Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is nobody using SSL client certificates?

pilif.github.io

Post reply on HN
Print view View original

131–140 of 160 posts

Re: Why is nobody using SSL client certificates?

#131

Post by krilnon »

vabmit wrote: post #117
superuser2 wrote: post #105

It's worth noting that MIT uses these. New students are provisioned client certs, which are accepted for login to institutional websites and even Apple's MIT student discount page. Not sure if any other universities are using this.

Yes. But, it's worth adding that MIT also uses a Shibboleth implementation (locally called Touchstone). On many core sites Touchstone handles authentication to the specific web servers. Touchstone itself can be authenticated to with either the individual X509 client cert or their password. Many people use password authentication to with the Touchstone server even though MIT has a website that (usually successfully)au…

Any idea how many people primarily use passwords? Personally, I've always found it really convenient to use certs for MIT and CSAIL stuff.

Re: Why is nobody using SSL client certificates?

#132

Post by jpalomaki »

Using the TPM to store the client certificates would prevent malware from stealing them. I have no experience on this, but quick search revealed something[1].

Maybe one use for securely stored client side certs would to mark the computer as trusted. For example now Google is probably using cookies to determine that my desktop is trusted and thus I don't need the two-factor authentication to log in. TPM and client side certs could provide more secure alternative for this.

[1] http://blog.habets.pp.se/2012/02/TPM-backed-SSL

Re: Why is nobody using SSL client certificates?

#133

Post by jes5199 »

tptacek wrote: post #16

Try having two client certificates and seeing the browser UX for selecting which one to present to which site. You'll see why they aren't used. Client certificates should be much more popular in backend applications, where they're straightforward to use, flexible, and fairly trustworthy. But they're not a good end-user technology.

Speaking of backend applications, Puppet uses client certificates to authenticate machines that are being administrated by a Puppet server. I used to work on that code - none of us would have ever called it "straightforward". The library support for client certs is underdeveloped and poorly documented - probably because so few people are using client certs in production.

Re: Why is nobody using SSL client certificates?

#134

Post by michaelt »

count wrote: post #79
snuxoll wrote: post #68

Earlier quoted context omitted.

> After the cert has been verified, you're free to pull the card out. Last time I checked DoD systems are configured to automatically log you out of your session upon removal of your CAC.

This is an unrelated security measure, but you are correct. And if you pull the card out, you can't access anything anymore that requires it (and on a Windows domain that DOESNT lock / terminate the session, you'll be able to access things until your kerberos ticket expires or you need to get to something you don't have a ticket for).

I once volunteered at a hospital where they made use of a smart card security system - among other things, it would log you out if you removed your card from the reader. This closed all the programs you were running - and logging back in was a slow process.

Needless to say, the smart cards stayed in the users' PCs even when they weren't at their desks.

Re: Why is nobody using SSL client certificates?

#135

Post by m_ram »

aroch wrote: post #9
wmil wrote: post #7

That's just installing it on a desktop. Try installing an SSL certificate on a mobile browser.

Both iOS and Android allow you to easily provision keys to a device...

Thanks for that. In case anyone else is interested: https://support.google.com/nexus/4/answer/2844832?hl=en

Re: Why is nobody using SSL client certificates?

#136

Post by icebraining »

616c wrote: post #122
icebraining wrote: post #34

Earlier quoted context omitted.

It's so annoying that OpenID providers either support client certs or using your own domain, but never both!

I have not tried both, so I did not experience this problem. I do know SSL client certs do not work well, and wanted to work on building my own solution that does what StartSSL (an OpenID endpoint with SSL-cert based authentication). Does anyone know of ways to do this?

Nginx supports client certs[1], so I'd say the easiest way to get started is to get some free OpenID server (SimpleID[2] seems maintaned) and configure nginx to require cert authentication to access the login path.

I'd do it myself, if I used OpenID more than once every two months or so.

[1]: http://nategood.com/client-side-certificate-authentication-i...

[2]: http://simpleid.koinic.net/

Re: Why is nobody using SSL client certificates?

#137

Post by zoidb »

pilif wrote: post #46

I'm the author of this post which I have written in 2008. Since then my views have changed a bit: for one, the added security is debatable as the client cert is easily accessible to malware and thus could easily be stolen. The other thing is that renegotiation is somewhat broken since that related security flaw in 2010ish, so you can't have parts of a site accessible without client certs and other parts requiring a c…

Adding to your third point I am pretty sure there is still awful mobile browser support for client certs which is a dealbreaker just about every site out there these days

Re: Why is nobody using SSL client certificates?

#138

Post by tptacek »

jes5199 wrote: post #133
tptacek wrote: post #16

Try having two client certificates and seeing the browser UX for selecting which one to present to which site. You'll see why they aren't used. Client certificates should be much more popular in backend applications, where they're straightforward to use, flexible, and fairly trustworthy. But they're not a good end-user technology.

Speaking of backend applications, Puppet uses client certificates to authenticate machines that are being administrated by a Puppet server. I used to work on that code - none of us would have ever called it "straightforward". The library support for client certs is underdeveloped and poorly documented - probably because so few people are using client certs in production.

I feel like I've written a fair bit of client certificate code in Ruby and haven't had much of a problem. Where did you run into problems?

Re: Why is nobody using SSL client certificates?

#139

Post by paxswill »

arscan wrote: post #32
count wrote: post #11

The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing. Email, single sign on, web site auth, etc. Works great!

True, it works great for the average dod user (and in an enterprise in general) because they have a helpdesk that sets everything up for them. Once its configured it works fine, which is consistent with the message of this article. Good luck to them if they want to install a different browser (non-IE) or do anything non-standard... if they even are allowed to do so.

For a while I was checking upcoming OS X releases for CAC compatibility. At least on OS X, it's surprisingly easy to get set up, with the hardest step finding a compatible card reader. Once you have that, you usually have to install a PKCS#11 module (usually CACKey for DoD). Once that's all done, it's presented as an additional Keychain for the rest of the system to use. I know Chrome and Safari work with it without further fiddling, and I'm pretty sure Firefox will as well.

Re: Why is nobody using SSL client certificates?

#140

Post by RyJones »

mcguire wrote: post #113
stonemetal wrote: post #100

Earlier quoted context omitted.

In my experience that is the common case, work for a defense contractor not on, but near a military base. I very well could be wrong though.

I don't work for the DoD, but you have the process right as far as I've seen. Don't forget that they seem to want a new set of fingerprints every time you go in.

Try when you don't have prints. Took a long time to get my card issued.
Post reply on HN