3 ms·

Let's hope this doesn't get picked up by the (corporate) masses... the last thing I want is my browser offering personal TLS certificates to every server I visi

Let's hope this doesn't get picked up by the (corporate) masses... the last thing I want is my browser offering personal TLS certificates to every server I visit as some kind of identity verification or fingerprint/tracking. It's bad enough that ssh does this by default with all your keys.

altairprime 1mo ago
Client TLS is rather unusable on the Internet by a typical random end user visiting a random public site, so that should at least keep the specific scenario you describe at bay.
- ranger_danger 1mo ago
  Currently yes, but there's not much stopping Chrome etc. from adding a new feature that has a way of presenting a client certificate to a website in a backwards-compatible manner. Of course the website itself would need to support that, but it's all possible in time.
  - altairprime 1mo ago
    Chrome would be more likely to implement a persistent and identifiable (to Google alone) tracking cookie replacement and ship it worldwide, which iirc they did — and then cancelled, of course. They seem to be focusing instead on improved tracking of Android users from the kernel up, rather than browsers from the headers down; GrapheneOS is, presumably, viewed as a serious threat to their advertising revenue. https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies https://privacysandbox.google.com/blog/update-on-plans-for-p...
    - ranger_danger 1mo ago
      Yes that's what I'm saying this could be used for. Browser generates a client-side key (or any kind of identifier, possibly derived from the site's TLS cert/domain or some other info) for the current browser/user/device/whatever and just offer that to every website as an extra header so that whoever wants to track you, can.
  - _flux 1mo ago
    Wouldn't this in practice be a lot like Passkeys? But it might be more difficult to integrate this kind of approach to the stacks we use, whereas Passkeys fits in relatively easily. I suppose client cert would protect against from a MitM attack, if the client failed to notice it, or if the MitMer has the website keys to make a perfect attack.
bschaatsbergen 1mo ago
[dead]
zx8080 1mo ago
This is most probably where it's going in less than a year. The recent campaign "Safer with Google" in Chrome hints to this.

altairprime 1mo ago

Client TLS is rather unusable on the Internet by a typical random end user visiting a random public site, so that should at least keep the specific scenario you describe at bay.

ranger_danger 1mo ago
Currently yes, but there's not much stopping Chrome etc. from adding a new feature that has a way of presenting a client certificate to a website in a backwards-compatible manner. Of course the website itself would need to support that, but it's all possible in time.
- altairprime 1mo ago
  Chrome would be more likely to implement a persistent and identifiable (to Google alone) tracking cookie replacement and ship it worldwide, which iirc they did — and then cancelled, of course. They seem to be focusing instead on improved tracking of Android users from the kernel up, rather than browsers from the headers down; GrapheneOS is, presumably, viewed as a serious threat to their advertising revenue. https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies https://privacysandbox.google.com/blog/update-on-plans-for-p...
  - ranger_danger 1mo ago
    Yes that's what I'm saying this could be used for. Browser generates a client-side key (or any kind of identifier, possibly derived from the site's TLS cert/domain or some other info) for the current browser/user/device/whatever and just offer that to every website as an extra header so that whoever wants to track you, can.
- _flux 1mo ago
  Wouldn't this in practice be a lot like Passkeys? But it might be more difficult to integrate this kind of approach to the stacks we use, whereas Passkeys fits in relatively easily. I suppose client cert would protect against from a MitM attack, if the client failed to notice it, or if the MitMer has the website keys to make a perfect attack.

bschaatsbergen 1mo ago

[dead]

zx8080 1mo ago

This is most probably where it's going in less than a year. The recent campaign "Safer with Google" in Chrome hints to this.