News for hackers. Stuff that matters.

A comment on The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords. Parent comment

Re:The Devil Is in the Details of Project Verify’s Goal to E... by LinuxBender on Thursday October 04, 2018 @06:03PM (#18144073)
I would fully expect some government sites to require client certs. Some DNS registrars also required client certs in addition to 2FA. Some payment systems also require them in addition to IP restrictions.
[ Parent | on HN ]
Re:The Devil Is in the Details of Project Verify’s Goal to E... by rkeene2 on Thursday October 04, 2018 @06:18PM (#18144177)
HSPD-12 largely abolished passwords as authenticators throughout the executive branch.
[ Parent | on HN ]
Re:The Devil Is in the Details of Project Verify’s Goal to E... by LinuxBender on Friday October 05, 2018 @11:01AM (#18148667)
Hopefully all of their authentication methods are hosted in-house, on-prem and not outsourced or outside of secure boundaries. Everything has a back-door these days and leaks like a waterfall. :-)
[ Parent | on HN ]
Re:The Devil Is in the Details of Project Verify’s Goal to E... by rkeene2 on Tuesday October 09, 2018 @01:54PM (#18178232)
A lot of the authentication is TLS client certificate authentication, SAML hosted by internal SAML IdP systems (such as ADFS) for web stuff.

For most other things Kerberos (via PKINIT) is used.

SSH authentication X.509 using PKIXSSH is rarely used since it is not a standard part of any operating systems used. For SSH, typically either Kerberos or SSH keys based on the RSA keys used by the certificates.

[ Parent | on HN ]