4 ms·
Give up on TLS client certs. The UI for client certs in browsers are miserable, terrible, horrible and insert every other awful adjective you can imagine. Seri
by zie 5y ago
Give up on TLS client certs.
The UI for client certs in browsers are miserable, terrible, horrible and insert every other awful adjective you can imagine. Seriously, it's so broken as to be unusable. Everybody knows it, nobody wants to fix it.
- anonymousDan 5y agoInteresting - can you give some specific examples of the major UI problems?
- zie 5y agoThe scars still haven't healed. ;) see: https://textslashplain.com/2020/05/04/client-certificate-authentication/ https://textslashplain.com/2020/05/04/client-certificate-aut...
- lifeisstillgood 5y agoBut it is the right way. With a client certificate the end server knows, you don't need to fuck around with cookies and TLS binding and so on. Add a new end point - great to use that during your "session". it just works. One day I will work it out.
- zie 5y agoeh. Client certs are better in theory. Client certs have lots of complexity that's not necessarily easily solved. If you control both ends, then most of the complexity is easily solved, but if you don't, then client certs get much harder. FIDO2 is arguably a much better way to deal with this provable identity problem. The UI for FIDO2 has been worked out and is good enough, etc. The big problem is, it requires handing people Yubikeys(or similar devices).