Hacker News Reader

tomc1985

- Make client-side certificate authentication mainstream. Fix the UI, UX

- Standardize on some sort of biometric identification that actually works. I HATE two-factor :(

1. Client-side certificates usage has privacy implications - https://github.com/tumi8/cca-privacy

2. Is biometric really necessary? U2F tokens already exist and are standardized (maybe not officially, I'm not sure). Chrome and Opera already support it, Mozilla's support must be coming soon (meanwhile you can use an add-on).

I am sick of the actual motions of authenticating, and many of the 2-factor implementations out there today are terrible. (SMS, really? What happens when your phone is stolen? How do you protect against an angry lover? What a joke)

U2F dongles aren't much better.

Also, a quick glance at that link seems to indicate attacker needs some sort of MITM access? Is it anything more than a replay attack?

Reply on news.ycombinator.com