News for hackers. Stuff that matters.

A comment on Why is nobody using SSL client certificates?. Parent comment

Re:Why is nobody using SSL client certificates? by mtrimpe on Thursday July 11, 2013 @11:09AM (#6026472)
They're as secure as your ability to keep the private keys private, just like with server certs.

As far as MITM and PFS goes; that's handled just the same as regular SSL. Using a client cert doesn't affect that at all.

[ Parent | on HN ]
Re:Why is nobody using SSL client certificates? by tomgirl1 on Thursday July 11, 2013 @11:12AM (#6026505)
Which is not secure at all. you can MITM a typical SSL connection in so many ways SSL might as well not exist.

No real cert validation, forged certs, proxy replays. SSL is a joke.

[ Parent | on HN ]
Re:Why is nobody using SSL client certificates? by peterwwillis on Thursday July 11, 2013 @01:18PM (#6027447)
You can't MITM an SSL session with validly CA-signed certs unless you've pwnd the CA, web server or end user's machine. And I don't know what you're going on about with regarding "no real cert validation". If it's valid, it will be validated. There's nothing wrong with it when it's done right.
[ Parent | on HN ]
Re:Why is nobody using SSL client certificates? by xnyhps on Thursday July 11, 2013 @12:27PM (#6027062)
Most places where you can authenticate with SSL client certs allow you to add your own self-signed certificate and authenticate using that. All the validation you need is to check wether the cert is in the user's list. You can only forge that by stealing the private key.

There's really no reason to only allow CA signed client certs.

[ Parent | on HN ]
Re:Why is nobody using SSL client certificates? by icebraining on Thursday July 11, 2013 @12:15PM (#6026984)
Proxy replays? How so?

As for cert validation / forged certs, they're only problematic because we want to authenticate a server we have never talked to before. With clients certs, the same doesn't apply: the server just needs to ensure the client is the same as the one who registered the account, so there's no need for the whole CA enchilada.

[ Parent | on HN ]