Maybe Passwords Are the Future(kevincox.ca)
kevincox.ca
Maybe Passwords Are the Future
https://kevincox.ca/2022/04/07/passwords/
4 comments
Don't TLS certs have domains they're valid for in the cert? (I admit it's been a while since I looked at this.) That would make them hard to phish.
Oops, this was a mistake. I don't think most browsers have a way to restrict client certs to specific domains but since asymmetric cryptography is used, and the key agreement ensures no MITM, no phishing is possible. (They may ask for your cert but can't use that to authenticate with the correct host.)
I've pushed a fix.
I've pushed a fix.
Some platforms may have a way to remember a client certificate as a preference, but you can't really bind a certificate to only specific sites.
If you can find a way to abuse a valid authentication to one site in order to gain access to another site, that sounds like a very firmly valid security issue needing investigated.
If you can find a way to abuse a valid authentication to one site in order to gain access to another site, that sounds like a very firmly valid security issue needing investigated.
I too believe passwords will have their role in the future - although I'd love to see their roles swapped: WebAuthn as first authentication factor - passwords as the optional MFA.