Re: end of useable crypto in browsers?

[Seth Arnold <seth.arnold () canonical com>]

On Sat, Apr 09, 2016 at 11:34:26AM +0200, Árpád Magosányi wrote:
> Browser developers are dropping support for X509 key generation.
> Yes, <keygen> have its problems. But window.crypto - which is meant to
> replace it - have no way to save keys in the browser's keystore.
> [..]
> Any ideas on how to make them understand the scale of the doom we are
> facing right now?

The only TLS client certificate authentication I see on a regular basis
is for CertFP use for IRC nickserv authentication and OpenVPN. Trying to
use a browser to perform either of these actions would be awkward at best.

What application or service do you know of that uses TLS client
authentication that requires browser integration? If you can demonstrate
users who will be affected they may be more amenable to your claims. (I
suspect the browser authors already know how many services use TLS client
authentication from their own telemetry systems. What may be harder to
gauge via telemetry is how important it is to the users.)

Thanks

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/