4 ms·
He doesn't mean that a solution existed 15 years ago, just that a significantly smaller number of applications would have been impacted by a solution coming int
by buro9 15y ago
He doesn't mean that a solution existed 15 years ago, just that a significantly smaller number of applications would have been impacted by a solution coming into existence 15 years ago, than if one appeared now.
I still like the idea of certificates in browsers authenticating me. But almost nothing out there that I use has the implemented.
- tptacek 15y agoSay we adopted certificate authentication. What happens when you want to get your mail from a friend's machine, or log in somewhere to print a boarding pass from a kiosk?
- buro9 15y agoI would hope that certificates are also paired with USB encryption tokens, and I could insert the one from my (physical) key ring and access the mail as usual. And once I'd withdrawn my token that access would be denied as expected.
- tptacek 15y agoSo now, when we log into machines, we have to carry special physical tokens? That's not realistic. You can thus see one of the reasons we didn't standardize on cert auth.
- ristretto 15y agothat's not unrealistic at all. I carry my keys with me all day, yet i only use them for a few seconds per day. On the other hand, given the risks of interception, i think the best is to have a centralized password system that will require frequent password changes.
- tptacek 15y agoMany tens of millions of people log into web applications every day, and you are proposing that they all somehow be issued PKI certificates and USB fobs, and that that be the primary way they get access to their data. You should talk to someone who manages fob deployments at a Fortune 500 company. These are environments supporting hundreds or thousands of users, not millions, and virtually all those users are highly paid, not fixed-income retirees. In particular, ask them about how easy it is to handle lost, damaged, and stolen fobs. Clearly, we weren't going to standardize on everyone getting a certificate on a USB key --- even had USB keys actually been feasible 15 years ago.
- ensignavenger 15y agoThe Department of Defense uses smart cards with X.509 certificates. I am not aware of all the details of this deployment, but I think they have millions of users.
- deleted 15y ago[deleted]
- yxhuvud 15y agoI know of banks that use cert auth for when their users is accessing their pages, so it is certainly realistic for certain applications.