Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is nobody using SSL client certificates?

pilif.github.io

Post reply on HN
Print view View original

111–120 of 160 posts

Re: Why is nobody using SSL client certificates?

#111

Post by nicolas314 »

coda_ wrote: post #29

I haven't been able to get a client certificate working on Android at all (stock 4.2.2 with Chrome and Chrome Beta). Perhaps someone here has gotten them to work? I've posted in several forums and haven't found anyone that's gotten them to work.

It definitely works with recent Chrome versions. I use this daily to check my professional webmail on an Android 4.2.2. Once you have provisioned a PKCS#12 into your keystore, open Chrome onto an HTTPS web site that requires certificates from your issuer and the certificate choice dialog pops up.

Re: Why is nobody using SSL client certificates?

#112

Post by nicolas314 »

tptacek wrote: post #16

Try having two client certificates and seeing the browser UX for selecting which one to present to which site. You'll see why they aren't used. Client certificates should be much more popular in backend applications, where they're straightforward to use, flexible, and fairly trustworthy. But they're not a good end-user technology.

Agreed if you configure your HTTPS server to accept certificates from any issuer. But if you restrict it to a smaller list of CAs, users are only prompted to choose among their certificates matching those CAs.

Re: Why is nobody using SSL client certificates?

#113

Post by mcguire »

stonemetal wrote: post #100
mpyne wrote: post #94

Earlier quoted context omitted.

If you're actually on the DoD network that's only necessary in the rarest of cases. Retirees have to drive awhile sometimes, that's true, but they are not getting CAC anyways, they're getting old-style ID cards.

In my experience that is the common case, work for a defense contractor not on, but near a military base. I very well could be wrong though.

I don't work for the DoD, but you have the process right as far as I've seen. Don't forget that they seem to want a new set of fingerprints every time you go in.

Re: Why is nobody using SSL client certificates?

#114

Post by hpagey »

tlrobinson wrote: post #69
Spearchucker wrote: post #62

Earlier quoted context omitted.

It's easy enough to use on a smart card, but try setting that up. I'm trivialising now, but you're looking at... - Card manufacture - Key handling - Enrolment - Card lifecycle - Certificate lifecycle - Identity synchronisation You could buy a stack of white-labelled cards, of it you're the DoD you'd roll your own. That's shopping for silicon wafers, contact plate assemblies, mag stripes, holograms, RFID blanks, plast…

Sounds like a business opportunity.

There are several companies in this space. I was a research lead for smartcard access project for iOS platforms. We had to perform two way handshake using the certificates on the smart card. The most difficult part was to get data signed by the private key on the card during the handshake process.

Re: Why is nobody using SSL client certificates?

#115

Post by hpagey »

Client certificates won't work well if you are trying to authenticated against services inside the corporate network (sharepoint, microsoft exchange, AD) and your connection passes through proxies such as Microsoft TMG. Your SSL connection will be terminated at such a proxy and you will have to setup kerberos or impersonation. It is doable just tricky to setup.

Re: Why is nobody using SSL client certificates?

#116

Post by drchaos »

pilif wrote: post #109
gcb0 wrote: post #73

Earlier quoted context omitted.

the malware point is moot. malware can steals passwords saved, which are optionally saved encrypted. the cert at least in the one browser i checked is always encrypted. and even then, if you have malware in your box, any and all security measures are worthless at this point. decent Renegotiation and mobile client support will come if people using that on the desktop request the feature. it's like that for everything…

What I meant about malware is that client certificates can't provide additional security over passwords because malware can easily steal both. So it's only hassle and no advantage, hence, useless

Other than passwords, client certs cannot be guessed or generated with wordlists, they can not be used to authenticate to other sites even if stolen, and they cannot be forgotten (at least I tend to forget passwords for rarely used sites way more often than I lose data through HW failure).

So I'd say there are some advantages over passwords. And most of the functionality is already there, the only thing missing is a browser function to generate a keypair for a domain and send the public key, without much user interaction.

Re: Why is nobody using SSL client certificates?

#117

Post by vabmit »

superuser2 wrote: post #105

It's worth noting that MIT uses these. New students are provisioned client certs, which are accepted for login to institutional websites and even Apple's MIT student discount page. Not sure if any other universities are using this.

Yes. But, it's worth adding that MIT also uses a Shibboleth implementation (locally called Touchstone). On many core sites Touchstone handles authentication to the specific web servers. Touchstone itself can be authenticated to with either the individual X509 client cert or their password. Many people use password authentication to with the Touchstone server even though MIT has a website that (usually successfully)auto generates and installs the certificate in the user's browser.

Re: Why is nobody using SSL client certificates?

#118

Post by bascule »

pilif wrote: post #109
gcb0 wrote: post #73

Earlier quoted context omitted.

the malware point is moot. malware can steals passwords saved, which are optionally saved encrypted. the cert at least in the one browser i checked is always encrypted. and even then, if you have malware in your box, any and all security measures are worthless at this point. decent Renegotiation and mobile client support will come if people using that on the desktop request the feature. it's like that for everything…

What I meant about malware is that client certificates can't provide additional security over passwords because malware can easily steal both. So it's only hassle and no advantage, hence, useless

Client certs can't be phished

Re: Why is nobody using SSL client certificates?

#119

Post by mgkimsal »

nathan_long wrote: post #47
mgkimsal wrote: post #8

Yes, it's true. Not sure why it's news, other than it's a new article? This has been an abomination since .... the functionality was added. It's hard even for geeks to deal with it - it makes 0 sense for non-techies to even contemplate dealing with it. Relatedly, browser UI for dealing with cookies has been abysmal since day 1 as well. Instead of making cookie information easily visisble and manageable, browser maker…

>> This has been an abomination since .... the functionality was added. It's hard even for geeks to deal with it - it makes 0 sense for non-techies to even contemplate dealing with it. Are you criticizing the concept or the implementation? Conceptually, for a user to maintain 1 or 2 "identities" on a machine seems easier than maintaining 50 "logins", which already require a password manager if you're using reasonably…

implementation. that's why it's not being used.

Re: Why is nobody using SSL client certificates?

#120

Post by tokenizerrr »

nicolas314 wrote: post #112
tptacek wrote: post #16

Try having two client certificates and seeing the browser UX for selecting which one to present to which site. You'll see why they aren't used. Client certificates should be much more popular in backend applications, where they're straightforward to use, flexible, and fairly trustworthy. But they're not a good end-user technology.

Agreed if you configure your HTTPS server to accept certificates from any issuer. But if you restrict it to a smaller list of CAs, users are only prompted to choose among their certificates matching those CAs.

It's possible to self sign client certificates, right? If so, you could just limit the list to your own.
Post reply on HN