Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is nobody using SSL client certificates?

pilif.github.io

Post reply on HN
Print view View original

21–30 of 160 posts

Re: Why is nobody using SSL client certificates?

#21

Post by jgrahamc »

tptacek wrote: post #16

Try having two client certificates and seeing the browser UX for selecting which one to present to which site. You'll see why they aren't used. Client certificates should be much more popular in backend applications, where they're straightforward to use, flexible, and fairly trustworthy. But they're not a good end-user technology.

I agree that for machine to machine communication client certificates work well. Especially if you implement your own CA so you don't worry about the public infrastructure.

Re: Why is nobody using SSL client certificates?

#22

Post by mtrimpe »

andyhmltn wrote: post #14

Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice? I have a password on my phone, because I don't want people with access to it to be able to login and look at my stuff. What's to stop my friend Joe Blogs coming over my house and being able to read my email because I have one of these things installed that allows for a o…

I don't know what browsers do, but it's fairly easy to password protect these keys.

If you then keep the key accessible until some timeout (whether maximum or idle time) occurs then you've got pretty good security.

That's what you already get if you use LastPass e.a.

Re: Why is nobody using SSL client certificates?

#23

Post by rmoriz »

Same goes for S/MIME which uses X.509, too. But S/MIME recently got traction and usability again because of OSX Mail.app and iOS mail support.

People should really consider S/MIME for mail encryption as nearly every MUA (mail client) can deal with it and large institutions already use it (e.g. for SSO)

https://gist.github.com/rmoriz/5945400

Re: Why is nobody using SSL client certificates?

#24

Post by 7952 »

I find it hard to believe that client certs offer much advantage over cookies for most normal web sites.

Even if it was common practice you would still need some way to recover an account after loosing a certificate, at which point an email will be sent out with a password equivalent reset token, so why not just use a password?

Storing certs client side just creates another target for malware, even if the certificate is password protected. You could move the certificate to a key fob, but at that point why not just use a separate second factor token? You would either have a full sense of security, or have to trust that the client machine is fully secure (impossible).

It is much more sense to focus on making cookies as secure as possible by setting secure headers, and invalidating cookies that come from a machine that is different than expected.

Re: Why is nobody using SSL client certificates?

#25

Post by Shish2k »

mgkimsal wrote: post #8

Yes, it's true. Not sure why it's news, other than it's a new article? This has been an abomination since .... the functionality was added. It's hard even for geeks to deal with it - it makes 0 sense for non-techies to even contemplate dealing with it. Relatedly, browser UI for dealing with cookies has been abysmal since day 1 as well. Instead of making cookie information easily visisble and manageable, browser maker…

> Instead of making cookie information easily visisble and manageable

How do /you/ suggest making base64 encoded blobs of context-less ID numbers understandable to the average browser user, assuming that they could be persuaded to care in the first place?

Even as a geek who knows where to look, I look at the cookies from most sites and have no idea what they mean :P

Re: Why is nobody using SSL client certificates?

#26

Post by mtrimpe »

tomgirl1 wrote: post #5

Im at a loss, but my first instinct is to say that server certs arent validated properly AT ALL, so I fail to see how client certs would do any better. For all the hype over PFS (perfect forward secrecy) I dont see how how MITM attacks are stopped because cert validation is so bad or nonexistent I dont see applying more certs (plus diffie hellman) to be a solution.

They're as secure as your ability to keep the private keys private, just like with server certs.

As far as MITM and PFS goes; that's handled just the same as regular SSL. Using a client cert doesn't affect that at all.

Re: Why is nobody using SSL client certificates?

#28

Post by tomgirl1 »

mtrimpe wrote: post #26
tomgirl1 wrote: post #5

Im at a loss, but my first instinct is to say that server certs arent validated properly AT ALL, so I fail to see how client certs would do any better. For all the hype over PFS (perfect forward secrecy) I dont see how how MITM attacks are stopped because cert validation is so bad or nonexistent I dont see applying more certs (plus diffie hellman) to be a solution.

They're as secure as your ability to keep the private keys private, just like with server certs. As far as MITM and PFS goes; that's handled just the same as regular SSL. Using a client cert doesn't affect that at all.

Which is not secure at all. you can MITM a typical SSL connection in so many ways SSL might as well not exist.

No real cert validation, forged certs, proxy replays. SSL is a joke.

Re: Why is nobody using SSL client certificates?

#29

Post by coda_ »

I haven't been able to get a client certificate working on Android at all (stock 4.2.2 with Chrome and Chrome Beta). Perhaps someone here has gotten them to work? I've posted in several forums and haven't found anyone that's gotten them to work.

Re: Why is nobody using SSL client certificates?

#30

Post by lcampbell »

akama wrote: post #20
count wrote: post #11

The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing. Email, single sign on, web site auth, etc. Works great!

I would love to hear more about this. I've been looking for a good sso solution that uses crypto cards.

My understanding is that the private key is on a CAC card[1,2], which is issued to all DoD employees and contractors who need access to DoD resources. Readers are usually built into the keyboard, and I'm guessing that there's something similar to ssh-agent running to maintain the key until you're AFK.

--

[1] http://en.wikipedia.org/wiki/Common_Access_Card

[2] http://www.cac.mil/

Post reply on HN