3 ms·
User authentication using client-side (aka mutual) TLS certificates. This was promoted with netscape navigator and then never came to be. Be authenticated ev
by tonymet 6y ago
User authentication using client-side (aka mutual) TLS certificates. This was promoted with netscape navigator and then never came to be. Be authenticated everywhere, without ever having to log in.
- jl2718 6y agoI did this for a bunch of government sites many years ago. It was amazingly simple and completely transparent to the user. No passwords. No auth cookies. No registration. Developers don’t even have to know about it. My understanding is that it’s still supported by every major browser. I’m not really a web programmer though; just stepped in on a lagging contract and it seems like the best solution.
- tonymet 6y agoMost big tech companies use this internally. Google "beyondcorp" works this way.
- 10000truths 6y agoPerhaps that's a good thing, because I'm almost certain that would be abused as a user fingerprint.
- tonymet 6y agoSo is your password presently (via auth session cookies). The same whitelisting used for cookies today would work to allow fingerprinting of your personal certificate.
- krupan 6y agoSo much this! WebAuthn is sort of doing this, but I think it is way too complicated. Perfect is the enemy of good enough. All we have to do is be better than passwords, and that’s a really low bar.