3 ms·
In a centralised system a lot of these techniques don't actually make much sense. We could have client certs but they would need to be cached in memory on mach
by 7952 12y ago
In a centralised system a lot of these techniques don't actually make much sense. We could have client certs but they would need to be cached in memory on machines that may be comprimised. At that point why not just use cookies sent over SSL? The same is true of personal digital signatures. Why give complete trust to something that could have been obtained using malware or phishing?
- nly 12y ago> At that point why not just use cookies sent over SSL? Cookies are completely under the control of the web server/application. They can't provide provide a secure means of client authentication, except as really bad session tokens. The way they're currently used as such is essentially broken because they're not actually bound to any session state, which opens the door for session hijacking attacks even if you're using TLS.
- 7952 12y agoWhich is exactly the same problem you would have with client certs. If an attacker can get a cookie why can't they also get a private key? Also a centralised system needs to have a way to recover accounts when credentials are lost. Without some kind of third party validation (which would reduce sign up) sites would have to rely on exactly the same methods to validate users as password + cookie. For consumer sites with badly maintained machines client certs just increase the attack surface with little real benefit.