3 ms·

I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser check

I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.

jon-wood 6y ago
Because the UI for managing client certificates is terrible, with no real support for distributing a cert to multiple endpoints unless you're in an enterprise environment with device management, or issuing smart cards and readers. I do think there's legs in client certs for enterprise authentication, but for consumer products it's a non-starter.
- jchook 6y ago
  I wonder if this is something that cloud password managers like 1Password could tackle.
gfodor 6y ago
Isn't the problem with this that it means your account is tied to your browser install? Eg, you'd need to copy the cert to another machine to sign in, would need to ensure it's backed up, etc.
- randomdata 6y ago
  Password management already is to basically that extent and the tools to copy that information around, backup, etc. also have come into existence to support usage beyond a single browser install.
  - gfodor 6y ago
    That's half true, password management piggybacks on top of a system which doesn't have these characteristics, so it means no special work needs to be done on the development side to support them, and it's activation function is only determined on one side of each edge (the user side.) For this cert system to work, you have a bit of a chicken-and-egg problem since it requires both sides of the user-service graph to have done work pre-emptively to support it.
hkt 6y ago
It would be really, drastically lovely if that were to happen. For bonus points, encrypt the client certs with a master password and sync between a user's devices.
corrys 6y ago
Perhaps one the main reasons is that a large number of people use multiple devices or even multiple browsers on the same device. Not sure how SSL client certificate authentication accommodates that.
aarroyoc 6y ago
It's the way Spanish government webapps work with the citizens but it's a bit confusing to be honest. When it works it's perfect but the setup is complicated, so they're introducing an optional user/password login also.
theandrewbailey 6y ago
UIs to use client certificates are terrible, and key and certificate storage almost always involves a password anyway. My day job occasionally involves a WebDAV server protected with a normal login plus a client certificate. Sometimes I need to explain the process to less technically literate people who use different client software than I do, and the certificate part is a total pain.

jon-wood 6y ago

Because the UI for managing client certificates is terrible, with no real support for distributing a cert to multiple endpoints unless you're in an enterprise environment with device management, or issuing smart cards and readers. I do think there's legs in client certs for enterprise authentication, but for consumer products it's a non-starter.

jchook 6y ago
I wonder if this is something that cloud password managers like 1Password could tackle.

gfodor 6y ago

Isn't the problem with this that it means your account is tied to your browser install? Eg, you'd need to copy the cert to another machine to sign in, would need to ensure it's backed up, etc.

randomdata 6y ago
Password management already is to basically that extent and the tools to copy that information around, backup, etc. also have come into existence to support usage beyond a single browser install.
- gfodor 6y ago
  That's half true, password management piggybacks on top of a system which doesn't have these characteristics, so it means no special work needs to be done on the development side to support them, and it's activation function is only determined on one side of each edge (the user side.) For this cert system to work, you have a bit of a chicken-and-egg problem since it requires both sides of the user-service graph to have done work pre-emptively to support it.

hkt 6y ago

It would be really, drastically lovely if that were to happen. For bonus points, encrypt the client certs with a master password and sync between a user's devices.

corrys 6y ago

Perhaps one the main reasons is that a large number of people use multiple devices or even multiple browsers on the same device. Not sure how SSL client certificate authentication accommodates that.

aarroyoc 6y ago

It's the way Spanish government webapps work with the citizens but it's a bit confusing to be honest. When it works it's perfect but the setup is complicated, so they're introducing an optional user/password login also.

theandrewbailey 6y ago

UIs to use client certificates are terrible, and key and certificate storage almost always involves a password anyway. My day job occasionally involves a WebDAV server protected with a normal login plus a client certificate. Sometimes I need to explain the process to less technically literate people who use different client software than I do, and the certificate part is a total pain.