3 ms·
Client certs have dire usability in browsers - it's impossible to do things like logging out, or using a public machine reasonably, managing certs across all yo
by vertex-four 10y ago
Client certs have dire usability in browsers - it's impossible to do things like logging out, or using a public machine reasonably, managing certs across all your devices is extremely difficult, etc etc.
BrowserID (Persona) solved some of these issues by issuing short-term certs to devices based on a login, and designing an API for logout, but even the organisation that specced it out (Mozilla) never integrated it into its browser, so it failed on usability grounds.
- wtbob 10y ago> it's impossible to do things like logging out, or using a public machine reasonably Both of those are really the same issue, and they boil down to 'only use a browser instance you own to use a secure site, and don't share ownership of browser instances.' That seems pretty reasonable to me: indeed, anyone who uses a shared browser for private communications has already lost, badly. The upside of not logging out is never having to log in. You're correct about the pain of managing certs across devices.
- vertex-four 10y agoI occasionally have to use friends' devices to log into various sites, unfortunately.
- closeparen 10y agoMy employer is deploying client certs to company-managed devices (transparently via config management) and requiring them to hit company internal tools precisely to thwart this behavior.
- vertex-four 10y agoWouldn't a simpler solution involve just putting the internal tools behind a VPN with cert login?
- deleted 10y ago[deleted]
- untog 10y ago> anyone who uses a shared browser for private communications has already lost, badly. Indeed they have - many people rely on public libraries for internet access. I don't think we should disadvantage them any further.
- geofft 10y agoThreat model! You've only lost to other people who have previously had access to that computer. Sometimes those people aren't within your threat model. For instance, "a close friend impersonates me on HN" is pretty strongly outside my threat model. And as mentioned for people whose only computers are shared computers, "someone installs malware on the computer at my shelter and spies on my tax return" is a preferable outcome to "I don't file a tax return" (but we still have authentication, because both of those are still much better than "my abusive ex, who is not allowed in the shelter, spies on my tax return").
- pault 10y ago> For instance, "a close friend impersonates me on HN" is pretty strongly outside my threat model. You obviously haven't had the same kind of close friends that I've had.
- Jtsummers 10y agoIf your certificates aren't stored in the clear (either passphrase secured or on a physical token), then you can solve the public machine problem and logging out. The next user has to know your passphrase or use it within a narrow time window (if the cert is on the system and not on a physical token). Logging in with a different account or role is handled by the browser asking which cert you want to use.
- vertex-four 10y ago> If your certificates aren't stored in the clear (either passphrase secured or on a physical token), then you can solve the public machine problem and logging out. Sure, but then you have to distribute physical tokens to people, and most people will not buy their own tokens. And once you've built a protocol to get a passphrase-secured cert from an arbitrary provider, you have the same problems the likes of BrowserID had with convincing browsers to adopt it. You also have to deal with building a protocol for updating certs as they expire, and other hard problems with key management.
- unscaled 10y agoThis! The UX is downright horrible, but the lack of logout functionality kills most of the extra security we get from client certs.