Lately, I was reading that article about SSL client certificate.
Why is nobody using SSL Client Certificate?
The answer was to that question was :
In the current state, this excellent idea is rendered completely useless by the awful usability and the completely detached nature: This is a browser feature. It's browser dependent without a way for the sites to control it - to guide users through steps.
For this to work, sites need more control.
Without giving them access to your keys.
So basically, it's a usability problem.
That made me think about cookies. Cookies are client side storage and there is nothing more easy to use than them. In fact, most users don't even know they exist. So, I thought that cookie might help here.
The part I'm interested in is 2 factors authentication.
- Something that you know : your password
- Something that you have : your private key for the "certificate"
Would it possible to use cookie in some clever way to provide 2 factors authenticate by storing a "certificate" in them?