3 ms·
I would hope that certificates are also paired with USB encryption tokens, and I could insert the one from my (physical) key ring and access the mail as usual.
by buro9 15y ago
I would hope that certificates are also paired with USB encryption tokens, and I could insert the one from my (physical) key ring and access the mail as usual. And once I'd withdrawn my token that access would be denied as expected.
- tptacek 15y agoSo now, when we log into machines, we have to carry special physical tokens? That's not realistic. You can thus see one of the reasons we didn't standardize on cert auth.
- ristretto 15y agothat's not unrealistic at all. I carry my keys with me all day, yet i only use them for a few seconds per day. On the other hand, given the risks of interception, i think the best is to have a centralized password system that will require frequent password changes.
- tptacek 15y agoMany tens of millions of people log into web applications every day, and you are proposing that they all somehow be issued PKI certificates and USB fobs, and that that be the primary way they get access to their data. You should talk to someone who manages fob deployments at a Fortune 500 company. These are environments supporting hundreds or thousands of users, not millions, and virtually all those users are highly paid, not fixed-income retirees. In particular, ask them about how easy it is to handle lost, damaged, and stolen fobs. Clearly, we weren't going to standardize on everyone getting a certificate on a USB key --- even had USB keys actually been feasible 15 years ago.
- ensignavenger 15y agoThe Department of Defense uses smart cards with X.509 certificates. I am not aware of all the details of this deployment, but I think they have millions of users.
- deleted 15y ago[deleted]
- yxhuvud 15y agoI know of banks that use cert auth for when their users is accessing their pages, so it is certainly realistic for certain applications.