Ask HN: What feature would you want the web to “force” next, after HTTPS?

Re:Ask HN: What feature would you want the web to “force” ne... by adrianratnapala on Wednesday July 12, 2017 @09:41PM (#14758175)

So I have heard of client TLS authentication, but does it exist for the web (I mean just in principle, not whether it is really used). That is, do browsers support it?

The thing is, if it is a massive pain for average users, then that is an own-goal. Look at SSH: there is no certification chain there. All you do is generate a keypair and then (here's the awkward bit) magic the pubkey over to the server.

It would be easy enough for a website to make pubkey installation a seamless part of the sign-on workflow.

[ Parent | on HN ]

Re:Ask HN: What feature would you want the web to “force” ne... by fragmede on Thursday July 13, 2017 @10:57AM (#14761785)

It is a massive pain for average users but it's well supported by browsers is because big corporations have IT departments that provision (and admin) computers for their users, average or otherwise, and the provisioning process includes setting up client certs.

So while browsers do support client certs, there has been very little effort to make them easy to install due to a chicken-egg situation. They're hard to use, so no one uses them, but no one (random sites on the Internet, that is) uses them for client auth because they're hard to use.

[ Parent | on HN ]

Re:Ask HN: What feature would you want the web to “force” ne... by tptacek on Wednesday July 12, 2017 @10:22PM (#14758299)

Yes, browsers have supported client certificates for decades and continue to today.

[ Parent | on HN ]