MIT uses it, https://ca.mit.edu/, but its a constant source of helpdesk headaches. Managing renewals and revocation is hard.
Why is nobody using SSL client certificates?
41–50 of 160 posts
Re: Why is nobody using SSL client certificates?
#42I think the main problem is the effort of having to maintain a client certificate. I.e, backing it up and copying it on to other devices. It's so much easier to just remember a password, or write it down if you can't do that.
Re: Why is nobody using SSL client certificates?
#43Earlier quoted context omitted.
Do you have specific criticisms? In cryptography, a system that has withstood scrutiny for that long is a rare and exceedingly valuable thing. By all means use it as the ugly foundations that you hide beneath the beautiful edifice on top, but throwing it away would be madness.
I wouldn't say SSL "withstood scrutiny" after all. We now know that state actors routinely MIM popular services with rogue keys (Iran, Turkey, Egypt, China and Syria are the ones we know about ), and are happy to steal keys to distribute malware (US/Israel with Stuxnet). It was fairly robust in the 90s when knowledge was scarce, but as malicious actors got more confident with the technology, it started to show the cr…
Those are weaknesses in the signing authorities. Signing authorities are a layer of SSL, and a rather high one. It is possible to use SSL without them. I have an app I've written that uses SSL, and since it's essentially one thing we own talking to another thing we own (from a security perspective), there's no signing authority, no Verisign, no NSA, just, is this the exact SSL cert we issued to this SSL user or not?
Not that there aren't other problems at times with SSL, especially depending on how you use it, but your criticism may be more limited than you realize.
Re: Why is nobody using SSL client certificates?
#44This is the kind of tech Bump needs to get on -- auth and identity management. They showed a way a while back to upload an image by "bumping" your phone on your keyboard. Since phones are singular and ubiquitous and have their own identifiers, your phone could essentially become a makeshift physical key. You could log into any machine, public or private, with a simple "bump" of the keyboard. So Bump, if you're listening, create a Bump Auth.
Of course if you lost your phone or someone stole it, that would be problematic, but I don't anticipate you'd use this as a way to log into your bank account.
Re: Why is nobody using SSL client certificates?
#45That's just installing it on a desktop. Try installing an SSL certificate on a mobile browser.
Much easier on a smartphone managed with MDM. Some of the MDM platforms even include a pre-configured CA.
Re: Why is nobody using SSL client certificates?
#46I'm the author of this post which I have written in 2008. Since then my views have changed a bit: for one, the added security is debatable as the client cert is easily accessible to malware and thus could easily be stolen.
The other thing is that renegotiation is somewhat broken since that related security flaw in 2010ish, so you can't have parts of a site accessible without client certs and other parts requiring a cert.
This has been fixed since, but I don't know how well it's supported by clients.
Finally, compared to 2008, we're using many more devices for accessing various web applications now. Having the client cert bound to one browser on one machine is annoying and synchronizing it truly securely is probably impossible.
I do stand by the horrendous UI though. Even if the other issues weren't there, the UI certainly kills client certificates for normal users.
Then again, crypto UI is hard and I'm afraid the incentive for redesigning this is pretty much zero because nobody is using it to begin with and because it's flawed anyways.
Re: Why is nobody using SSL client certificates?
#47Yes, it's true. Not sure why it's news, other than it's a new article? This has been an abomination since .... the functionality was added. It's hard even for geeks to deal with it - it makes 0 sense for non-techies to even contemplate dealing with it. Relatedly, browser UI for dealing with cookies has been abysmal since day 1 as well. Instead of making cookie information easily visisble and manageable, browser maker…
>> This has been an abomination since .... the functionality was added. It's hard even for geeks to deal with it - it makes 0 sense for non-techies to even contemplate dealing with it.
Are you criticizing the concept or the implementation?
Conceptually, for a user to maintain 1 or 2 "identities" on a machine seems easier than maintaining 50 "logins", which already require a password manager if you're using reasonably hard passwords.
Re: Why is nobody using SSL client certificates?
#48Earlier quoted context omitted.
> Instead of making cookie information easily visisble and manageable How do /you/ suggest making base64 encoded blobs of context-less ID numbers understandable to the average browser user, assuming that they could be persuaded to care in the first place? Even as a geek who knows where to look, I look at the cookies from most sites and have no idea what they mean :P
doesn't particular matter if you know what they mean. A sidepanel that can open up at the click of an icon which tells me that 9 cookies were used, and they're set by google and yahoo and bing and 5 sites I've never heard of... that would give a lot of visibility immediately to people. Giving them an option of deleting/removing/blocking right from that sidepanel would empower people to be able to deal with it themsel…
When I click on the https padlock on this site, chromium shows me 1 ycombinator cookie and 0 third-pary cookies. In 2 clicks I can block the cookie, if I so choose.
Re: Why is nobody using SSL client certificates?
#49The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing. Email, single sign on, web site auth, etc. Works great!
I've always liked the idea of smart cards, but I also wonder how I would use a smart card to simultaneously log in to a site from, say, my PC and phone. It seems like the card can only be plugged in one place.
Re: Why is nobody using SSL client certificates?
#50Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice? I have a password on my phone, because I don't want people with access to it to be able to login and look at my stuff. What's to stop my friend Joe Blogs coming over my house and being able to read my email because I have one of these things installed that allows for a o…
Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice?
The most important difference is that attackers can't get it from the server and re-use it on others, since the server only needs to see the public key of the cert. Attackers can no longer break into a single server and get thousands of badly-secured passwords.
Of course, secure password hashing mitigates this issue, but that means we need to trust each and every server out there to implement that correctly (not likely), while this only requires a correct implementation from the browsers.