I don't necessarily agree with the perceived benefits highlighted in the article. i) No need to enter username and password: Yes, we won't have to enter thos

I don't necessarily agree with the perceived benefits highlighted in the article. i) No need to enter username and password: Yes, we won't have to enter those but the real problem is keeping track of multiple usernames/passwords, not entering them. Even if we implement certificate based authentication, we will probably need multiple of them. Single identity is unlikely to happen because of (a) Privacy - You won't want to use the same identity (username or certificate) on facebook and a .xxx site. (b) Security - Sites who care about security like banks would want stronger control on identity (e.g. by expiring passwords or certificates periodically) whereas other consumer facing sites would not. Given these reasons, single identity is not going to happen anytime soon. If keeping track of multiple usernames/passwords is a problem, think how hard would it be to keep track of multiple certificates. (ii) Two factor authentication: Well, just storing certificates in the browser/computer doesn't make it two factor authentication. The second factor in 2-factor should include something which is outside your computer such as a hardware token or your mobile phone. If you store your certificate in your laptop, the same malware which steals your password would steal it too. (iii) Delegation and revoking: OAuth already solves this problem. You don't give your facebook username/password to a third party site for it to access your profile. And you can revoke access anytime. Certificate based authentication is useful if you store them on some 3rd device like Smart Card or USB keys. There are a bunch of companies doing that but they mostly sell to enterprises. We don't want to carry multiple cards, right?