XAuth critiques

[Ben Laurie]

On 8 June 2010 20:09, Dan Brickley <danbri at danbri.org> wrote:
> On Tue, Jun 8, 2010 at 6:55 PM, Ben Laurie <benl at google.com> wrote:
>
>> I would really like to see better support for client certificates in
>> browsers so that this became less clunky around the certificate management
>> aspects...
>
> What needs to happen to achieve this?

IMO, two things:

1. UI that is actually useful to the user (e.g. a dropdown with a list
of certificates is not particularly useful).

2. A mechanism to move certs between browsers and machines (this is
one of the reasons I designed the Nigori protocol).

>
> Is the shape of the problem / solution broadly understood?

Problem, yes, solution less so.

> Is this
> something that W3C could usefully act on, or just needs coding work
> from the browsers?

There need to be standards in order to allow portability and (I would
hope, ultimately) "identity plugins". Whether W3C is the right forum
is another question.

> How does it relate to the recent
> http://www.w3.org/TR/wsc-ui/ and http://www.w3.org/2006/WSC/ work at
> W3C?

I have no idea.

> Sorry for all the questions. I've heard "browser certificate support
> needs improving" countless times, maybe this is a good time to find
> out if the will is there to improve the situation...
>
> cheers,
>
> Dan
>