3 ms·
Probably because client-based SSL certificates have been around forever, but no-one uses them. Probably not a coincidence either, my bank used to rely on clien
by gizzlon 15y ago
Probably because client-based SSL certificates have been around forever, but no-one uses them.
Probably not a coincidence either, my bank used to rely on client side certificates but gave up after, I guess, an insane amount of support calls.
- alexchamberlain 15y agoThey are brilliant, but they need to be more accessible. Hmmmmm... maybe I should provide a patch for Chromium/Firefox.
- zobzu 15y agoi wouldnt say brillant the CA model is still a pita where you've to pay for certified authorities that are backed up by the vendors and then, those certified authorities still fail to secure themselves it certainly made a lot of sense but in reality its not that good
- icebraining 15y agoThe CAs don't need to play any part in client-cert based authentication. You just generate a cert locally and then copy the public key to the site when you register. Subsequent logins are performed by the server checking if you own the right private key that matches the public key used on registration. It's like SSH, not HTTPS. CAs are only useful to match a cert to a domain and/or known organization, or inside an organization to make sure the user has a cert signed by the org itself.
- gizzlon 15y ago"You just generate a cert locally and then copy the public key to the site when you register." But how do you know you're copying your key to the right site and not some fake? Answer is, of course, you don't, so you need something else. And it's not stronger than the weakest link..
- alexchamberlain 15y agoI would like to emphasise my disagreement with this comment and agreement with the other reply. Authentication using HTTPS is the same theory as SSH public key authentication.