3 ms·
> At that point why not just use cookies sent over SSL? Cookies are completely under the control of the web server/application. They can't provide provide a se
by nly 12y ago
> At that point why not just use cookies sent over SSL?
Cookies are completely under the control of the web server/application. They can't provide provide a secure means of client authentication, except as really bad session tokens. The way they're currently used as such is essentially broken because they're not actually bound to any session state, which opens the door for session hijacking attacks even if you're using TLS.
- 7952 12y agoWhich is exactly the same problem you would have with client certs. If an attacker can get a cookie why can't they also get a private key? Also a centralised system needs to have a way to recover accounts when credentials are lost. Without some kind of third party validation (which would reduce sign up) sites would have to rely on exactly the same methods to validate users as password + cookie. For consumer sites with badly maintained machines client certs just increase the attack surface with little real benefit.