Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is nobody using SSL client certificates?

pilif.github.io

Post reply on HN
Print view View original

91–100 of 160 posts

Re: Why is nobody using SSL client certificates?

#91

Post by Aqua_Geek »

area51org wrote: post #37
lmm wrote: post #12

Earlier quoted context omitted.

Do you have specific criticisms? In cryptography, a system that has withstood scrutiny for that long is a rare and exceedingly valuable thing. By all means use it as the ugly foundations that you hide beneath the beautiful edifice on top, but throwing it away would be madness.

You're right, I'm being vague. I'm looking for two things, really: 1- simpler implementation — one that is easier for users to understand, and includes client certs by default 2- one with a re-engineered cryptographic implementation, one less likely to have the kind of numerous security flaws that have been uncovered in SSL/TLS over the years SSL was originally meant to serve two purposes: 1- encrypt communication 2-…

Verisign still verifies - at least to some extent. Last time I got a cert I had to take my business registration stuff to a notary and get them to notarize a statement to the effect that I am who I say I am, etc.

Re: Why is nobody using SSL client certificates?

#92

Post by peterwwillis »

gcb0 wrote: post #73
pilif wrote: post #46

I'm the author of this post which I have written in 2008. Since then my views have changed a bit: for one, the added security is debatable as the client cert is easily accessible to malware and thus could easily be stolen. The other thing is that renegotiation is somewhat broken since that related security flaw in 2010ish, so you can't have parts of a site accessible without client certs and other parts requiring a c…

the malware point is moot. malware can steals passwords saved, which are optionally saved encrypted. the cert at least in the one browser i checked is always encrypted. and even then, if you have malware in your box, any and all security measures are worthless at this point. decent Renegotiation and mobile client support will come if people using that on the desktop request the feature. it's like that for everything…

And managing multiple devices is actually a security boon. If your auth creds get stolen you'll know what specific device was compromised and can revoke the one vs a reset of all creds.

Also agree that malware is moot (it can steal auth tokens live as they're submitted, so even physical tokens requiring 2-factor pins get compromised).

The problem is browsers haven't been proactive in making the technology user friendly, so websites don't adopt it, so browsers don't make the technology user friendly. A couple large icons and good design decisions would make it as easy as logging into your screen saver.

Re: Why is nobody using SSL client certificates?

#93

Post by lotsofcows »

tptacek wrote: post #16

Try having two client certificates and seeing the browser UX for selecting which one to present to which site. You'll see why they aren't used. Client certificates should be much more popular in backend applications, where they're straightforward to use, flexible, and fairly trustworthy. But they're not a good end-user technology.

Not too bad on the Mac: prompts you to pick one when required. If you use more than one cert on a single site then you need to go into Keychain Access to delete the favoured cert for site thingy to make it prompt you each time. Move client certs to their own keychain to password protect them.

Re: Why is nobody using SSL client certificates?

#94

Post by mpyne »

stonemetal wrote: post #71
Spearchucker wrote: post #62

Earlier quoted context omitted.

It's easy enough to use on a smart card, but try setting that up. I'm trivialising now, but you're looking at... - Card manufacture - Key handling - Enrolment - Card lifecycle - Certificate lifecycle - Identity synchronisation You could buy a stack of white-labelled cards, of it you're the DoD you'd roll your own. That's shopping for silicon wafers, contact plate assemblies, mag stripes, holograms, RFID blanks, plast…

Enrolment is a hefty process. Apply for smart card. Personalise physical card (typically photo and name), provision (link card to user), give card to user, mail PIN to user (out of band), and then activate card. You missed the part where you drive several hours to the closest military base and wait in line several hours(think DMV and TSA all rolled into one).

If you're actually on the DoD network that's only necessary in the rarest of cases. Retirees have to drive awhile sometimes, that's true, but they are not getting CAC anyways, they're getting old-style ID cards.

Re: Why is nobody using SSL client certificates?

