3 ms·
But it is the right way. With a client certificate the end server knows, you don't need to fuck around with cookies and TLS binding and so on. Add a new end p
by lifeisstillgood 5y ago
But it is the right way.
With a client certificate the end server knows, you don't need to fuck around with cookies and TLS binding and so on. Add a new end point - great to use that during your "session". it just works.
One day I will work it out.
- zie 5y agoeh. Client certs are better in theory. Client certs have lots of complexity that's not necessarily easily solved. If you control both ends, then most of the complexity is easily solved, but if you don't, then client certs get much harder. FIDO2 is arguably a much better way to deal with this provable identity problem. The UI for FIDO2 has been worked out and is good enough, etc. The big problem is, it requires handing people Yubikeys(or similar devices).