Re: Client Certificates. Was: GlobalPlatform Trusted User Interface spec

On Mon, Apr 1, 2013 at 6:35 AM, Anders Rundgren
<anders.rundgren@telia.com> wrote:
> On 2013-04-01 11:55, Jeffrey Walton wrote:
> <snip>
>>
>>> My guess is that the US will remain at its current position regarding
>>> strong authentication for consumers, i, e, at the _absolute_bottom_.
>
>> Client certificates are a good choice for client authentication, but
>> they suffer provisioning hardships and a number of UI issues.
>
> Yes, are these hardships incurable?
A good survey is available at
http://www2.futureware.at/svn/sourcerer/CAcert/SecureClient.pdf.

>> As for cell phones and second factors, that channel was breached in 2011
>> (http://financialcryptography.com/mt/archives/001349.html).
>
> You will always find people who claim that they can penetrate any security system.
> Does this motivate us sticking to static passwords (reused at multiple sites), forever?
> EMV-cards are not perfect (it has been proved) but the amount of fraud performed on
> the EMV-level are magnitudes lower than on the non EMV-ditto.
>
>
>> A client certificate means the consumer could be applying his/her
>> secret for an insecure/unknown server.
>
> Yes, I can surely login to "BadBank" with "GoodBank"'s client-certificate.
> Fortunately for me "BadBank" doesn't have my money and they cannot reuse the
> login information to "GoodBank" either.
>
>
>> It seems to me if the consumer
>> uses a non-hardened PKI with internet profiles, then all consumers
>> suffer - both US and abroad. Surely you have not forgotten the Dutch
>> CA Diginotar's failure affected all users, and Iranian users in
>> particular.
>
> As I see it, a working client-side PKI would be an important part of the
> puzzle making the Internet more secure since attacks on public SSL PKIs
> would become less useful.
>
> That is, there's no single solution that "does it all" but there are
> some pretty well identified areas worth improving.
Sections 3.2.1 Transaction Based Applications and 3.2.2
Non-Transaction Based Applications of
http://www2.futureware.at/svn/sourcerer/CAcert/SecureClient.pdf seem
very relevant for banking.

Jeff

Received on Monday, 1 April 2013 11:37:10 UTC