Posted October 16, 2016
Dear all,
Among the reasons giving ground to two factor authentication is the fact that many people use the same or very similar passwords for their ever increasing number of accounts on the net.
There's a solution to this that's been implemented in all major browsers for a looooong time now : client certificates.
1) One certificate could be used by an individual to login everywhere
2) If a website's security is compromised, the leaked data could not be used to login to another website where the same certificate is used to login.
3) A single password can be used to protect the private key associated with the client certificate.
Hence a single password could be used to login everywhere, securely.
There are a few things to be aware of, however :
1) Same certificate, same identifier. People who don't want to have a unique ID would have to use different certificates, but that's similar to the current situation. The same password could be used to protect different certificates with no identity disclosure.
2) In the same way as passwords, it's better to change a certificate on a regular basis.
3) A certificate is not a thing that can only be bought at Verisign/Digicert or whatever : you can make your own for free. What these providers are supposed to sell you is the guarantee that you're the one you're pretending to be, sometimes requiring as much as physical presence and ID check (that's what Verisign's "Class 3" means). This is particularly useful on the server side. GOG for example uses a Cybertrust server certificate, and Cybertrust guarantees the certificate has been delivered to GOG. This type of guarantee is not usually required by the server from the user.
Hence I suggest that GOG implements certificate login.
Among the reasons giving ground to two factor authentication is the fact that many people use the same or very similar passwords for their ever increasing number of accounts on the net.
There's a solution to this that's been implemented in all major browsers for a looooong time now : client certificates.
1) One certificate could be used by an individual to login everywhere
2) If a website's security is compromised, the leaked data could not be used to login to another website where the same certificate is used to login.
3) A single password can be used to protect the private key associated with the client certificate.
Hence a single password could be used to login everywhere, securely.
There are a few things to be aware of, however :
1) Same certificate, same identifier. People who don't want to have a unique ID would have to use different certificates, but that's similar to the current situation. The same password could be used to protect different certificates with no identity disclosure.
2) In the same way as passwords, it's better to change a certificate on a regular basis.
3) A certificate is not a thing that can only be bought at Verisign/Digicert or whatever : you can make your own for free. What these providers are supposed to sell you is the guarantee that you're the one you're pretending to be, sometimes requiring as much as physical presence and ID check (that's what Verisign's "Class 3" means). This is particularly useful on the server side. GOG for example uses a Cybertrust server certificate, and Cybertrust guarantees the certificate has been delivered to GOG. This type of guarantee is not usually required by the server from the user.
Hence I suggest that GOG implements certificate login.