News for hackers. Stuff that matters.

A comment on Adding Easy SSL Client Authentication To Any Webapp.

Re:Adding Easy SSL Client Authentication To Any Webapp by nly on Saturday November 30, 2013 @06:28PM (#6825166)
Imho the gaping hole with client certificates at the moment is that, in current browser implementations at least, I don't think they are well secured.

Notice when using his demo pages you are asked by your browser for confirmation before you use your shiny new certificate, but otherwise no credentials are required. It's relatively easy for someone to steal client certificates from my machine whether I'm here or not.

    [wf9bhh4z.default]$ pwd
    /home/nly/.mozilla/firefox/wf9bhh4z.default
    [wf9bhh4z.default]$ strings cert8.db | grep nly.*junkie
    nly's scriptjunkie.us ID
... I'm not sure if this default behaviour is a switch that can be flipped somewhere, or whether they are actually encrypted, but that protection can only ever boil down to some other credential like the users Windows password (which will be weak).

When it comes down to it today, I feel a mobile solution, like Google Authenticator that can live comfortably in my pocket, is just more workable as a 'something I have' credential, and I then don't have to entirely trust whatever random PC I'm using. With QR codes it's even almost as convenient. (I also don't think password auth need be totally disregarded, see : https://news.ycombinator.com/item?id=6767249 ).

That said, I commend the author for seeking alternatives to password authentication and doing all this excellent work to make it easy to use. It's good, desperately needed work.

[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by derefr on Saturday November 30, 2013 @11:19PM (#6826080)
In OSX, client certificates are stored in the Keychain, which must be unlocked with your password. The problem with almost every "security product" comes down to the fact that Windows (and Linux, I think) don't have equivalent protected-storage APIs integrated throughout the desktop environment.
[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by mhogomchungu on Sunday December 01, 2013 @01:36AM (#6826402)
linux has "equivalent protected-storage APIs integrated throughout the desktop environment",KDE has kwallet[1],GNOME has libsecret[2] and lxqt has lxqt wallet[3].Firefox has an extension to store its passwords in KDE's kwallet[4] and GNOME's gnome-keyring/libsecret[5].Chrome has support for both wallets[6]

all linux destributions ships with libsecret and that will be the API to target if anybody want to store sensitive information securely in a linux desktop session.

[1] http://en.wikipedia.org/wiki/KWallet

[2] http://lwn.net/Articles/490518/

[3] https://github.com/mhogomchungu/lxqt_wallet

[4] https://addons.mozilla.org/en-US/firefox/addon/kde-wallet-pa...

[5] https://addons.mozilla.org/en-Us/firefox/addon/gnome-keyring...

[6] http://productforums.google.com/forum/#!topic/chrome/r65mTFM...

[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by MichaelGG on Sunday December 01, 2013 @03:05AM (#6826577)
Windows provides Data Protection APIs, which allow any program to encrypt data using a key that's derived from the user's password. Reset the password, lose that data. (It also has options for in-memory data, based on a user's session or process scope.)

It doesn't protect you from arbitrary code running in your security context that has access to your encrypted data. Without app-level verification (like kernel verifies current binary is signed and hasn't been tampered with), I'm not sure that's even possible.

[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by ams6110 on Saturday November 30, 2013 @08:32PM (#6825612)
Another gaping hole is how to recover the key when the user manages to delete it or lose it (new browser, new computer, etc).

This is all just dismissed as "not the subject of this post"

[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by spydum on Saturday November 30, 2013 @08:59PM (#6825688)
CRL. Just like you deactivate app tokens. Allow user to generate new cert and revoke their old ones.
[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by revelation on Saturday November 30, 2013 @06:52PM (#6825276)
As usual, if you can't trust the client machine, no solution is secure. Not even any mobile two way authentication.
[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by nly on Saturday November 30, 2013 @07:06PM (#6825338)
That's true, but there are outright trivial things a lot of sites just don't do to limit the impact of compromise. I just sold some Bitcoin for example (I know right...) and the exchange doesn't require any special credentials for initiating trades or withdrawals: just the same password and 2FA code I use to login to my account.

All the good stock trading sites I've used in the past have had separate trading passwords, it just makes sense.

[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by MichaelGG on Sunday December 01, 2013 @03:08AM (#6826582)
Do you often login to your Bitcoin exchange account without performing any write actions? If the majority if the time you're not logging into a read-only session, having an extra password seems rather pointless. If an attacker has compromised the 2FA system, they've most likely compromised your device.
[ Parent | on HN ]