Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Why can't we be using client certificates generated and stored and synced this same way instead of passwords?! Imagine a world without cookies...


Because that would mean you could only log in with computers storing your cert. Passwords might have lots of drawbacks, but it allows you to log in from anywhere on any computer without any other requirements beside remembering it. I don't see this property in any of the proposed solutions to replace passwords thus far.


You remember one password... and then can access your master password list.


And where is stored this master password then? If it's on your browser/computer, it's not portable. If it's online, it's possibly less secure (especially if you're not the one hosting it). A physical token might work, but it's usually too specific and not scalable.

Nothing beats plain old password as convenience, that's why they are still so wildly used despite lousy security properties.


This. Servers are moving to SSL everywhere. Why not have client ssl certs generated when you first install a browser? No cookies, like you said, AND the servers get client authentication built in.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: