Hacker News Reader

Comment by lvh | Hacker News Reader

I love mTLS a lot more than the average bear[0], but the main reason I see companies deploy SSO is centralized access control and access management (particularly for offboarding), which client certs are only a tiny fraction of. Since they're typically long-held, you're now proposing either a rigorous revocation scheme or continuous reissuance, and neither seems to be deployed anywhere outside of maybe the DoD. (And Gemini? Maybe?) So: as much as I'd love that to be the case, I don't think that we're "iOS' UX for client certs" away from that being a plausible replacement.

[0]: Thomas Pornin is far from average!

View on HN

It really shouldn't be any more work to revoke a certificate or just maintain a whitelist/blacklist of certificates than it should be to just disable a user account.

Certificates are only more difficult because nobody seems to have put in the effort to automate them, and client software hasn't put in any effort to make the experience nice.

Even if we stipulate that's true: that's precisely my point, nobody has built the tooling to make any of it good, but companies need a reasonable access control story today.

Why are the people who left taking corporate devices with them?

Or alternatively, why are you trusting new employees phones? That’s absolute insanity.

They don't need to take a corporate device with them. They need to have exfiltrated a credential during the (long) time they had alone with the laptop. You trust new employees' phones the way you decided to trust anything else: a risk assessment based on what the company is willing to bear, taking into account compensating controls like MDM.

Are you suggesting "no creds that live outside of trusted elements physically tied to a device we own" is an ubiquitous property of access management?

> no creds that live outside of trusted elements physically tied to a device we own.

I’ve never worked full time at a software company that allowed credentials on employee personal devices. Supposedly because most consumers are up to their eyes in malware, often from the moment they buy the devices, not because the employees are untrustworthy (it would be difficult to have a functioning business where you can’t trust the employees.)

I’m currently typing on a personal mobile device that is trusted by my software employer

You don't appear to have engaged with my core point: policy is not access control.

Reply on news.ycombinator.com