Top all-time · #7199
gnegg
Personal blog · pilif.github.iosecurityprogramming
gnegg is a personal blog at pilif.github.io about security and programming. Since 2013, 10 different Hacker News readers have linked it 14 times, most often “Why is nobody using SSL client certificates?”. The last post was in 2017, but the archive is still widely read.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link gnegg's 2008 post on why nobody uses SSL client certificates, cited when threads discuss passwords, client certs and logins. Comments cite it as a source; none judges the writing itself.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Why is nobody using SSL client certificates?5 people · 6 mentions · first linked 2013-04-15
- Why is nobody using SSL client certificates? (2008)3 people · 3 mentions · first linked 2015-01-30
- When in doubt – SSL2 people · 2 mentions · first linked 2014-10-27
What Hacker News says?
http://pilif.github.io/2008/05/why-is-nobody-using-ssl-clien...
Comment linking /2008/05/why-is-nobody-using-ssl-client-certificates/
on “Fun with your friend's Facebook and Tinder sessions”Submitted Why is nobody using SSL client certificates? as a story · 241 points
HN discussionI guess not much has changed since 2008: https://pilif.github.io/2008/05/why-is-nobody-using-ssl-clie...
Comment linking /2008/05/why-is-nobody-using-ssl-client-certificates/
on “Shutting down persona.org in November 2016”Submitted Why I don't touch crypto as a story · 77 points
HN discussionhttps://pilif.github.io/2008/05/why-is-nobody-using-ssl-clie...
Comment linking /2008/05/why-is-nobody-using-ssl-client-certificates/
on “Signing in to websites with SSH”Submitted Why is nobody using SSL client certificates? (2008) as a story · 56 points
HN discussionLikely "Cowboy" is a transparent proxy added by your mobile service provider. I had a similar thing happening a year ago when the mobile provider used by most of our barcode scanners decided to add a transparent proxy into the loop (without telling anybody). The solution for this problem: Use SSL. I mean: There are already many good reasons to use SSL, but whenever you need to send any kind of mission critical data…
Comment linking /2013/09/when-in-doubt-ssl/
on “Post Mortem: A single whitespace character”Submitted When in doubt – SSL as a story · 3 points
HN discussionAnther nice "feature" of mysql: If you have a table configured to UTF-8, and you use utf-8 client encoding but then accidentally try to send something that's not UTF-8 (shit happens), then mysql will happily accept your data and truncate it on the first byte it doesn't understand. It issues a warning, but most frameworks don't care to inform the caller if a warning has happened (some don't even provide a way to acce…
Comment linking /2008/02/failing-silently-is-bad/
on “Unicode support in MySQL is...”Submitted Why is nobody using SSL client certificates? (2008) as a story · 1 points
HN discussionThe thing about SJR is that it lends itself much better to progressive enhancement: if you need/want to present a page which also works without JS, that means that you need to be able to render the page on the server, which means that by using SJR, you can easily reuse that same view code that you already need to have for the non-JS clients. Of course, as JS on the server becomes more and more wide-spread, you might…
Comment linking /2011/04/ajax-architecture-frameworks-and-hacks/
on “Server-generated JavaScript responses”SSL includes a feature called client-side certificates: http://pilif.github.io/2008/05/why-is-nobody-using-ssl-clien...
Comment linking /2008/05/why-is-nobody-using-ssl-client-certificates/
on “I long for the future where I can safely assume my passwords are stolen”Back in 2008 I have blogged ( http://pilif.github.io/2008/05/why-is-nobody-using-ssl-clien... ) about client certs. The UI around them is horrendous and they also serve as a very good solution to uniquely identify clients across sites. This was a good idea, but in its current implementation it's unusable.
Comment linking /2008/05/why-is-nobody-using-ssl-client-certificates/
on “Web Security – Client side certs”This exists: http://pilif.github.io/2008/05/why-is-nobody-using-ssl-clien...
Comment linking /2008/05/why-is-nobody-using-ssl-client-certificates/
on “Password prompts are annoying”
