4 ms·

I love mTLS a lot more than the average bear[0], but the main reason I see companies deploy SSO is centralized access control and access management (particularl

by lvh 7y ago

I love mTLS a lot more than the average bear[0], but the main reason I see companies deploy SSO is centralized access control and access management (particularly for offboarding), which client certs are only a tiny fraction of. Since they're typically long-held, you're now proposing either a rigorous revocation scheme or continuous reissuance, and neither seems to be deployed anywhere outside of maybe the DoD. (And Gemini? Maybe?) So: as much as I'd love that to be the case, I don't think that we're "iOS' UX for client certs" away from that being a plausible replacement. [0]: Thomas Pornin is far from average!

swiley 7y ago
Why are the people who left taking corporate devices with them? Or alternatively, why are you trusting new employees phones? That’s absolute insanity.
- lvh 7y ago
  They don't need to take a corporate device with them. They need to have exfiltrated a credential during the (long) time they had alone with the laptop. You trust new employees' phones the way you decided to trust anything else: a risk assessment based on what the company is willing to bear, taking into account compensating controls like MDM. Are you suggesting "no creds that live outside of trusted elements physically tied to a device we own" is an ubiquitous property of access management?
  - swiley 7y ago
    > no creds that live outside of trusted elements physically tied to a device we own. I’ve never worked full time at a software company that allowed credentials on employee personal devices. Supposedly because most consumers are up to their eyes in malware, often from the moment they buy the devices, not because the employees are untrustworthy (it would be difficult to have a functioning business where you can’t trust the employees.)
    - throwaway3157 7y ago
      I’m currently typing on a personal mobile device that is trusted by my software employer
    - lvh 7y ago
      You don't appear to have engaged with my core point: policy is not access control.
admax88q 7y ago
It really shouldn't be any more work to revoke a certificate or just maintain a whitelist/blacklist of certificates than it should be to just disable a user account. Certificates are only more difficult because nobody seems to have put in the effort to automate them, and client software hasn't put in any effort to make the experience nice.
- lvh 7y ago
  Even if we stipulate that's true: that's precisely my point, nobody has built the tooling to make any of it good, but companies need a reasonable access control story today.

by lvh 7y ago

swiley 7y ago

Why are the people who left taking corporate devices with them? Or alternatively, why are you trusting new employees phones? That’s absolute insanity.

lvh 7y ago
They don't need to take a corporate device with them. They need to have exfiltrated a credential during the (long) time they had alone with the laptop. You trust new employees' phones the way you decided to trust anything else: a risk assessment based on what the company is willing to bear, taking into account compensating controls like MDM. Are you suggesting "no creds that live outside of trusted elements physically tied to a device we own" is an ubiquitous property of access management?
- swiley 7y ago
  > no creds that live outside of trusted elements physically tied to a device we own. I’ve never worked full time at a software company that allowed credentials on employee personal devices. Supposedly because most consumers are up to their eyes in malware, often from the moment they buy the devices, not because the employees are untrustworthy (it would be difficult to have a functioning business where you can’t trust the employees.)
  - throwaway3157 7y ago
    I’m currently typing on a personal mobile device that is trusted by my software employer
  - lvh 7y ago
    You don't appear to have engaged with my core point: policy is not access control.

admax88q 7y ago

It really shouldn't be any more work to revoke a certificate or just maintain a whitelist/blacklist of certificates than it should be to just disable a user account. Certificates are only more difficult because nobody seems to have put in the effort to automate them, and client software hasn't put in any effort to make the experience nice.

lvh 7y ago
Even if we stipulate that's true: that's precisely my point, nobody has built the tooling to make any of it good, but companies need a reasonable access control story today.