3 ms·
Why isn't TLS client auth a turnkey solution for maintaining a single web session as a client moves between network segments?
by Abekkus 7y ago
Why isn't TLS client auth a turnkey solution for maintaining a single web session as a client moves between network segments?
- kelnos 7y agoAside from the fact that TLS client auth is currently a usability nightmare... well, it could be, but you'd be building that session-resume capability into a higher layer than would be ideal. Meaning that anything that isn't TLS would have to build their own session resumption system. Conceptually, you want to push things as low in the stack as is feasible.
- Abekkus 7y agoSession is a higher OSI layer than transport, and any secure session management would probably be as complicated as TLS in the end.