What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

See: Cutting the Gordian Knot of Web Identity

Please consider adding certificate-based authentication to Stack Exchange as another form of authentication. I believe this method of authentication is probably closest to what Jeff describesas a good solution in his blog.

It sure seems like this should be pretty easy to implement. It should be as trustworthy for proving the identity of someone as trusting 3rd party identity providers, or simple cookies for authentication. You already support multiple authentication providers adding another seems like it would be easy.

Certificate based authentication isn't very common at the moment, but has many of the properties Jeff seemed to desire in his blog. The only way it might become common if someone big actually does it, and does it well. Providing certificate based authentication as on option on a platform many developers use seems like a good way to let people test it out and see how easy it could work.

Doing the certificate authentication should be easy. Just setup a page, which requires a certificate. If you have never seen the public certificate that is offered by the browser before, then ask the user if they wish to associate the certificate with an existing account or create a new one, store the certificate for future logins to that account. If you have seen the public cert before, then look up the account details and log the user in. Please be sure to allow a user to have a few certificates stored, and give them an easy way to manage the certs associated with their account.

I would suggest that you should not care about what CA the certificate is signed by. Just accept any certificate signed by any CA, or self-signed. I don't think the CAs really offer much useful for stacexchange. Just trust that the first use of a certificate is from the user it belongs to.

share|improve this question
3  
I already do exactly this with my own OpenID provider. That's the beauty of OpenID. I'd be willing to bet there were other OpenID providers out there doing this too. –  Flexo Sep 7 '11 at 17:33
    
+1 This is a great idea. This could really help to drive cert based authentication into reality. –  squillman Sep 7 '11 at 19:06
1  
I agree with @awoodland. Maybe the SE OpenID provider could support certificates then (and even issue SE-signed certificates, without any third-party trusted root), but I don't see the need for support on SE sites themselves. –  Arjan Sep 7 '11 at 21:10
    
@Arjan, supporting cert-based auth for the SE OpenID provider seems like it would be an easy to implement way to provide certificate based authentication. If they did implement something I expected they would do something that would be network wide. –  Zoredache Sep 7 '11 at 21:40

1 Answer 1

If you trust all certificates you accomplish absolutely nothing with X.509 in terms of knowing who the person is. You could associate with cacert.org, in fact, I don't know where else anyone is going to get a personal cert from except a self-signed one.

If all you use certs for is to allow the creator of an account to associate arbitrary public keys, you do save them typing their passwords. However, the entire state of the X.509 universe is horrible, and I would personally not consider ever inviting a user to make themselves miserable by trying to use the tools involved.

share|improve this answer
    
Why? I don't need a third-party service to agree on a password either. A self-signed one is just as good for this purpose, I think. –  Arjan Sep 7 '11 at 21:08
    
And using X.509 instead of any other mechanism is just nice as all browsers support installing such certificates. (But you're right that creating self-signed certificates might not be doable for everybody.) –  Arjan Sep 7 '11 at 21:16
    
We don't need a 3rd party (CA) to know that the identity you provide today (public key) is the same as the identity you provided yesterday. The 3rd party (CA) is in only around to provide confirmation that you are actually are who your certificate claims you are. I think the system offers value without that confirmation from a 3rd party be useful on stackexchange. On stackexchange we already trust any account created on google, yahoo, twitter, etc as legit. It would be far easier to build a fake webmail account then it would be to steal a properly protected private key. –  Zoredache Sep 7 '11 at 21:20
    
@Zor thus my second paragraph. –  Rosinante Sep 7 '11 at 21:24
    
I am sure someone could build a cross-platform tool script to run openssl / makecert or even a browser plugin. If there are no public services that accepts certificates nobody is going to actually spend any time building a tools make the key/cert easy. Jeff seems willing to use stackexchange to be a leader in the area of identity. Permitting auth via cert seems like something he could easily do to encourage authentication by certificate. –  Zoredache Sep 7 '11 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .