29 ms·
There's no reason a browser couldn't have generated a new self-signed client certificate for each site, though; the fact that they don't offer that as an option
by ryukafalz 6y ago
There's no reason a browser couldn't have generated a new self-signed client certificate for each site, though; the fact that they don't offer that as an option is just a browser design decision.
- sirn 6y ago...which means a login is now tied to a browser, and you have to come up with a way to securely export or sync private key (bad idea?) or a way to link another browser to a login. Also user losing access to all their websites by accidentally uninstalling a browser doesn't sounds very user friendly.
- sneak 6y agoThis is exactly the same situation as software WebAuthn keys, if they are used as a single factor.
- dividuum 6y agoThere was actually a <keygen> html tag used within <form>s to generate a keypair what was then supposed to be signed by the server and finally returned to the browser for local installation. At least that's how I understand it. It's been deprecated for a while now.
- ryukafalz 6y agoOh wow, yeah - I didn't realize that existed, and now I'm sad it never caught on. :(