Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

A: It's a pain in the rear.

We use them for device identification. It's ok in those scenarios. But for user auth, you really need smart cards to make it work.



My understanding of smart cards is that they are nothing more but a portable storage device for a certificate. While that certainly helps with the PITA complaint, what problem does a smart card solve in regards to identity that exporting and importing certificates doesn't?


Certificates are public, they don't need protection. The private keys do. That said you always want to store a certificate close to its private key for practical reasons. Smart cards are useful to transform your keys into a real object that is carried around and presented upon request. They offer the interesting property that they cannot be copied or used by illegitimate users, at least not without spending horrendous amounts of time and money. When your smart card is lost or stolen you can always revoke the credentials it contains on the server side and get new ones. Much harder to know when your browser key store was stolen from your computer.


So it's the transformation to a physical "thing you have" that is valuable? Would you say it is any better than a physical one-time code generator? Again, beyond the PITA argument; having used both I completely agree that the card was a lot easier.


Definitely that, and the fact they cannot be copied. OTP fobs offer the same convenience but are based on shared secrets that can be stolen from the server (happened to RSA). With PKI your private key is only on your smart card and nowhere else.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: