4 ms·

Uhh, what's this about? https://i.imgur.com/e3kNYTH.png https://i.imgur.com/e3kNYTH.png

by amiga-workbench 8y ago

captn3m0 8y ago
Link, in case someone wants to dig further. https://nsa.dod.afpims.mil/ https://nsa.dod.afpims.mil/
- hermitdev 8y ago
  403'd for me...was forced from https to http for some reason (on mobile with JS disabled - maybe a factor?).
- richardwhiuk 8y ago
  I get: > You cannot visit nsa.dod.afpims.mil at the moment because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later.
mcpherrinm 8y ago
I haven't worked at US government so I am not 100% sure of the details, but this is my understanding: HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend. It is less commonly used for people to authenticate to servers. In particular, the "Common Access Card" is the ID badge used by the DoD, various parts of the armed forces, and in particular the NSA (whose website this is). Those access cards have a key and certificate usable for this. So your keyboard (or laptop) has a smartcard reader in it, and you can insert your ID badge (maybe with a PIN? not sure if usa gov't does that) to log into any website. Browser UX for this isn't great. Unlike the newer Webauthn specs where javascript (and thus site-specific instructions) can ask you to log in, the browser has to prompt you in a very generic way to present your certificate.
- unknownknowns 8y ago
  Client certificate PKI is common in this space. Even if it's just a local cert on the user's profile, it works really well as SSO.
- Godel_unicode 8y ago
  I actually prefer the browser UX for client cert authentication; since it's presented by the browser it's harder to do nefarious things with JavaScript to confuse the user as to what site is requesting authentication. Edit: for what it's worth, the executive agencies are all required to use PIV (essentially civilian CAC) to authenticate, and those PIVs are required to have significant physical controls including requiring a PIN for access. It's a pretty robust way of enforcing 2fa.
- amiga-workbench 8y ago
  Thanks for the info, I had no idea this was possible. I'm tempted to give it a go on my site.

Uhh, what's this about? https://i.imgur.com/e3kNYTH.png https://i.imgur.com/e3kNYTH.png

captn3m0 8y ago

Link, in case someone wants to dig further. https://nsa.dod.afpims.mil/ https://nsa.dod.afpims.mil/

hermitdev 8y ago
403'd for me...was forced from https to http for some reason (on mobile with JS disabled - maybe a factor?).
richardwhiuk 8y ago
I get: > You cannot visit nsa.dod.afpims.mil at the moment because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later.

mcpherrinm 8y ago

I haven't worked at US government so I am not 100% sure of the details, but this is my understanding: HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend. It is less commonly used for people to authenticate to servers. In particular, the "Common Access Card" is the ID badge used by the DoD, various parts of the armed forces, and in particular the NSA (whose website this is). Those access cards have a key and certificate usable for this. So your keyboard (or laptop) has a smartcard reader in it, and you can insert your ID badge (maybe with a PIN? not sure if usa gov't does that) to log into any website. Browser UX for this isn't great. Unlike the newer Webauthn specs where javascript (and thus site-specific instructions) can ask you to log in, the browser has to prompt you in a very generic way to present your certificate.

unknownknowns 8y ago
Client certificate PKI is common in this space. Even if it's just a local cert on the user's profile, it works really well as SSO.
Godel_unicode 8y ago
I actually prefer the browser UX for client cert authentication; since it's presented by the browser it's harder to do nefarious things with JavaScript to confuse the user as to what site is requesting authentication. Edit: for what it's worth, the executive agencies are all required to use PIV (essentially civilian CAC) to authenticate, and those PIVs are required to have significant physical controls including requiring a PIN for access. It's a pretty robust way of enforcing 2fa.
amiga-workbench 8y ago
Thanks for the info, I had no idea this was possible. I'm tempted to give it a go on my site.