18 ms·

Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice? I have a p

Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice? I have a password on my phone, because I don't want people with access to it to be able to login and look at my stuff. What's to stop my friend Joe Blogs coming over my house and being able to read my email because I have one of these things installed that allows for a one-click login?

mtrimpe 13y ago
I don't know what browsers do, but it's fairly easy to password protect these keys. If you then keep the key accessible until some timeout (whether maximum or idle time) occurs then you've got pretty good security. That's what you already get if you use LastPass e.a.
icebraining 13y ago
Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice? The most important difference is that attackers can't get it from the server and re-use it on others, since the server only needs to see the public key of the cert. Attackers can no longer break into a single server and get thousands of badly-secured passwords. Of course, secure password hashing mitigates this issue, but that means we need to trust each and every server out there to implement that correctly (not likely), while this only requires a correct implementation from the browsers.
jlgaddis 13y ago
> What's to stop my friend Joe Blogs coming over my house and being able to read my email ... The PIN. X.509 certificates are protected by a PIN in the same way that an SSH key pair is protected by a passphrase. Even if you "physically" obtain the private key, you still need the PIN that protects it before you can use it. (side note: you can use an X.509 certificate for SSH authentication)

18 ms·

Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice? I have a p

by andyhmltn 13y ago

mtrimpe 13y ago
I don't know what browsers do, but it's fairly easy to password protect these keys. If you then keep the key accessible until some timeout (whether maximum or idle time) occurs then you've got pretty good security. That's what you already get if you use LastPass e.a.
icebraining 13y ago
Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice? The most important difference is that attackers can't get it from the server and re-use it on others, since the server only needs to see the public key of the cert. Attackers can no longer break into a single server and get thousands of badly-secured passwords. Of course, secure password hashing mitigates this issue, but that means we need to trust each and every server out there to implement that correctly (not likely), while this only requires a correct implementation from the browsers.
jlgaddis 13y ago
> What's to stop my friend Joe Blogs coming over my house and being able to read my email ... The PIN. X.509 certificates are protected by a PIN in the same way that an SSH key pair is protected by a passphrase. Even if you "physically" obtain the private key, you still need the PIN that protects it before you can use it. (side note: you can use an X.509 certificate for SSH authentication)