Dr Nic

Yep, being able to sign on with SSL certificates is fantastic, and one of the things I love about MyOpenID.

(Signing on to my blog doesn’t do much at the moment though - it basically lets people I know IRL access my contact details and will also provide a way in to test possible betas.)

Wow, just wow. This can be amazing. Thanks for the info.

Wow, I had no idea you could do that. This really seems like it should *be the way*. Why the heck hasn’t this caught on?

Awesome sauce Dr. Nic. I’m just testing if it’s working with the webpage setting in MyOpenID identity so that it links to that, not my OpenID page. I suppose down the road that might be a better verifier, but for now it’d be nice just to have it link to my site without having to become a provider myself, and set-up client cert sign-on.

Hmm, apparently you have to set your profile up ahead of time for it to have the right link in the comment? I suppose in the future consumers (of open ID) can become smarter about what to do with the identity info it passes back.

@timocratic [via] - yeah the openid plugin for wordpress I’m using here just stores your URL at the time that you login and post.

@Daniel Fischer [via] - I think this hasn’t caught on because it’s not portable. Combining this with OpenID is the perfect solution, I think, as it’s the best of both worlds: Zero sign on when you’re on a machine you own, and Single sign on when you’re not.

Whoa, cool autosuggest on the @. I need to make a cool OpenID plugin like this for Mephisto…

Actually I’ve seen a site use them: http://www.wmtransfer.com/. They use them for authentication.

I Denmark, the state body has issued digital certificates to all residents, for use on state body websites (e.g. doing your taxes online), so I’ve been using these for years! It’s the way to go, although I personally prefer PGP.

@Daniel [via] - exactly - instead of each website issuing client certificates, a client could already have a certificate.

My knowledge here gets shaking - I’m guessing its like ssl key pairs - the website holds the public key portion.

This is where I think OpenID is still very useful - you upload your public key to your OpenID profile and when you create a new account with xyz.com your OpenID provider shares your public certificate key. Now you can login to xyz.com automatically without going through OpenID provider each time (ignoring sessions for a second).

This wouldn’t work well if multiple people use the same computer with the same account, or if they typically use a computer that is not under their control.

However, every modern OS does accounts well enough, and computers are becoming cheap enough that in many places this will work well.

With good certificate management systems like keychain, you can even be protected in the event of computer theft (I think it encrypts all of the passwords and certificates it saves).

@rictic [via] - yeah I’m sure many households would have multiple users per machine, and in my life we’ve never managed to use more than one OS-account. But, at work, and on the laptop etc, certificates would be sweet.

Great idea… never thought about using it…
why not create an opensource (rails/merb/…)-plugin?

@Nic: you forgot to remove your certificate’s serial no. in the “recent activity” picture…

@Michael Siebert [via] - thx, fixed.

My Safari screenshots

Instead of autoloading certificate into browser I must manually open it:

Then it appears in KeyChain:

Really interesting: I never realised myopenid.com had that functionality.

I’m trying it out (using Safari on a Mac), and have successfully created a client cert, but I can’t see that “Click here to install your certificate” link - or at least, it’s nowhere in the vicinity of the “MANAGE YOUR SSL CLIENT CERTIFICATES” section.

(Although I do have a link to an Apple support forum message regarding problems signing with Safari.)

Where do you find the magic “install your certificate” link?

Many thanks!
Neil.

@NeilS [via] - The “Click here to install your certificate” section was at the top of the screen after submitting “laptop-safari” to the “Add an SSL Client Certificate” form. So its above the “Change Password” + “Manage your SSL Client Certificates” section, and below “About this page”, on the Authentication Settings page.

As mentioned here, there are issues with Certificates and Safari, see the Safari ticket]. So all is not well in Zero Sign On land for Safari.

We had that on a web site probably ten years ago (definitively before the millennium) offered as an extra service for the customers who wanted to log in that way. (I’ve always been into smart cards and thought we’d better be prepared when people started using them.) But I think exactly zero customers bothered with it. They turned out to be too lazy even for passwords… Anyway.. Seeing OpenID take off in the blogging world today, I can just shake my head. Certificates are implemented in every client that can do https, plus you get crypto for free, there’s zero to implement since Apache does everything. But apparently it’s not cool enough.

@Dr Nic [via] - A-ha! Thank you! Obviously not enough caffeine yet this morning. For the record, I note that if you reload/revisit that page, it appears your chance to download the certificate is gone forever, which is what I think I did. Thanks again …

I implemented (experimentally) certificate-based web authentication in the late 90s, when client certificates where introduced by Netscape (it was at the times when Internet Explorer did not exist, and OpenSSL was called SSLeay).

