Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Why can't we be using client certificates generated and stored and synced this same way instead of passwords?! Imagine a world without cookies...


Because that would mean you could only log in with computers storing your cert. Passwords might have lots of drawbacks, but it allows you to log in from anywhere on any computer without any other requirements beside remembering it. I don't see this property in any of the proposed solutions to replace passwords thus far.


You remember one password... and then can access your master password list.


And where is stored this master password then? If it's on your browser/computer, it's not portable. If it's online, it's possibly less secure (especially if you're not the one hosting it). A physical token might work, but it's usually too specific and not scalable.

Nothing beats plain old password as convenience, that's why they are still so wildly used despite lousy security properties.


This. Servers are moving to SSL everywhere. Why not have client ssl certs generated when you first install a browser? No cookies, like you said, AND the servers get client authentication built in.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: