2 ms·

Most of the day-to-day issues with certificate auth aren't actually problems with "the web", so much as they're broader user workflow or endpoint support issues

by akerl_ 8y ago

Most of the day-to-day issues with certificate auth aren't actually problems with "the web", so much as they're broader user workflow or endpoint support issues. Here's a couple: * How does a user log in from a new device? * Especially if they've lost / broken their original device? * What happens if users want to log in from a shared computer (think public library)? * Do all the OSes/browsers that users are using actually support certificate management and auth?

philjohn 8y ago
Hence using an HSM, e.g. something like a Yubikey. Of course, they can be lost or stolen, which is why certificate revocation is necessary, and they would need broad adoption among OS and browser vendors. Plus you still have the issue of proving your identity if it's lost/stolen.
- akerl_ 8y ago
  Hardware tokens don't really solve any of the problems I listed. You still have to deal w/ devices that don't do cert auth from a Yubikey (iOS being a great example), so as a site operator you don't get to avoid supporting new device / temp device workflows. Hardware tokens can allow individual power users to solve issues around multiple devices, lost devices, etc themselves, but unless you're suggesting porting 100% of users to hardware tokens, it doesn't change the workflows a site must support.
  - jrockway 8y ago
    I believe Yubikeys work from iOS now. I have not tried it, however.
leppr 8y ago
Message signing with CryptoCurrency wallets (especially those that integrate with the browser like web3.js compatible ones e.g. Metamask), might be a good avenue in the future, as these tools may become widespread for other reasons, yet also fix web authentication in the process. Users would find the process of moving their identity on different devices tedious, but if that allows them to synchronize their whole digital lives, it would seem worth the effort.

by akerl_ 8y ago

philjohn 8y ago

Hence using an HSM, e.g. something like a Yubikey. Of course, they can be lost or stolen, which is why certificate revocation is necessary, and they would need broad adoption among OS and browser vendors. Plus you still have the issue of proving your identity if it's lost/stolen.

akerl_ 8y ago
Hardware tokens don't really solve any of the problems I listed. You still have to deal w/ devices that don't do cert auth from a Yubikey (iOS being a great example), so as a site operator you don't get to avoid supporting new device / temp device workflows. Hardware tokens can allow individual power users to solve issues around multiple devices, lost devices, etc themselves, but unless you're suggesting porting 100% of users to hardware tokens, it doesn't change the workflows a site must support.
- jrockway 8y ago
  I believe Yubikeys work from iOS now. I have not tried it, however.

leppr 8y ago

Message signing with CryptoCurrency wallets (especially those that integrate with the browser like web3.js compatible ones e.g. Metamask), might be a good avenue in the future, as these tools may become widespread for other reasons, yet also fix web authentication in the process. Users would find the process of moving their identity on different devices tedious, but if that allows them to synchronize their whole digital lives, it would seem worth the effort.