Hacker News Reader

Comment by Willamin | Hacker News Reader

I wonder why SSL Client Certificate Authentication hasn't become popularized for the web.

1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.

View on HN

Perhaps one the main reasons is that a large number of people use multiple devices or even multiple browsers on the same device. Not sure how SSL client certificate authentication accommodates that.

Because the UI for managing client certificates is terrible, with no real support for distributing a cert to multiple endpoints unless you're in an enterprise environment with device management, or issuing smart cards and readers. I do think there's legs in client certs for enterprise authentication, but for consumer products it's a non-starter.

I wonder if this is something that cloud password managers like 1Password could tackle.

It's the way Spanish government webapps work with the citizens but it's a bit confusing to be honest. When it works it's perfect but the setup is complicated, so they're introducing an optional user/password login also.

Isn't the problem with this that it means your account is tied to your browser install? Eg, you'd need to copy the cert to another machine to sign in, would need to ensure it's backed up, etc.

Password management already is to basically that extent and the tools to copy that information around, backup, etc. also have come into existence to support usage beyond a single browser install.

That's half true, password management piggybacks on top of a system which doesn't have these characteristics, so it means no special work needs to be done on the development side to support them, and it's activation function is only determined on one side of each edge (the user side.) For this cert system to work, you have a bit of a chicken-and-egg problem since it requires both sides of the user-service graph to have done work pre-emptively to support it.

It would be really, drastically lovely if that were to happen. For bonus points, encrypt the client certs with a master password and sync between a user's devices.

UIs to use client certificates are terrible, and key and certificate storage almost always involves a password anyway.

My day job occasionally involves a WebDAV server protected with a normal login plus a client certificate. Sometimes I need to explain the process to less technically literate people who use different client software than I do, and the certificate part is a total pain.

Reply on news.ycombinator.com