#96

Post by Cyranix »

chrisfarms wrote: post #13

I think this would need a total re-think before the masses could use. I'd love to see browsers implement it by forcing people to store client certs on a USB-key or a phone by default. I think some kind of physical item that contains your keychain would be much more intuitive to many. Everyone is familiar with mechanical keys, they know not to leave them around, they know that they need them to unlock things and they…

The analogy to mechanical keys doesn't hold up under closer scrutiny, though, right? House keys don't serve as an identity, just an access mechanism. You don't lose all future access to your house if you lose your keys; a locksmith can independently verify (with reasonable certainty) that it's okay for you to obtain a new set of keys which give access to the same house.

I feel like the human predisposition to risk aversion is even more of a factor preventing adoption among average users than poor UX (not to mention lack of awareness). What do I tell my parents when they ask "What if my computer crashes? Would I not be able to log in to the website and see my stuff? What good is using a website if I can't access it from any computer?"

Until something as securely portable and loss-resistant as one's own memory is achieved, I don't see passwords being less popular than any other access mechanism for the average user, no matter how significant the other downsides.

Re: Why is nobody using SSL client certificates?

#97

Post by jlgaddis »

andyhmltn wrote: post #14

Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice? I have a password on my phone, because I don't want people with access to it to be able to login and look at my stuff. What's to stop my friend Joe Blogs coming over my house and being able to read my email because I have one of these things installed that allows for a o…

> What's to stop my friend Joe Blogs coming over my house and being able to read my email ...

The PIN.

X.509 certificates are protected by a PIN in the same way that an SSH key pair is protected by a passphrase. Even if you "physically" obtain the private key, you still need the PIN that protects it before you can use it.

(side note: you can use an X.509 certificate for SSH authentication)

Re: Why is nobody using SSL client certificates?

#98

Post by yxhuvud »

tlrobinson wrote: post #69
Spearchucker wrote: post #62

Earlier quoted context omitted.

It's easy enough to use on a smart card, but try setting that up. I'm trivialising now, but you're looking at... - Card manufacture - Key handling - Enrolment - Card lifecycle - Certificate lifecycle - Identity synchronisation You could buy a stack of white-labelled cards, of it you're the DoD you'd roll your own. That's shopping for silicon wafers, contact plate assemblies, mag stripes, holograms, RFID blanks, plast…

Sounds like a business opportunity.

There are already companies in this space though.

One example is secmaker.com, but I don't know if they operate outside .se yet.

Re: Why is nobody using SSL client certificates?

#99

Post by johnmacintyre »

gcb0 wrote: post #73
pilif wrote: post #46

I'm the author of this post which I have written in 2008. Since then my views have changed a bit: for one, the added security is debatable as the client cert is easily accessible to malware and thus could easily be stolen. The other thing is that renegotiation is somewhat broken since that related security flaw in 2010ish, so you can't have parts of a site accessible without client certs and other parts requiring a c…

the malware point is moot. malware can steals passwords saved, which are optionally saved encrypted. the cert at least in the one browser i checked is always encrypted. and even then, if you have malware in your box, any and all security measures are worthless at this point. decent Renegotiation and mobile client support will come if people using that on the desktop request the feature. it's like that for everything…

I agree with your malware point. If your system is compromised, and attackers are past the 'airtight hatchway', then you're doomed anyway.

Re: Why is nobody using SSL client certificates?

#100

Post by stonemetal »

mpyne wrote: post #94
stonemetal wrote: post #71

Earlier quoted context omitted.

Enrolment is a hefty process. Apply for smart card. Personalise physical card (typically photo and name), provision (link card to user), give card to user, mail PIN to user (out of band), and then activate card. You missed the part where you drive several hours to the closest military base and wait in line several hours(think DMV and TSA all rolled into one).

If you're actually on the DoD network that's only necessary in the rarest of cases. Retirees have to drive awhile sometimes, that's true, but they are not getting CAC anyways, they're getting old-style ID cards.

In my experience that is the common case, work for a defense contractor not on, but near a military base. I very well could be wrong though.
Post reply on HN