisipisipisi 10y ago
Client certificates are doomed, looking into the future (think: keygen tag). Especially if you are using hardware tokens, and if you want to use them in TLS client authentication. We have been doing this for years in .ee, and the user experience has been mediocre. And this is something we can not fix (browser vendors can). The future promises to be FIDO, but then again, this is a different model, that mostly addresses authentication ONLY. I just started a weekend project to bring the hardware token based authentication to a state that it could be called "standardized", for the huge EU market, where very many citizens in different countries have a vetted PKI identity on the eID smart card. Might be of interest. https://github.com/martinpaljak/x509-webauth/wiki/WebAuth https://github.com/martinpaljak/x509-webauth/wiki/WebAuth The core of it is just a profile of OpenID Connect ID Token, with fresh browser extensions with native messaging support to facilitate actual communication to hardware tokens.
forgotpwtomain 10y ago
Why would we move to client-certs? You need to have a file and sync it between devices.. You might as well use a password manager and sync it between devices..
Rafert 10y ago
I am surprised nobody has mentioned the FIDO Alliance and its Universal 2nd Factor, or it's successor work by the W3C. They're actively working on 'killing passwords'. U2F originated from Google when they wanted better 2FA for their internal services and they partnered with Yubikey to create the hardware. In a two years study it has been shown to be faster to easy, less prone to user error and more secure[1]. It's basically a client cert on a USB stick, but the standards allow for forms of other hardware as well. U2F is a FIDO 1.0 standard, the 2.0 version is now being worked on by the W3C Web Authentication Working Group[2]. Microsoft has launched support for a draft of this spec in Windows 10 and Edge under the 'Windows Hello' banner[3]. [1]: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys... [2]: https://www.w3.org/blog/2015/11/w3c-fido/ https://www.w3.org/blog/2015/11/w3c-fido/ [3]: https://blogs.windows.com/msedgedev/2016/04/12/a-world-without-passwords-windows-hello-in-microsoft-edge/ https://blogs.windows.com/msedgedev/2016/04/12/a-world-witho...
- camillomiller 10y ago
  Geez, I even have a Yubikey and I didn't think of that. I use it so sporadically for my 2FA on gmail that it completely fell off of my mind...

I would like to extend the question: is any startup/company working on something that would simplify the client certs process? Why haven't we really moved beyond password-based logins yet?

pisipisipisi 10y ago

Client certificates are doomed, looking into the future (think: keygen tag). Especially if you are using hardware tokens, and if you want to use them in TLS client authentication. We have been doing this for years in .ee, and the user experience has been mediocre. And this is something we can not fix (browser vendors can). The future promises to be FIDO, but then again, this is a different model, that mostly addresses authentication ONLY. I just started a weekend project to bring the hardware token based authentication to a state that it could be called "standardized", for the huge EU market, where very many citizens in different countries have a vetted PKI identity on the eID smart card. Might be of interest. https://github.com/martinpaljak/x509-webauth/wiki/WebAuth https://github.com/martinpaljak/x509-webauth/wiki/WebAuth The core of it is just a profile of OpenID Connect ID Token, with fresh browser extensions with native messaging support to facilitate actual communication to hardware tokens.

forgotpwtomain 10y ago

Why would we move to client-certs? You need to have a file and sync it between devices.. You might as well use a password manager and sync it between devices..

Rafert 10y ago

I am surprised nobody has mentioned the FIDO Alliance and its Universal 2nd Factor, or it's successor work by the W3C. They're actively working on 'killing passwords'. U2F originated from Google when they wanted better 2FA for their internal services and they partnered with Yubikey to create the hardware. In a two years study it has been shown to be faster to easy, less prone to user error and more secure[1]. It's basically a client cert on a USB stick, but the standards allow for forms of other hardware as well. U2F is a FIDO 1.0 standard, the 2.0 version is now being worked on by the W3C Web Authentication Working Group[2]. Microsoft has launched support for a draft of this spec in Windows 10 and Edge under the 'Windows Hello' banner[3]. [1]: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys... [2]: https://www.w3.org/blog/2015/11/w3c-fido/ https://www.w3.org/blog/2015/11/w3c-fido/ [3]: https://blogs.windows.com/msedgedev/2016/04/12/a-world-without-passwords-windows-hello-in-microsoft-edge/ https://blogs.windows.com/msedgedev/2016/04/12/a-world-witho...

camillomiller 10y ago
Geez, I even have a Yubikey and I didn't think of that. I use it so sporadically for my 2FA on gmail that it completely fell off of my mind...