<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 11/03/2008 11:38 AM, Ben Laurie:<br>
<blockquote
cite="mid:1b587cab0811030138m3a4aa950rda9c1d5d11a047cb@mail.gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">
Well, not sure which "secret" you mean here. The only secret with client
certs is the private key which is generated in the browser or smart card and
stored within the relevant security module. However your idea of the browser
providing "phishing resistant password scheme" is what I meant to question
really, since there are no phishing resistant user name / pass word pairs -
it simply doesn't exist.
</pre>
</blockquote>
<pre wrap=""><!---->
Really? Why not? What about SRP or J-PAKE?
</pre>
</blockquote>
<br>
Isn't OpenID actually similar to what SRP does in some way? In any case
it's by the use of yet another third party server...and then you are at
the same point more or less, isn't it?<br>
<br>
<blockquote
cite="mid:1b587cab0811030138m3a4aa950rda9c1d5d11a047cb@mail.gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">Client certificate authentication can't be phished.
</pre>
</blockquote>
<pre wrap=""><!---->
I know. My point was that in order to acquire a client certificate,
you have to somehow prove who you are - usually by showing you know
some secret.</pre>
</blockquote>
<br>
No, it doesn't have to be. Usually client certificates are used mainly
for S/MIME (which requires the validation of some email address), but
they can function for authentication (and authentication only, without
the S/MIME capabilities). The only exchange is really the public key
submitted to the CA and the issuance of the certificate. There is no
need to exchange any other information, none of it is a secret either.
In any case, authentication via client certificate authentication is
non-phishible because there is nothing to take from the user. Any
information (lets say certificate content and public key) are completly
useless to a phisher...<br>
<br>
...and apparently quite some OP's adopted exactly that, which might
suggest this to be one of the better solutions to avoid phishing and
other misuse.<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>