3 ms·

> it's impossible to do things like logging out, or using a public machine reasonably Both of those are really the same issue, and they boil down to 'only use

by wtbob 10y ago

> it's impossible to do things like logging out, or using a public machine reasonably Both of those are really the same issue, and they boil down to 'only use a browser instance you own to use a secure site, and don't share ownership of browser instances.' That seems pretty reasonable to me: indeed, anyone who uses a shared browser for private communications has already lost, badly. The upside of not logging out is never having to log in. You're correct about the pain of managing certs across devices.

vertex-four 10y ago
I occasionally have to use friends' devices to log into various sites, unfortunately.
- closeparen 10y ago
  My employer is deploying client certs to company-managed devices (transparently via config management) and requiring them to hit company internal tools precisely to thwart this behavior.
  - vertex-four 10y ago
    Wouldn't a simpler solution involve just putting the internal tools behind a VPN with cert login?
    - deleted 10y ago
      [deleted]
untog 10y ago
> anyone who uses a shared browser for private communications has already lost, badly. Indeed they have - many people rely on public libraries for internet access. I don't think we should disadvantage them any further.
geofft 10y ago
Threat model! You've only lost to other people who have previously had access to that computer. Sometimes those people aren't within your threat model. For instance, "a close friend impersonates me on HN" is pretty strongly outside my threat model. And as mentioned for people whose only computers are shared computers, "someone installs malware on the computer at my shelter and spies on my tax return" is a preferable outcome to "I don't file a tax return" (but we still have authentication, because both of those are still much better than "my abusive ex, who is not allowed in the shelter, spies on my tax return").
- pault 10y ago
  > For instance, "a close friend impersonates me on HN" is pretty strongly outside my threat model. You obviously haven't had the same kind of close friends that I've had.

by wtbob 10y ago

vertex-four 10y ago

I occasionally have to use friends' devices to log into various sites, unfortunately.

closeparen 10y ago
My employer is deploying client certs to company-managed devices (transparently via config management) and requiring them to hit company internal tools precisely to thwart this behavior.
- vertex-four 10y ago
  Wouldn't a simpler solution involve just putting the internal tools behind a VPN with cert login?
  - deleted 10y ago
    [deleted]

untog 10y ago

> anyone who uses a shared browser for private communications has already lost, badly. Indeed they have - many people rely on public libraries for internet access. I don't think we should disadvantage them any further.

geofft 10y ago

Threat model! You've only lost to other people who have previously had access to that computer. Sometimes those people aren't within your threat model. For instance, "a close friend impersonates me on HN" is pretty strongly outside my threat model. And as mentioned for people whose only computers are shared computers, "someone installs malware on the computer at my shelter and spies on my tax return" is a preferable outcome to "I don't file a tax return" (but we still have authentication, because both of those are still much better than "my abusive ex, who is not allowed in the shelter, spies on my tax return").

pault 10y ago
> For instance, "a close friend impersonates me on HN" is pretty strongly outside my threat model. You obviously haven't had the same kind of close friends that I've had.