3 ms·

> Can you guess which two of the three popular authentication mechanisms Google doesn't use? Google is hardly alone. Non-cookie-based authentication mechanisms

> Can you guess which two of the three popular authentication mechanisms Google doesn't use? Google is hardly alone. Non-cookie-based authentication mechanisms aren't used (and aren't even usable) on any other public web site, either. TLS client certificates have always been a UX nightmare. There is no standard UI for creating, installing, or selecting a certificate to use to authenticate to a web server; many browsers (especially on mobile devices) don't even support those features. There's no way to log out without closing the browser. There's no way for an average user to transfer a certificate from one device to another. NTLM is simply irrelevant outside the scope of a Windows network. Other HTTP password mechanisms have many of the same failings as client certificates -- the UI is clunky and sometimes unavailable, and there's no standard way to log out.

jiggawatts 5y ago
> aren't used ... on any other public web site, either. Internal-use web sites are a thing, however. A very common, heavily used thing. Many of them use NTLM or Kerberos authentication. > TLS client certificates have always been a UX nightmare. Which isn't an issue for APIs accessed over HTTPS, many of which are "public" yet use client certificates for authentication.
ClumsyPilot 5y ago
"There's no way to log out without closing the browser. " Itw like theu gave up halfway when inplementing it. Wtf
pabs3 5y ago
> There's no way for an average user to transfer a certificate from one device to another. Wouldn't you just enrol a new certificate from the new device?
- duskwuff 5y ago
  How would you do that? The old device doesn't know anything about the new certificate, and the new device can't prove that it's the successor to the old device.
  - tene 5y ago
    You use some other form of authentication, like a password, or clicking an emailed link, or clicking an "approve" button on the old device if available, or anything else that makes sense for your relationship with your users.
    - duskwuff 5y ago
      And how does the server remember that you've provided one of those other forms of authentication? Recall that the original goal was to be an alternative to cookies...
  - pabs3 5y ago
    Same as how you verify the keys of another person, manually transferring the hex digits of the fingerprint, or something more user-friendly like QR codes or audio or BT data transmission.
pabs3 5y ago
> There's no way to log out without closing the browser. Well, with TLS client certs, each request is essentially similar to a new login, request, logout, so "logout" doesn't really make sense, unless you want to it to mean "stop using the cert temporarily"? Perhaps the UX for certs should be more like "this site wants you to login", you press login in the browser UI, then all future requests are signed with your cert, until you click logout in the browser UI and then they aren't signed any more.
- deleted 5y ago
  [deleted]
pabs3 5y ago
> TLS client certificates have always been a UX nightmare. Indeed, it is very sad; they could be a great auth standard if only the client UX was acceptable.

jiggawatts 5y ago

> aren't used ... on any other public web site, either. Internal-use web sites are a thing, however. A very common, heavily used thing. Many of them use NTLM or Kerberos authentication. > TLS client certificates have always been a UX nightmare. Which isn't an issue for APIs accessed over HTTPS, many of which are "public" yet use client certificates for authentication.

ClumsyPilot 5y ago

"There's no way to log out without closing the browser. " Itw like theu gave up halfway when inplementing it. Wtf

pabs3 5y ago

> There's no way for an average user to transfer a certificate from one device to another. Wouldn't you just enrol a new certificate from the new device?

duskwuff 5y ago
How would you do that? The old device doesn't know anything about the new certificate, and the new device can't prove that it's the successor to the old device.
- tene 5y ago
  You use some other form of authentication, like a password, or clicking an emailed link, or clicking an "approve" button on the old device if available, or anything else that makes sense for your relationship with your users.
  - duskwuff 5y ago
    And how does the server remember that you've provided one of those other forms of authentication? Recall that the original goal was to be an alternative to cookies...
- pabs3 5y ago
  Same as how you verify the keys of another person, manually transferring the hex digits of the fingerprint, or something more user-friendly like QR codes or audio or BT data transmission.

pabs3 5y ago

> There's no way to log out without closing the browser. Well, with TLS client certs, each request is essentially similar to a new login, request, logout, so "logout" doesn't really make sense, unless you want to it to mean "stop using the cert temporarily"? Perhaps the UX for certs should be more like "this site wants you to login", you press login in the browser UI, then all future requests are signed with your cert, until you click logout in the browser UI and then they aren't signed any more.

deleted 5y ago
[deleted]

pabs3 5y ago

> TLS client certificates have always been a UX nightmare. Indeed, it is very sad; they could be a great auth standard if only the client UX was acceptable.