4 ms·

That will happen - truefactor.io

• drdaeman 10y ago
  Sorry, this doesn't look attractive to me. Among the downsides I see, the important one is that it requires a whole new software stack. That had been tried many times - I'm afraid, unless you have some really huge corporation backing the project (one that can really push it), it just won't fly. What's good about TLS is that it's ubiquitous and you don't need anything special to deploy it. Got nginx, Apache or Caddy? Add a single directive (e.g. ssl_verify_client for nginx) and you're almost there, all the validation is already implemented, just tie the keys to your accounts system.
  • homakov 10y ago
    That software stack is made to fix previous problems. Backed up as a password, deterministic and scales easily. It is new (tiny and well thought through) API but nobody used client certs anyway, as we found out in this very thread.