Re:Tell HN: SMS-based two-factor authentication is not secure
by baybal2 on Wednesday June 09, 2021 @02:27PM
(#27451336)
It had it! HTML 5 keygen tag https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke...
But Mozilla, and Google double teamed to sink it in W3C to push their own bicycle reinvention attempts, which after 10+ years, multiple incompatible versions, and errata ridden revisions are still not there.
https://lists.w3.org/Archives/Public/www-tag/2015Sep/0001.ht...
Google needs to be kicked out of W3C
Re:Tell HN: SMS-based two-factor authentication is not secure
by jjav on Wednesday June 09, 2021 @03:31PM
(#27452078)
Yes! This was a very good solution. Built right into the browser, very convenient. We built a related CA product back in the 90s and were issuing client certs on smarts cards via the browser. Plug in smartcard and browser could automatically authenticate to all services. Take it out and go home.
Re:Tell HN: SMS-based two-factor authentication is not secure
by lmz on Wednesday June 09, 2021 @09:08PM
(#27455562)
I used an SSL CA (Startcom / StartSSL) that used Client certs as its (only?) method of authentication. It was a terrible experience if you ever had to log in from another browser.
Re:Tell HN: SMS-based two-factor authentication is not secure
by maxwelljoslyn on Wednesday June 09, 2021 @08:42PM
(#27455371)
I didn't know that. Oh, come on. That's so unfortunate.
This is more portable than U2F tokens since client-side certificates are part of the TLS standard and should be supported regardless of the application protocol used. Adding other devices could be done by sending a CSR along with the username and password and authorizing the second device from first device that's already logged into the account.