4 ms·

Imho the gaping hole with client certificates at the moment is that, in current browser implementations at least, I don't think they are well secured. Notice w

by nly 13y ago

Imho the gaping hole with client certificates at the moment is that, in current browser implementations at least, I don't think they are well secured. Notice when using his demo pages you are asked by your browser for confirmation before you use your shiny new certificate, but otherwise no credentials are required. It's relatively easy for someone to steal client certificates from my machine whether I'm here or not. [wf9bhh4z.default]$ pwd /home/nly/.mozilla/firefox/wf9bhh4z.default [wf9bhh4z.default]$ strings cert8.db | grep nly.*junkie nly's scriptjunkie.us ID ... I'm not sure if this default behaviour is a switch that can be flipped somewhere, or whether they are actually encrypted, but that protection can only ever boil down to some other credential like the users Windows password (which will be weak). When it comes down to it today, I feel a mobile solution, like Google Authenticator that can live comfortably in my pocket, is just more workable as a 'something I have' credential, and I then don't have to entirely trust whatever random PC I'm using. With QR codes it's even almost as convenient. (I also don't think password auth need be totally disregarded, see : https://news.ycombinator.com/item?id=6767249 https://news.ycombinator.com/item?id=6767249 ). That said, I commend the author for seeking alternatives to password authentication and doing all this excellent work to make it easy to use. It's good, desperately needed work.

revelation 13y ago
As usual, if you can't trust the client machine, no solution is secure. Not even any mobile two way authentication.
- nly 13y ago
  That's true, but there are outright trivial things a lot of sites just don't do to limit the impact of compromise. I just sold some Bitcoin for example (I know right...) and the exchange doesn't require any special credentials for initiating trades or withdrawals: just the same password and 2FA code I use to login to my account. All the good stock trading sites I've used in the past have had separate trading passwords, it just makes sense.
  - MichaelGG 13y ago
    Do you often login to your Bitcoin exchange account without performing any write actions? If the majority if the time you're not logging into a read-only session, having an extra password seems rather pointless. If an attacker has compromised the 2FA system, they've most likely compromised your device.
ams6110 13y ago
Another gaping hole is how to recover the key when the user manages to delete it or lose it (new browser, new computer, etc). This is all just dismissed as "not the subject of this post"
- spydum 13y ago
  CRL. Just like you deactivate app tokens. Allow user to generate new cert and revoke their old ones.
derefr 13y ago
In OSX, client certificates are stored in the Keychain, which must be unlocked with your password. The problem with almost every "security product" comes down to the fact that Windows (and Linux, I think) don't have equivalent protected-storage APIs integrated throughout the desktop environment.
- mhogomchungu 13y ago
  linux has "equivalent protected-storage APIs integrated throughout the desktop environment",KDE has kwallet[1],GNOME has libsecret[2] and lxqt has lxqt wallet[3].Firefox has an extension to store its passwords in KDE's kwallet[4] and GNOME's gnome-keyring/libsecret[5].Chrome has support for both wallets[6] all linux destributions ships with libsecret and that will be the API to target if anybody want to store sensitive information securely in a linux desktop session. [1] http://en.wikipedia.org/wiki/KWallet http://en.wikipedia.org/wiki/KWallet [2] http://lwn.net/Articles/490518/ http://lwn.net/Articles/490518/ [3] https://github.com/mhogomchungu/lxqt_wallet https://github.com/mhogomchungu/lxqt_wallet [4] https://addons.mozilla.org/en-US/firefox/addon/kde-wallet-password-integratio/ https://addons.mozilla.org/en-US/firefox/addon/kde-wallet-pa... [5] https://addons.mozilla.org/en-Us/firefox/addon/gnome-keyring-integration/ https://addons.mozilla.org/en-Us/firefox/addon/gnome-keyring... [6] http://productforums.google.com/forum/#!topic/chrome/r65mTFMrT9o http://productforums.google.com/forum/#!topic/chrome/r65mTFM...
- MichaelGG 13y ago
  Windows provides Data Protection APIs, which allow any program to encrypt data using a key that's derived from the user's password. Reset the password, lose that data. (It also has options for in-memory data, based on a user's session or process scope.) It doesn't protect you from arbitrary code running in your security context that has access to your encrypted data. Without app-level verification (like kernel verifies current binary is signed and hasn't been tampered with), I'm not sure that's even possible.

by nly 13y ago

revelation 13y ago

As usual, if you can't trust the client machine, no solution is secure. Not even any mobile two way authentication.

nly 13y ago
That's true, but there are outright trivial things a lot of sites just don't do to limit the impact of compromise. I just sold some Bitcoin for example (I know right...) and the exchange doesn't require any special credentials for initiating trades or withdrawals: just the same password and 2FA code I use to login to my account. All the good stock trading sites I've used in the past have had separate trading passwords, it just makes sense.
- MichaelGG 13y ago
  Do you often login to your Bitcoin exchange account without performing any write actions? If the majority if the time you're not logging into a read-only session, having an extra password seems rather pointless. If an attacker has compromised the 2FA system, they've most likely compromised your device.

ams6110 13y ago

Another gaping hole is how to recover the key when the user manages to delete it or lose it (new browser, new computer, etc). This is all just dismissed as "not the subject of this post"

spydum 13y ago
CRL. Just like you deactivate app tokens. Allow user to generate new cert and revoke their old ones.

derefr 13y ago

In OSX, client certificates are stored in the Keychain, which must be unlocked with your password. The problem with almost every "security product" comes down to the fact that Windows (and Linux, I think) don't have equivalent protected-storage APIs integrated throughout the desktop environment.

mhogomchungu 13y ago
linux has "equivalent protected-storage APIs integrated throughout the desktop environment",KDE has kwallet[1],GNOME has libsecret[2] and lxqt has lxqt wallet[3].Firefox has an extension to store its passwords in KDE's kwallet[4] and GNOME's gnome-keyring/libsecret[5].Chrome has support for both wallets[6] all linux destributions ships with libsecret and that will be the API to target if anybody want to store sensitive information securely in a linux desktop session. [1] http://en.wikipedia.org/wiki/KWallet http://en.wikipedia.org/wiki/KWallet [2] http://lwn.net/Articles/490518/ http://lwn.net/Articles/490518/ [3] https://github.com/mhogomchungu/lxqt_wallet https://github.com/mhogomchungu/lxqt_wallet [4] https://addons.mozilla.org/en-US/firefox/addon/kde-wallet-password-integratio/ https://addons.mozilla.org/en-US/firefox/addon/kde-wallet-pa... [5] https://addons.mozilla.org/en-Us/firefox/addon/gnome-keyring-integration/ https://addons.mozilla.org/en-Us/firefox/addon/gnome-keyring... [6] http://productforums.google.com/forum/#!topic/chrome/r65mTFMrT9o http://productforums.google.com/forum/#!topic/chrome/r65mTFM...
MichaelGG 13y ago
Windows provides Data Protection APIs, which allow any program to encrypt data using a key that's derived from the user's password. Reset the password, lose that data. (It also has options for in-memory data, based on a user's session or process scope.) It doesn't protect you from arbitrary code running in your security context that has access to your encrypted data. Without app-level verification (like kernel verifies current binary is signed and hasn't been tampered with), I'm not sure that's even possible.