2 ms·
I still cannot understand why mutual TLS never took off anywhere besides Gov [1]. You know how much more convenient it is to just open a browser and go to a we
by lesuorac 2y ago
I still cannot understand why mutual TLS never took off anywhere besides Gov [1].
You know how much more convenient it is to just open a browser and go to a webpage and already be logged in?
[1]: https://en.wikipedia.org/wiki/Common_Access_Card https://en.wikipedia.org/wiki/Common_Access_Card
- bqmjjx0kac 2y agoWouldn't that broadcast a stable identifier to every site you visit?
- lesuorac 2y agoIsn't that desirable? Safari (Apple), IE/Edge (Microsoft), and Chrome (Google) all operate their own ad networks. I'm sure they'd love their own version of X-UIDH [1]. [1]: https://en.wikipedia.org/wiki/List_of_HTTP_header_fields https://en.wikipedia.org/wiki/List_of_HTTP_header_fields
- fragmede 2y agothat's precisely why it's not desireble
- hinkley 2y agoMutual TLS was necessary but a giant pain in the butt for an app I worked on that needed to do over the air updates over WiFi. Getting it working across all of the moving parts was a significant part of the overall effort for the OTA part of that project. OCSP existed back then which helped but I don’t know if stapling had been widely implemented yet.