8 ms·

SSH-style login is still something I'd really fucking love. Much more secure way of logging in, easy protocol for storing multiple passwords, and easy authoriza

SSH-style login is still something I'd really fucking love. Much more secure way of logging in, easy protocol for storing multiple passwords, and easy authorization/deauthirzation of passwords/keys.

StavrosK 9y ago
Client TLS certs already exist, and they are a massive pain for the average user.
- vacri 9y ago
  I remember StartCom used client TLS certs, the only place where I ever saw them in use, and the browser workflow was certainly clunky. I'd hate to see a non-techie have to deal with it.
  - BenjiWiebe 9y ago
    They worked quite smoothly for me. I actually liked StartCom's login process.
- adrianratnapala 9y ago
  So I have heard of client TLS authentication, but does it exist for the web (I mean just in principle, not whether it is really used). That is, do browsers support it? The thing is, if it is a massive pain for average users, then that is an own-goal. Look at SSH: there is no certification chain there. All you do is generate a keypair and then (here's the awkward bit) magic the pubkey over to the server. It would be easy enough for a website to make pubkey installation a seamless part of the sign-on workflow.
  - tptacek 9y ago
    Yes, browsers have supported client certificates for decades and continue to today.
  - fragmede 9y ago
    It is a massive pain for average users but it's well supported by browsers is because big corporations have IT departments that provision (and admin) computers for their users, average or otherwise, and the provisioning process includes setting up client certs. So while browsers do support client certs, there has been very little effort to make them easy to install due to a chicken-egg situation. They're hard to use, so no one uses them, but no one (random sites on the Internet, that is) uses them for client auth because they're hard to use.
Sjoerd 9y ago
Token binding provides something like that. With token binding you have a private/public key pair for each site that supports it. An identifier is created from the public key and signed with the private key, to prove your identity. https://www.sjoerdlangkemper.nl/2017/07/05/prevent-session-hijacking-with-token-binding/ https://www.sjoerdlangkemper.nl/2017/07/05/prevent-session-h...

SSH-style login is still something I'd really fucking love. Much more secure way of logging in, easy protocol for storing multiple passwords, and easy authorization/deauthirzation of passwords/keys.

StavrosK 9y ago

Client TLS certs already exist, and they are a massive pain for the average user.

vacri 9y ago
I remember StartCom used client TLS certs, the only place where I ever saw them in use, and the browser workflow was certainly clunky. I'd hate to see a non-techie have to deal with it.
- BenjiWiebe 9y ago
  They worked quite smoothly for me. I actually liked StartCom's login process.
adrianratnapala 9y ago
So I have heard of client TLS authentication, but does it exist for the web (I mean just in principle, not whether it is really used). That is, do browsers support it? The thing is, if it is a massive pain for average users, then that is an own-goal. Look at SSH: there is no certification chain there. All you do is generate a keypair and then (here's the awkward bit) magic the pubkey over to the server. It would be easy enough for a website to make pubkey installation a seamless part of the sign-on workflow.
- tptacek 9y ago
  Yes, browsers have supported client certificates for decades and continue to today.
- fragmede 9y ago
  It is a massive pain for average users but it's well supported by browsers is because big corporations have IT departments that provision (and admin) computers for their users, average or otherwise, and the provisioning process includes setting up client certs. So while browsers do support client certs, there has been very little effort to make them easy to install due to a chicken-egg situation. They're hard to use, so no one uses them, but no one (random sites on the Internet, that is) uses them for client auth because they're hard to use.

Sjoerd 9y ago

Token binding provides something like that. With token binding you have a private/public key pair for each site that supports it. An identifier is created from the public key and signed with the private key, to prove your identity. https://www.sjoerdlangkemper.nl/2017/07/05/prevent-session-hijacking-with-token-binding/ https://www.sjoerdlangkemper.nl/2017/07/05/prevent-session-h...