Re: [TLS] HTTPS client-certificate-authentication in browsers

On 27 Jul 2011, at 07:34, Peter Gutmann wrote:

> Matt McCutchen <matt@mattmccutchen.net> writes:
> 
>> Your reference to people with PhDs in computer science is misleading: a PhD
>> is a highly specialized degree that does not necessarily imply broad computing
>> ability.
> 
> "OK, so you have a PhD. Just don't touch anything" :-).  That was just the
> first study, and I mentioned the PhD thing to avoid the "it was carried out on
> students, they're not representative" criticism.  Other studies were carried
> out on IT students (which I'd say is actually a good sample of very tech-savvy
> users, so they'd be non-representative in being too good a fit rather than too
> bad a fit), and possibly on random samples of people (I'd have to trawl
> through the refs again to see who all the subjects were).  From memory I don't
> think any were done on the Joe-Sixpack demographic, probably because the
> outcome would be a foregone conclusion ("Failure to enrol: 100%").

Yes, and the reason for this is very simple: every Joe six-pack is intelligent
enough to see that client side certificates gives him no advantage over 
username passwords! Why? For two reasons:

  - Most client side certificates only work only with one site (unless you are in
    the army, or a few places like that)
  - For that site you need a password anyway - in case you loose your certificate

Joe Six Pack has a lot of work, following what's going on TV and following complex
scores between football teams to be bothered learning something that gives no advantage.

( And here we are assuming that the testers would have understood how to make it easy 
  to do 1 click certificate creation, how to do logout properly, and how to develop a 
   web site that takes into account the special features of TLS - which I highly doubt. )

OpenId has the same problem: most sites ask you to login with an OpenID and then once you
have ask you for a username and password! Well how is anyone going to get the point of
OpenId if that is going to be the way they are introduced to it? 

Notice that Facebook Connect by giving access to a social graph provides in their 
authentication system an advantage that cannot be simply bypassed by the Relying Party:
no relying party is going to ask all the logged in users to enter all their social network
right after authentication. 

So this is where WebIDs advantage is: it decentralised Facebook Connect by tying it
to Client Side Certificates - removing one of its most problematic features. But
http://webid.info/ ties an identity into the social web. WebID allows the same CCA
to be used on ANY webiste that implements it, and at the same time to help that
site ( the Relying Party as they are known in this ugly jargon ) to get access to
the social graph of the user - if that user is interested in presenting it.

No as soon as you have those advantages, then the benefit to Joe Sixpack becomes obvious.
He can now login as a fan to any of the football league sites in one click, and comment
on discussions, play games, organise meetings, order tickets for football matches and 
so on. He can create a football social network that is not centralised in one country
or by one organisation. He can use his football fan credentials to login to a football
producer site - in one click - to explain what is wrong with the football they are making.
And if there is a beer advert on TV with a special offer for Fans he can get that in 
one click. 

That is how you convince football fans. Once you have convinced them, you can convince the
developers who are also football fans, because you have convinced their managers who 
can see the point in this. And you also convince the EFF because otherwise Facebook is
going to completely take over all authentication on the web and we really have a big 
brother situation. WebID is Freedom Box friendly.

Henry

- http://webid.info/
- http://www.freedomboxfoundation.org/


> 
> Peter.
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

Social Web Architect
http://bblfish.net/

Received on Wednesday, 27 July 2011 07:47:12 UTC