3 ms·

If we're all going to use SSL to avoid attacks that Firesheep brought to the forefront, users can provide client certificates to different websites, managed on

If we're all going to use SSL to avoid attacks that Firesheep brought to the forefront, users can provide client certificates to different websites, managed on a per-user basis with a passphrase like pass managers work.

caf 16y ago
The problem with client certificates is that they reside in just one of your browsers - what happens when you want to log in from your girlfriend's PC? You need some method of authorising yourself at new locations, presumably rooted in a username/password somewhere, and you need the UI for that to be dead simple.
- thwarted 16y ago
  That same issue exists with a password manager, especially one that exists in the browser. Which is why I suggested client certs need to be managed in some portable manner. Since browsers have started using OS services for certificate management, the portability may be easier. The logging in from your girlfriend's PC is a valid use case, but that's the price you pay for not having to remember passwords. Alternatively, you have an account on your girlfriend's PC that has your certificate store in it. I don't envision the UI for this being any different than for a password manager. In fact, you don't even need more than one certificate, the same cert can be given to every website. Self-signed certs could be used as long as the website only allows login with a single certificate, the server could cache the certificate information as part of the "account" information and only ever allow a single certificate, in the same way ssh keys work (if ssh keys are secure enough is beyond the scope of this discussion). Or for the use-your-girlfriend's-pc scenario, you can bind multiple certificates, stored on different computers, with your account. Account recovery, in the event you need to change the certificate you use, would work just like password recovery, you assert you can't login, the site emails you a link to a page where you can tell it about your new certificate. This is no more or less secure than account recovery with passwords (where access to the email account is proof enough that you are who you are), but the main goal here is to assert to the website your authentication so you don't need to remember different passwords all over the place. I don't think we have a "dead simple" key/cert generation/store right now that would make this work for Joe User, but I think the backend technology is already there.
  - caf 16y ago
    I agree, the technology is there to do this (use client certificates for site login) exists today - StartSSL is one place that does this. The problem is essentially that moving your certificate store around is not a task that Joe User can accomplish, because the UI sucks. (Oh, and I also agree that this problem also exists for browser-based password stores). Build a better interface, and it might just work. For example, I should be able to roll up to a new browser, login to some "home site" (whether run by Apple, Google, Firefox or whoever) and use my single username/password to download a client certificate, that then authorises me to login to my accounts on Twitter, Facebook and so on. Ideally, I could request a time-limited temporary certificate, so that it becomes useless after I've gone.

caf 16y ago

The problem with client certificates is that they reside in just one of your browsers - what happens when you want to log in from your girlfriend's PC? You need some method of authorising yourself at new locations, presumably rooted in a username/password somewhere, and you need the UI for that to be dead simple.

thwarted 16y ago
That same issue exists with a password manager, especially one that exists in the browser. Which is why I suggested client certs need to be managed in some portable manner. Since browsers have started using OS services for certificate management, the portability may be easier. The logging in from your girlfriend's PC is a valid use case, but that's the price you pay for not having to remember passwords. Alternatively, you have an account on your girlfriend's PC that has your certificate store in it. I don't envision the UI for this being any different than for a password manager. In fact, you don't even need more than one certificate, the same cert can be given to every website. Self-signed certs could be used as long as the website only allows login with a single certificate, the server could cache the certificate information as part of the "account" information and only ever allow a single certificate, in the same way ssh keys work (if ssh keys are secure enough is beyond the scope of this discussion). Or for the use-your-girlfriend's-pc scenario, you can bind multiple certificates, stored on different computers, with your account. Account recovery, in the event you need to change the certificate you use, would work just like password recovery, you assert you can't login, the site emails you a link to a page where you can tell it about your new certificate. This is no more or less secure than account recovery with passwords (where access to the email account is proof enough that you are who you are), but the main goal here is to assert to the website your authentication so you don't need to remember different passwords all over the place. I don't think we have a "dead simple" key/cert generation/store right now that would make this work for Joe User, but I think the backend technology is already there.
- caf 16y ago
  I agree, the technology is there to do this (use client certificates for site login) exists today - StartSSL is one place that does this. The problem is essentially that moving your certificate store around is not a task that Joe User can accomplish, because the UI sucks. (Oh, and I also agree that this problem also exists for browser-based password stores). Build a better interface, and it might just work. For example, I should be able to roll up to a new browser, login to some "home site" (whether run by Apple, Google, Firefox or whoever) and use my single username/password to download a client certificate, that then authorises me to login to my accounts on Twitter, Facebook and so on. Ideally, I could request a time-limited temporary certificate, so that it becomes useless after I've gone.