<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
On 11/03/2008 10:24 AM, Ben Laurie:<br>
<blockquote
cite="mid:1b587cab0811030024o56173a18taebca248416e5c84@mail.gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">
You mean something like client certificate authentication?
</pre>
</blockquote>
<pre wrap=""><!---->
Not really - you still have to issue the client cert somehow. In
practice, this pretty much always involves the user proving knowledge
of some secret. It is that secret that I would like to protect in
transit.
</pre>
</blockquote>
Well, not sure which "secret" you mean here. The only secret with
client certs is the private key which is generated in the browser or
smart card and stored within the relevant security module. However your
idea of the browser providing "phishing resistant password<span
class="moz-txt-citetags"> </span>scheme"
is what I meant to question really, since there are no phishing
resistant user name / pass word pairs - it simply doesn't exist.<br>
<br>
Client certificate authentication can't be phished.<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>