Re:Adding Easy SSL Client Authentication To Any Webapp
by derefr on Saturday November 30, 2013 @11:19PM
(#6826080)
In OSX, client certificates are stored in the Keychain, which must be unlocked with your password. The problem with almost every "security product" comes down to the fact that Windows (and Linux, I think) don't have equivalent protected-storage APIs integrated throughout the desktop environment.
[ Parent
| on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp
by mhogomchungu on Sunday December 01, 2013 @01:36AM
(#6826402)
linux has "equivalent protected-storage APIs integrated throughout the desktop environment",KDE has kwallet[1],GNOME has libsecret[2] and lxqt has lxqt wallet[3].Firefox has an extension to store its passwords in KDE's kwallet[4] and GNOME's gnome-keyring/libsecret[5].Chrome has support for both wallets[6]
all linux destributions ships with libsecret and that will be the API to target if anybody want to store sensitive information securely in a linux desktop session.
[1] http://en.wikipedia.org/wiki/KWallet
[2] http://lwn.net/Articles/490518/
[3] https://github.com/mhogomchungu/lxqt_wallet
[4] https://addons.mozilla.org/en-US/firefox/addon/kde-wallet-pa...
[5] https://addons.mozilla.org/en-Us/firefox/addon/gnome-keyring...
[6] http://productforums.google.com/forum/#!topic/chrome/r65mTFM...
Re:Adding Easy SSL Client Authentication To Any Webapp
by MichaelGG on Sunday December 01, 2013 @03:05AM
(#6826577)
Windows provides Data Protection APIs, which allow any program to encrypt data using a key that's derived from the user's password. Reset the password, lose that data. (It also has options for in-memory data, based on a user's session or process scope.)
It doesn't protect you from arbitrary code running in your security context that has access to your encrypted data. Without app-level verification (like kernel verifies current binary is signed and hasn't been tampered with), I'm not sure that's even possible.