2 ms·
i.e., put a cookie on the site, and trust the cookie instead of the cert for all pages except the login one? That leaves you with all the usual problems of cook
by geofft 8y ago
i.e., put a cookie on the site, and trust the cookie instead of the cert for all pages except the login one? That leaves you with all the usual problems of cookie-based logins that certs are supposed to solve (revocation, risk of being stolen, etc.), and also if you want to do that you can just put a private key in localStorage and use WebCrypto on the login page. Or with username + no password + FIDO security key as your only factor, if you want a hardware token, or whatever. There's no advantage in using SSL for this.
- pmorici 8y agoThe point of the hardware token is that the credential never touches the PC. Putting a private key in local storage is no better than a user name and password because it leaves it open to theft. The most common problem that an everyday user faces is either a data breach on the service provider end or a virus / keylogger on their PC. Hardware tokens with certs solve both those problems in terms of account access.