Re: [TLS] Making TLS-Client-Certificate-Authentication Useful

On Oct 8, 2012, at 8:05 PM, Eric Rescorla wrote:

> On Mon, Oct 8, 2012 at 11:03 AM, Henry Story <henry.story@bblfish.net> wrote:
>>> Again, I'd encourage you to describe a set of use cases that demand a change
>>> to TLS and show that there is real interest in them from site operators and the
>>> like.
>> 
>> I don't think there is anything actually needing change at the TLS layer.
> 
> Oh, good. In that case this is off-topic for this mailing list.

<plug type="shameless">

There may be another mailing list where this may be on-topic: the http-auth mailing list [1]. That one is concerned with authentication at the HTTP layer. There's also a BoF planned for Atlanta.

Note that the kind of auth discussed there is not in HTML or JS either, so plugging WebID is not really appropriate there either. However, well-supported arguments why HTTP is the wrong layer for authentication *are* appropriate for that list. Also, discussion of the UI requirements for authentication are very appropriate both on that list and at the BoF, because modifying browsers to allow customization of the authentication dialog is possible in HTTP (and HTML), but would be very strange in TLS.

If you believe you have UI expertise, and would like to discuss it in the Atlanta BoF, please contact Derek Atkins or me directly. 

</plug>

Apologies for hijacking this thread for plugging our BoF. I promise to do this only this once (at least on this mailing list)

Yoav

[1] https://www.ietf.org/mailman/listinfo/http-auth