3 ms·

Password prompts are annoying, agreed. I like the idea of delaying it as long as possible, even if sometimes it gets annoying. If I have to go through several

by Spittie 13y ago

Password prompts are annoying, agreed. I like the idea of delaying it as long as possible, even if sometimes it gets annoying. If I have to go through several steps just to register to a site, then I'll probably not register. But remember that e-mail is not a secure protocol. Anyone could be sniffing your traffic to find a random generated password, an url that automatically log you in, and similar content. I'd love to see a solution based on certificates, like how ssh works. Your browser and the server agree on a key pair over a secure (https?) connection, and then you use it to login. This add a whole layer of complications to the browser, like how you sync those, take them into another browser ecc... But it would sure be a very cool way to totally remove the password prompt, while staying secure. By the way, Amazon ask for my password every time I try to place an order, even if it's with a saved credit card and with on a registered address. Maybe it's an American thing?

dionyziz 13y ago
This exists: http://pilif.github.io/2008/05/why-is-nobody-using-ssl-client-certificates/ http://pilif.github.io/2008/05/why-is-nobody-using-ssl-clien...
- phlo 13y ago
  StartSSL (a reasonably priced Israeli PKIX CA) does. Some Banks do too, but tend to wrap it all up in a hardened browser instance or app. As for why no-one else does: * installing a client cert is way too complicated for "average" users * being directed to change settings you don't understand may appear scary * moving a your client cert from one box to another is unnecessarily complicated (browser sync may help there) * if more than one person uses the OS account, they'll need to mess around in the browsers config option each time they authenticate * not having to provide a password will "feel" insecure to many users * running a PKI is hard[er than storing passwords] * I'm not sure we want people installing any kind of certificates as a normal part of their workflow -- more often than not they might stumble upon a malicious CA cert

by Spittie 13y ago

dionyziz 13y ago

This exists: http://pilif.github.io/2008/05/why-is-nobody-using-ssl-client-certificates/ http://pilif.github.io/2008/05/why-is-nobody-using-ssl-clien...

phlo 13y ago
StartSSL (a reasonably priced Israeli PKIX CA) does. Some Banks do too, but tend to wrap it all up in a hardened browser instance or app. As for why no-one else does: * installing a client cert is way too complicated for "average" users * being directed to change settings you don't understand may appear scary * moving a your client cert from one box to another is unnecessarily complicated (browser sync may help there) * if more than one person uses the OS account, they'll need to mess around in the browsers config option each time they authenticate * not having to provide a password will "feel" insecure to many users * running a PKI is hard[er than storing passwords] * I'm not sure we want people installing any kind of certificates as a normal part of their workflow -- more often than not they might stumble upon a malicious CA cert