News for hackers. Stuff that matters.

A comment on Logins without logins.. Parent comment

Re:Logins without logins. by icebraining on Monday September 03, 2012 @12:16PM (#4470852)
How would one authenticate from two different devices? Moving certificates around has plenty of issues.
[ Parent | on HN ]
Re:Logins without logins. by alexchamberlain on Monday September 03, 2012 @01:25PM (#4471092)
DON'T MOVE CERTIFICATES.

You need another way of authenticating someone as well, whether it by SMS, biometrics or passwords.

Client-side certificates can be used as one-part of two-factor authentication or on their own depending on the level of security needed.

Oh, and btw, DON'T MOVE CERTIFICATES!

[ Parent | on HN ]
Re:Logins without logins. by callahad on Monday September 03, 2012 @12:22PM (#4470877)
You could have the certificate follow the device, rather than the user.
[ Parent | on HN ]
Re:Logins without logins. by icebraining on Monday September 03, 2012 @01:06PM (#4471022)
If the certificate is device-bound, then how do you authenticate from another device?
[ Parent | on HN ]