Why is nobody using SSL client certificates?
pilif.github.io
Why is nobody using SSL client certificates?
1–10 of 160 posts
Re: Why is nobody using SSL client certificates?
#2Yep -- too hard to setup.
A really good browser enhancement would be 1-click client side certificate setup.
Re: Why is nobody using SSL client certificates?
#3The key management tools are awful. People complain about the complexity of PGP but at least there it's one-click to export a key, look at the details of it, sign someone else's key etc.
But yeah, it would be nice to use this tech rather than reinventing the wheel. The underlying implementation is sound.
Re: Why is nobody using SSL client certificates?
#4Yep -- too hard to setup. A really good browser enhancement would be 1-click client side certificate setup.
Pretty sure that you could write an Firefox addon for this.
Re: Why is nobody using SSL client certificates?
#5Im at a loss, but my first instinct is to say that server certs arent validated properly AT ALL, so I fail to see how client certs would do any better.
For all the hype over PFS (perfect forward secrecy) I dont see how how MITM attacks are stopped because cert validation is so bad or nonexistent I dont see applying more certs (plus diffie hellman) to be a solution.
Re: Why is nobody using SSL client certificates?
#6The key management tools are awful. People complain about the complexity of PGP but at least there it's one-click to export a key, look at the details of it, sign someone else's key etc. But yeah, it would be nice to use this tech rather than reinventing the wheel. The underlying implementation is sound.
The whole system, now close to 20 years old, needs a reboot. I know, that's easy for me to say. But it's showing its age, and could really benefit from a complete rethink.
Re: Why is nobody using SSL client certificates?
#7That's just installing it on a desktop. Try installing an SSL certificate on a mobile browser.
Re: Why is nobody using SSL client certificates?
#8Yes, it's true. Not sure why it's news, other than it's a new article?
This has been an abomination since .... the functionality was added. It's hard even for geeks to deal with it - it makes 0 sense for non-techies to even contemplate dealing with it.
Relatedly, browser UI for dealing with cookies has been abysmal since day 1 as well. Instead of making cookie information easily visisble and manageable, browser makers resorted to shifting cookie mgt stuff around in 'preferences' a few times (is it 'privacy'? or 'advanced'? why not 'cookies'?), and people champion using specific browsers with specific plugins as an optimal solution.
Client certs are even worse off - few people even bother to write plugins to deal with this stuff. It's chicken/egg as well - no point in updating browsers to be better if no servers will modify their code to deal with it.
Re: Why is nobody using SSL client certificates?
#9That's just installing it on a desktop. Try installing an SSL certificate on a mobile browser.
Both iOS and Android allow you to easily provision keys to a device...
Re: Why is nobody using SSL client certificates?
#10While the UX side of things could be made quite simpler, but I think a significant hurdle for client certificates is authentication through proxies.