4 ms·
I think the bigger issue in general is that client certificates only authenticate the machine, not the user. That is, unless you password-protect the certificat
by chc 15y ago
I think the bigger issue in general is that client certificates only authenticate the machine, not the user. That is, unless you password-protect the certificate — in which case you've only succeeded in adding a step to the process of getting into your site, a process that most commercial sites would like to streamline as much as possible because it's essentially a giant ramp in the middle of your funnel.
Basically, even if the cost is marginal, so are the benefits for most sites — and although I haven't implemented this myself, I do not believe the cost would be marginal once you take into account all the new problems it creates.
- serge2k 15y agoYup, plus you have the issue of users gettng a new machine and being totally lost. Or owning 2 machines. I suppose you could help that a bit. i.e. have a cert used for authentication, if it is not present then ask for the users info and offer to create a cert for next time.
- alexchamberlain 15y agoHow absurd. This is 2 factor authentication... Validating something you have (ie the computer) and something you know(ie a password).
- tehmeh 15y agoExcept that in most "real" two-factor systems, you can't duplicate the second factor easily. The problem here is if the private key is in main memory, malware can copy it to another computer that will be indistinguishable (for the purposes of authentication) from the first. With something like a smartcard that is made much more difficult. Not impossible, but beyond the reach of most folks.
- alexchamberlain 15y agoYou have a point. I would like to see crypto chips on motherboards/in the CPU that can generate a key, export a public cert and then be asked to sign things. Then this vulnerability disappears.
- mkup 15y agoThere are TPMs exactly for this. Not very popular, though.
- alexchamberlain 15y agoThese sound awesome. Wikipedia says many laptops have them. Is this true? If so, how can I detect one on Linux?
- mkup 15y agoThere are tpm kernel modules and tpm-tools package (in Debian, for example). Also sometimes device must be turned on in BIOS Setup.
- tehmeh 15y agoAnd all of the recent Mac laptops have them. You need a special driver -- look here for a good writeup: http://osxbook.com/book/bonus/chapter10/tpm/ http://osxbook.com/book/bonus/chapter10/tpm/
- technomancy 15y agoIsn't this the same problem as SSH keys though? I already take care to bring my SSH keys with me where ever I go and have an agent to handle them. In fact, if I could get the browser to use them for authentication I'd be thrilled.
- alexchamberlain 15y agoYou shouldn't be taking your SSH keys anywhere. Generate a new one on each machine you use... unless you are using a smart card.