The approach described in this article (client certificate + openid) may indeed work.

But using client certificates *directly* to authenticate users at websites has a problem. The problem is the same as using server certificates to authenticate web servers, but much worse. It is the design of x.509: a certificate may be signed by *only one* certificate authority. And to verify your identity, your peer needs to have (and trust) the certificate of the CA that signed your certificate. This boils down to that there may be only so many widely recognized CAs in the world, with all certificates being signed by one of them. Or that a user will have to sign a separate certificate for every site by that site’s private CA, which is almost as bad as having multiple passwords…

@Daniel Fischer: I suspect that the reason this never caught on is that SSL certificates are strongly associated with with “arm and a leg”.

@Daniel Fischer: I strongly suspect the reason is that SSL certificates basically cost “an arm and a leg” as far as home users are concerned. By the time ‘free’ ones came out (like the Thawte ones you can get with an SSN), they were under-advertised, basically useless, and collected ridiculous amounts of personal info (my *SSN*!? WTF!!).

My employer uses certificates for members to access their financial info.

Safari and Opera really make the process harder than Firefox or even IE.

The tab order is incorrect btw. If you tab from the OpenId box you end up in the search field at the other end f the page.

MIT has been using personal certificates for administrative web sites for a long time. It’s a really great system. Just make sure you set them to expire, because it’s extremely easy to create certs for a wayward machine, and then your security is in jeopardy.

Zero Sign On…

Zero Sign On - Better than Single Sign On? We’ve talked about doing this here with [[CAS]]…….

Cool idea, and good explaination.

However, this does not really seem to be zero sign on. You have missed the fact that the user still does sign into their operating system (one sign on) and its that authenticated session that allows the user to submit the certification for future sign ons.

-Ricky

Okay, but how portable is this? Doesn’t this mean I can’t login from a public machine because I don’t have the certificate on it?

I’m all about this… but what good is a ssl cert without a good passphrase? A ssl cert can’t gurantee its me signing on.

X.509 certs don’t support selective revelation, so they violate some of the “laws” of identity and privacy. Some certs are dossiers, and you don’t want to reveal that to Web sites. But a cert that reveals no info (such as self-signed) seems like it would be no better than a cookie.

Also, the UI for certs is even worse than the UI for HTTP auth, and you’ll notice that no one uses HTTP auth any more because of the UI problems.

This method is also somewhat phish proof for these site created certificates. A MyOpenID.com phishing clone site may fool the user if it looks exactly the same, but the browser knows that this certificate only gets sent to a specific site or domain. So you have no certificate for the phishing site, telling you that you aren’t where you think you are.

This is a very reason MyOpenID.com adopted to method, I believe.

Reading the code here: http://reductivelabs.com/trac/puppet/browser/lib/puppet/sslcertificates makes me think those guys did what you wanted. Not in a universal way, bu they do use certs to authenticate users in rails. It would be still nice to make a universal rails plugin out of that. I’ll try to if I find some time…

I meant ruby, surely, not rails. But it seems portable enough to me =)

@labria [via] - nice find. Perhaps ask the Puppet guys for assistance, but again, nice find.

[...] Dr Nic » Zero Sign On - 1 better or Infinitely better than Single Sign On? (tags: security authentication) [...]

So a) I can’t log on to my banking, etc. site unless I’m using my browser, and b) anyone who is using my browser can automatically log on to my banking, etc. site? Inconvenient and insecure, gee, I wonder why it hasn’t caught on.

@Squeegy:

Maybe, but if the certificate is not signed by a valid CA I wonder if that introduces a security risk for these client side certs. Obviously, if you use a self signed server certificate that’s easy to fake and fool a user with. But I don’t know enough about client certificates to tell if a similar security issue exists there.

Just curious, but what happens if someone gets access to your computer? how easy is it for them to copy the cert and then use it on their own?

That’s one thing in favor of a username and password. Assuming my brain keeps working, I will always have my login info with me and no one else can take it (assuming no key loggers, etc etc)

@blm [via] - you can still login with username/password

@Ian [via] - I think KeyChain encrypts your certificates so the lawless thief (or ebay purchaser) would need your O/S account username/password first.

I find it both sad and amusing that you document this with screen shots of the mac Keychain and Safari, as those two (at least 2.0 and before, as well as other Webkit-based browsers) have a bug that prevents zero sign-on if you have more than one certificate on the key chain. This may be a .mac certificate in addition to your myopenid cert, for example. It will cause Safari to use one random certificate of yours to authenticate with, and if connecting with that random certificate fails, to fail to connect entirely.

