Johnathan Nightingale wrote:
On 17-Mar-09, at 7:55 AM, Ian G wrote:
Doing some research on bugzilla, it transpires that the default is to
always ask before using a client certificate, because otherwise we
have a privacy issue.
<https://bugzilla.mozilla.org/show_bug.cgi?id=295922> Now, this is a
bit of a killer issue, because the certs probably have info in them,
and there are obvious harvesting possibilities [2] [3].
However, the fix is to turn on the "ask always" default, which makes
client certs unusable [4] because every click there is a request for
confirmation, and sometimes there are several clicks.
Starting from a point of basic agreement that client certs need to be a
lot more usable than they currently are, I'll nevertheless point out
that your experience isn't the typical one, here. As you mention in
your footnote, there appears to be some brokenness with your testing
server wrt SSL sessions. The initial client cert auth should be used to
establish an authenticated session, which the server should persist for
some period of time thereafter, making subsequent identifications less
onerous. Nelson has commented on bugs of this ilk before, I hope he's
around for this thread as well.
That isn't necessarily going to help; for some (actually, most) https
connections, I don't want to use a client cert at all, in which case I
would need to click cancel every time anyway. Unfortunately, this means
I end up getting prompted over and over again. (Of course, I last tried
using certs in the context of IRC connections...)
--
Mook
--
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
