3 ms·

And if you have SSL anyway, why use passwords when you can use certificates?

• icebraining 14y ago
  Because users don't understand certificates?
  • drdaeman 14y ago
    They didn't understood many other form of credentials either (like OpenID), but sites educated them and now they do.
    • icebraining 14y ago
      They do? Are you sure of that?
      • drdaeman 14y ago
        That depends on who the site's audience are and how the login UI's done. Fairly tech-savvy visitors certainly do understand OpenID and alike. At least, I strongly believe so. Well, more casual audience probably don't. However, my bank uses X.509 certificates to authenticate users over Internet. Out of curiosity, I've asked bank employee once and was told that most users do manage their certificates just fine, without any issues. Obviously, bank provides short and simple manuals, which explain how to generate a certificate request, obtain a signed certificate (by visiting bank in person), authenticate and renew expiring certs. (My bank's not using in-browser PKI due to legal reasons and provides a small piece of software wrapping around the browser, but that doesn't really matter.)