The way that would work (but I now find it dubious to argue for that as it reveals quite a lot of information about what is in your keychain, as per comment 21 above) is to connect using each of the certificates on the chain and succeed if any of them works. Safari doesn’t do this and I have a .mac account with an attached certificate on my keychain, so I can’t use zero sign on for myOpenID. It would be really really convenient. )-:

(For a more detailed description of this bug, see http://www.macintouch.com/readerreports/leopard/topic4694.html and search for “client-side certificates”)

@everyone - if a user already had a myopenid/otheropenid provider’s certificate, could my application/server directly accept those certificates and save the user having to login via the openid provider each time?

@DrNic - the answer is yes. You can accept client certificates and log users in to your server. The issues are that first you need to have either a large list of CA’s that you trust or limit the CA’s that clients can use for their certs. Second, you can test that the client cert is signed by a trusted CA and that it is still valid, but you should know that depending on the CA, you probably can’t assert anything about the identity of the user.

To answer another user’s comment about why client certs are expensive. The purpose of the CA’s was to actually validate your identity so that when you present a certificate that says you are Dr. Nic, someone (the CA) has actually done some background checking to back up that statement.

Out of interest, what plugin are you using here for the OpenID comments?

http://blog.startika.com/2008/2/23/ssl-client-certificate-login-pt-1

This would be perfect for the iPhone, but MyOpenID returned this error: “Your browser did not send us a valid certificate request.”

[...] mich bei Seiten zu registrieren oder anzumelden… bisher! Tobias hat mich gestern auf einen Artikel von Nic Williams aufmerksam gemacht in dem er beschreibt wie man mit myOpenID aus OpenID ein Zero [...]

@topfunky [via] - that’s disappointing since mobile devices definitely fit the “one user per device” model. On the other hand, if you don’t password-lock your phone, your certificates aren’t protected, I guess.

@Rasputnik [via] - I think I’m using the wpopenid plugin from Alan J Castonguay

[...] Dr Nic » Zero Sign On - 1 better or Infinitely better than Single Sign On? (tags: openid security authentication certificates ssl firefox browser 2008 administration Apple browsers client ssh tutorial webdev) [...]

[...] anyone interested in Zero Signon, please take a look at Zero Sign On - 1 better or Infinitely better than Single Sign On? by Dr. Nic. It’s an interesting combination of the new (OpenID) and the old (Client [...]

[...] 或Yahoo决定采用）。 Nic Williams, Dr Nic February 22, 2008 [原文链接] [Tags: Google, Yahoo!] [...]

@DavidK [via] - fixed now, thx for the reminder to get off my arse and fix it.

Lots of very useful comments @ reddit.

I found a few tutorials for Apache, but does anyone have any Nginx tutorials on how to do SSL Client Certificate Authentication?

[...] Single sign-on versus Zero sign-on, incluindo um possível uso incorreto do OpenID; [...]

This could solve so many issues for me. Handy!

[...] Zero Sign On - 1 better or Infinitely better than Single Sign On? “It” is Client Certificates, and to me to means “never logging on with username/password NOR OpenID ever again”. Zero Sign On. It must be better than the much-targetted Single Sign On. (tags: authentication openid) [...]

Well, I’ve made it =)
http://blog.startika.com/2008/2/25/ssl-client-certificate-login-pt-3
It’s still a mess, needs lots of refactoring, but it’s certificate-based logon with rails, and t works =)

@labria [via] - very nice work indeed!

Well, now i made a rails plugin out of the whole thing =)
http://github.com/labria/restful-authentication/tree/master
or
http://blog.startika.com/2008/2/26/ssl-client-certificate-login-pt-4
Gosh, I need some sleep now…

[...] Dr Nic » Zero Sign On - 1 better or Infinitely better than Single Sign On? - Using client certificates to implement zero sign on. [...]

[...] Der Post von Dr. Nic erklärt das alles sehr schön und man fragt sich ernsthaft warum wir uns im Jahr 2008 immer noch mit der User/Password Kombination rumschlagen wenn es so bequeme Möglichkeiten gibt. Jetzt müsste man das nur noch mit GPG kombinieren können… [...]

[...] [OPENID] Zero Sign On - 1 better or Infinitely better than Single Sign On?, drnicwilliams.com [...]

[...] het zoeken naar informatie liep ik tegen een aantal interessante zaken aan. Dit artikel van Dr Nic beschrijft het gebruik van OpenID in combinatie met cliënt side certificates. Dit artikel [...]

[...] Dr Nic » Zero Sign On - 1 better or Infinitely better than Single Sign On? (tags: openid authentication security certificates ssl firefox browser) [...]