4 ms·

It baffles me that no one else mentioned client certificates. That's like Crypto 101, but the author of this software seems unaware it even exists (it's not men

by zyx321 9y ago

It baffles me that no one else mentioned client certificates. That's like Crypto 101, but the author of this software seems unaware it even exists (it's not mentioned in the comparison on the GitHub page)

homakov 9y ago
I'm aware. It's the thing nobody uses. There's no need to compare with it. I'd rather add https://www.youtube.com/watch?v=VgC4b9K-gYU https://www.youtube.com/watch?v=VgC4b9K-gYU
- derefr 9y ago
  That's rather the point. If everyone is already using something, then the existing implementations are probably already near-optimal, so it's hard to do better and easy to do worse. You can expend a great deal of effort in such a space and—almost all of the time—all that effort will be for naught, because your solution will end up different but not necessarily strictly better for any particular use-case. On the other hand, if everyone agrees that a design is great in theory—but nobody is using it—then that suggests that all current implementations are crap—and so that's a great niche to innovate in. It's hard to do worse, and very easy to do better—and "doing better" is likely to turn "the thing nobody uses" into "the thing at least some people use", with your name stamped on the side in the process.
  - zyx321 9y ago
    >that suggests that all current implementations are crap Except the one time I've seen it in the wild, the implementation/UX was surprisingly good. Turns out Firefox can generate a cert entirely client-side and install it via Javascript. Chrome draws from whatever cert storage the underlying OS offers, so it should be as simple as saving the cert file to disk and opening it. Mobile might pose a problem. Would have to try it out.
  - homakov 9y ago
    > then that suggests that all current implementations Long story short entire concept of client certs is not as usable in terms of backups/enrollment as I want to, no matter how well dialogs are implemented.
    - derefr 9y ago
      > not as usable in terms of backups/enrollment as I want That's what I was referring to when I said "all current implementations are crap." A better implementation would change that (by e.g. having client certs sync in browser-sync like cookies do; and sync in the OS between devices like macOS keychains do.)
      - homakov 9y ago
        It's hard to just push your code into other browsers. Very slow process. We can't wait any longer

by zyx321 9y ago

homakov 9y ago

I'm aware. It's the thing nobody uses. There's no need to compare with it. I'd rather add https://www.youtube.com/watch?v=VgC4b9K-gYU https://www.youtube.com/watch?v=VgC4b9K-gYU

derefr 9y ago
That's rather the point. If everyone is already using something, then the existing implementations are probably already near-optimal, so it's hard to do better and easy to do worse. You can expend a great deal of effort in such a space and—almost all of the time—all that effort will be for naught, because your solution will end up different but not necessarily strictly better for any particular use-case. On the other hand, if everyone agrees that a design is great in theory—but nobody is using it—then that suggests that all current implementations are crap—and so that's a great niche to innovate in. It's hard to do worse, and very easy to do better—and "doing better" is likely to turn "the thing nobody uses" into "the thing at least some people use", with your name stamped on the side in the process.
- zyx321 9y ago
  >that suggests that all current implementations are crap Except the one time I've seen it in the wild, the implementation/UX was surprisingly good. Turns out Firefox can generate a cert entirely client-side and install it via Javascript. Chrome draws from whatever cert storage the underlying OS offers, so it should be as simple as saving the cert file to disk and opening it. Mobile might pose a problem. Would have to try it out.
- homakov 9y ago
  > then that suggests that all current implementations Long story short entire concept of client certs is not as usable in terms of backups/enrollment as I want to, no matter how well dialogs are implemented.
  - derefr 9y ago
    > not as usable in terms of backups/enrollment as I want That's what I was referring to when I said "all current implementations are crap." A better implementation would change that (by e.g. having client certs sync in browser-sync like cookies do; and sync in the OS between devices like macOS keychains do.)
    - homakov 9y ago
      It's hard to just push your code into other browsers. Very slow process. We can't wait any longer