Re:Why is nobody using SSL client certificates?
by drchaos on Thursday July 11, 2013 @05:06PM
(#6029227)
Other than passwords, client certs cannot be guessed or generated with wordlists, they can not be used to authenticate to other sites even if stolen, and they cannot be forgotten (at least I tend to forget passwords for rarely used sites way more often than I lose data through HW failure).
So I'd say there are some advantages over passwords. And most of the functionality is already there, the only thing missing is a browser function to generate a keypair for a domain and send the public key, without much user interaction.
Re:Why is nobody using SSL client certificates?
by deoxxa on Friday July 12, 2013 @01:16AM
(#6031050)
That's already a thing, if I understand what you're asking - see the <keygen> tag.
Re:Why is nobody using SSL client certificates?
by bascule on Thursday July 11, 2013 @05:18PM
(#6029290)
Client certs can't be phished
Re:Why is nobody using SSL client certificates?
by dredmorbius on Friday July 12, 2013 @02:11AM
(#6031197)
The can be revealed by other means (trojan/virus on the client). But yes, the anti-phishing aspect is a good one.
password can fails all those plus phishing.
Re:Why is nobody using SSL client certificates?
by gcb0 on Thursday July 11, 2013 @05:36PM
(#6029392)
Not really. you could use a storage medium that is remote and load it in memory only, if the usage justified.... not case, for reasons you outlined eloquently on the article.
Also, the client cert, as with private keys, allows you to memorize ONLY ONE password (make it a passphrase, please) instead of a bazillion (or, gasp, reusing).
So, no, it's not an extra hassle. it's a solution for the real hassle of passwords in websites. if it was used.
So it's only hassle and no advantage, hence, useless