4 ms·
Then why not work on improving the UX in the OS and/or application instead of coming up with an entirely new standard? For example, when creating accounts on w
by u801e 4y ago
Then why not work on improving the UX in the OS and/or application instead of coming up with an entirely new standard?
For example, when creating accounts on websites like here or reddit, part of the process should involve the application you're using creating a CSR and the website sending the certificate back. The application should then store the certificate and whenever you log in, the application knows to use the certificate and private key when negotiating a connection.
And the application doesn't have to be a web browser. It could also be an email client or IRC client, for example.
- zie 4y agoAll(well all the ones anyone ever uses) the browsers now are OSS and nobody has done the work. As for doing public key crypto, that's exactly what webauthn does. It doesn't use X.509 and TLS under the hood, but it essentially is a public key crypto system. It works in reverse of what you are saying though. The device(TPM, Yubikey, etc) stores the private key, the website just does verification checks that the device really does have the secret key. Note: there are lots of details I skipped over on purpose.
- u801e 4y agoThe problem I have with webauthn is the fact that it depends on the HTTP application protocol. TLS works regardless of the application protocol used. If I'm using Thunderbird to read and send email over IMAP and SMTP respectively, there shouldn't be a requirement that I use HTTP for authentication.