From owner-freebsd-questions@FreeBSD.ORG Sun Mar 24 08:16:37 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id C5938100B for ; Sun, 24 Mar 2013 08:16:37 +0000 (UTC) (envelope-from bc979@lafn.org) Received: from zoom.lafn.org (zoom.lafn.org [108.92.93.123]) by mx1.freebsd.org (Postfix) with ESMTP id A06402DF for ; Sun, 24 Mar 2013 08:16:37 +0000 (UTC) Received: from [10.0.1.2] (static-71-177-216-148.lsanca.fios.verizon.net [71.177.216.148]) (authenticated bits=0) by zoom.lafn.org (8.14.3/8.14.2) with ESMTP id r2O8GYum066496 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Sun, 24 Mar 2013 01:16:36 -0700 (PDT) (envelope-from bc979@lafn.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) Subject: Re: Client Authentication From: Doug Hardie In-Reply-To: Date: Sun, 24 Mar 2013 01:16:33 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <85D3DEE2-3E4E-4B68-87B0-6B946F15581C@lafn.org> References: To: CeDeROM X-Mailer: Apple Mail (2.1503) X-Virus-Scanned: clamav-milter 0.97 at zoom.lafn.org X-Virus-Status: Clean Cc: "freebsd-questions@freebsd.org List" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2013 08:16:37 -0000 On 24 March 2013, at 01:03, CeDeROM wrote: > Why don't you just use PKI for authentication (you can generate your > own certificates)? You can easily upload keys/certificated to client > machines (PC, Android, Apple, ...). That should work :-) >=20 Thats exactly what I have been testing. Its easy in concept, but there = are issues in the details. Once the certificate is loaded in a Mac and = the password entered, its available for anyone to use thereafter. You = actually have to remove the certificate from the keychain to disable it. = Not a great approach for shared computers. Most users will not know = how to remove it properly. I don't know about PCs yet though. In = addition there are possible issues with mail clients. I have not tried = them yet. It all depends if they can handle p12 format certificates. = Pem format certificates must have the private key in plain format which = renders them completely insecure. Then there still is the issue about Safari (at least) not handling the = no certificate case properly. -- Doug