Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is nobody using SSL client certificates?

pilif.github.io

Post reply on HN
Print view View original

101–110 of 160 posts

Re: Why is nobody using SSL client certificates?

#101

Post by count »

wmf wrote: post #49
count wrote: post #11

The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing. Email, single sign on, web site auth, etc. Works great!

I've always liked the idea of smart cards, but I also wonder how I would use a smart card to simultaneously log in to a site from, say, my PC and phone. It seems like the card can only be plugged in one place.

That is, in fact, the point :) Using cards with your phone is a serious pain in the neck still, either way. You could always get an alternate token/card, so you have two you can use.

Re: Why is nobody using SSL client certificates?

#103

Post by NDizzle »

I used SSL client certificates with a Lotus system from 2000 to ~2011. They're still in use today, I just no longer work there.

It's pretty easy maintenance once you set up systems for account managers to generate and issue new certificates for people.

Then again, this was small time. Few thousand active users. Niche bio/pharma web application.

Large scale it could very well be a bitch and/or unnecessary at this point in time.

The system was designed/created between '96 and '98 and has used certificates the entire time.

Re: Why is nobody using SSL client certificates?

#106

Post by AjithAntony »

snuxoll wrote: post #68
jleehey wrote: post #40

Earlier quoted context omitted.

As a DoD CAC user and developer, this is correct (although the card readers at my company are built into the laptop or inserted via a USB adapter). I don't think there is a background agent that maintains the key though, I just think the card reader is queried when the certificate is needed. After the cert has been verified, you're free to pull the card out.

> After the cert has been verified, you're free to pull the card out. Last time I checked DoD systems are configured to automatically log you out of your session upon removal of your CAC.

I think this is a feature of the ActiveClient middleware. Also handles the PIN entry when you insert. Default windows behavior is to leave the certs in the cert store.

Re: Why is nobody using SSL client certificates?

#108

Post by superuser2 »

tomgirl1 wrote: post #5

Im at a loss, but my first instinct is to say that server certs arent validated properly AT ALL, so I fail to see how client certs would do any better. For all the hype over PFS (perfect forward secrecy) I dont see how how MITM attacks are stopped because cert validation is so bad or nonexistent I dont see applying more certs (plus diffie hellman) to be a solution.

The point isn't eavesdropping prevention, it's authentication that's not broken (like passwords).

Re: Why is nobody using SSL client certificates?

#109

Post by pilif »

gcb0 wrote: post #73
pilif wrote: post #46

I'm the author of this post which I have written in 2008. Since then my views have changed a bit: for one, the added security is debatable as the client cert is easily accessible to malware and thus could easily be stolen. The other thing is that renegotiation is somewhat broken since that related security flaw in 2010ish, so you can't have parts of a site accessible without client certs and other parts requiring a c…

the malware point is moot. malware can steals passwords saved, which are optionally saved encrypted. the cert at least in the one browser i checked is always encrypted. and even then, if you have malware in your box, any and all security measures are worthless at this point. decent Renegotiation and mobile client support will come if people using that on the desktop request the feature. it's like that for everything…

What I meant about malware is that client certificates can't provide additional security over passwords because malware can easily steal both.

So it's only hassle and no advantage, hence, useless

Re: Why is nobody using SSL client certificates?

#110

Post by [deleted] »

jlgaddis wrote: post #89
gcb0 wrote: post #73

Earlier quoted context omitted.

the malware point is moot. malware can steals passwords saved, which are optionally saved encrypted. the cert at least in the one browser i checked is always encrypted. and even then, if you have malware in your box, any and all security measures are worthless at this point. decent Renegotiation and mobile client support will come if people using that on the desktop request the feature. it's like that for everything…

Certificates can also be marked as non-exportable.

[deleted]
Post reply on HN