|
| ▲ | cmgbhm 6 hours ago | parent | next [-] |
| That’s likely just the side effect of supporting mtls. Mutual TLS came around at the same time as Microsoft did implicit network auth. Seemed magical at the time and so hare brained for eons of problems. The user side tls never caught on in most circles and still has the ancient sharp edges |
| |
|
| ▲ | naturalmovement 4 hours ago | parent | prev | next [-] |
| That's literally how client certificates work. It's not attempting to "read" anything, nor is it the least bit suspicious or malicious. Your browser was asked if it would like to present a certificate to authenticate, and you were prompted to choose one if you please. You can also hit cancel as client auth can be optional and the server will either serve you the page or a 401/403. It's like being asked to show ID to enter a pub, you can either show one or decline, and they may or may not let you enter based on that transaction. |
| |
| ▲ | TurdF3rguson an hour ago | parent [-] | | It's a little suspicious. Why are they doing something that no other website in the world does? I was curious about zero-whatever but not enough to do whatever this is. | | |
| ▲ | naturalmovement 43 minutes ago | parent [-] | | Bruh it's one line in nginx config. > that no other website in the world does That you know of. Anywhere with stringent security it's everywhere. |
|
|
|
| ▲ | mook 6 hours ago | parent | prev [-] |
| That's because the client certificate interface in browsers is supremely dumb. It always just lists all certificates you have, with very little context in the UI, and hopes that's good enough. I believe that's part of the reason client certificates are not poplar; having actual users deal with that is terrible, and the browsers (in practice, Chrome because of its overwhelming market share) isn't incentivized to fix it. |
| |
| ▲ | Avamander 3 hours ago | parent | next [-] | | Servers can communicate their preference in terms of CAs they want. But the UX in browsers is unbelievably horrible for no good reason. Not only is it difficult for an user to make a proper selection, it's also hard to fix a wrong one. The error pages are also terrible. There's no way for the site owner to request that when the navigation to the (auth) page fails, redirect back. Nope, no way to do error handling without some really clever iframe stuff and even then it's way too opaque. God forbid you have to deal with CORS + mTLS. | | |
| ▲ | elevation 2 hours ago | parent [-] | | > God forbid you have to deal with CORS + mTLS As someone who is about to deal with exactly this, what kind of trouble am I in for? |
| |
| ▲ | 4 hours ago | parent | prev [-] | | [deleted] |
|
