8 ms·
I'm the author of this, now quite dated, article and by now I really don't agree with its contents any more - at least not fully: 1) this is not truly two-fact
by pilif 15y ago
I'm the author of this, now quite dated, article and by now I really don't agree with its contents any more - at least not fully:
1) this is not truly two-factor authentication as the certificate is stored right there on the machine I'm using for authentication. If this would ever get widespread use, we'd have issues with malware extracting the key from the browser. Not even password-protecting the key (giving you something comparable to SSH authentication) would help much as malware presumably has access to your memory anyways.
2) With the problems inherent to the SSL protocol in conjunction with renegotiation (http://www.kb.cert.org/vuls/id/120541 http://www.kb.cert.org/vuls/id/120541), this becomes a bit annoying because you can't safely have resources for which you check a client certificate on the same server as resources where you don't. Remember: The article predates the vulnerability by a year.
3) More and more people are beginning to have multiple devices they use. There's not even a "main" machine any more. Not having access to the client-side certificate is annoying though with the various browser syncing solutions out there, this might become a non-issue over time.
None the less. My personal complaint about the overly complicated UI still stands - heck, this is even annoying for me and I would (aside of point 2 above) have good use for this at times - but clicking through this jungle of dialog boxes remains annoying to this date.
- jdwhit2 15y agoWould this be able to handle multiple accounts for the same website? Or would you use a separate browser for each account?
- wmf 15y agoThe browser could ask you which cert to present, but as the saying goes, now you have N problems.
- oomkiller 15y agoChrome and Safari prompt you (at least on OS X, not sure about others) which certificate you want to use if there are multiple matches.
- X-Istence 15y agoThe bad thing is that it remembers what certificate you want to use and logging out and loggin back in doesn't ask you what certificate you want to use :-( I've had this issue with the fact that I have two CACert accounts (due to not remembering I had already created one before) and I just recently moved all domains to the newest account...
- Groxx 15y agoThe UI is still ridiculous, yeah. But that seems to be par for the course for anything security-related, especially around client-side public keys. Setting signatures for your email is ridiculous, as is receiving them - epic warnings on every client I've tried means I know I can't send signed emails to my family, because they'll freak out and delete the message or shut down the computer immediately. Until that changes, you can be guaranteed it will never gain widespread adoption.
- Toucan 15y agoI agree with your reasoning in the article and in point 3 here. I used to work at a tech firm, we used this SSL Certificates to authenticate against our internal CA. Sysadmins got it wrong, devs got it wrong, qa got it wrong and nobody else stood a chance. The worst thing about it by far was managing keys between machines. For example, it made it impossible to work from home on an impromptu basis without someone available to help you out.
- count 15y agoSmart cards (like the DoD Common Access Card/CAC) solve #1 and #3 (no dice on 2 yet).
- marshray 15y agoRenegotiation is fixed in all major browsers and servers with the implementation of RFC 5746. http://tools.ietf.org/html/rfc5746 http://tools.ietf.org/html/rfc5746 Unless you're a year or so out of date on your patches, renegotiation works better than ever.
- count 15y agoThanks, I missed that somehow. Although, I did say DoD clients, so odds are they're out of date still. Neat to get the update from the guy I watched keynote about the problem in the first place though!