full-disclosure - Re: [FD] end of useable crypto in browsers?

Open Source and information security mailing list archives

Message-ID: <20160411225216.GB18105@hunt>
Date: Mon, 11 Apr 2016 15:52:16 -0700
From: Seth Arnold <seth.arnold@...onical.com>
To: fulldisclosure@...lists.org
Subject: Re: [FD] end of useable crypto in browsers?

On Sat, Apr 09, 2016 at 11:34:26AM +0200, Árpád Magosányi wrote:
> Browser developers are dropping support for X509 key generation.
> Yes, <keygen> have its problems. But window.crypto - which is meant to
> replace it - have no way to save keys in the browser's keystore.
> [..]
> Any ideas on how to make them understand the scale of the doom we are
> facing right now?

The only TLS client certificate authentication I see on a regular basis
is for CertFP use for IRC nickserv authentication and OpenVPN. Trying to
use a browser to perform either of these actions would be awkward at best.

What application or service do you know of that uses TLS client
authentication that requires browser integration? If you can demonstrate
users who will be affected they may be more amenable to your claims. (I
suspect the browser authors already know how many services use TLS client
authentication from their own telemetry systems. What may be harder to
gauge via telemetry is how important it is to the users.)

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives