HTTP-POST vs. ECP

[Leif Johansson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/16/2012 05:22 PM, Jon Carlson wrote:
> Scott, Can you elaborate further?  Please?  :-)
> 


What form do you imagine using for your TLS client token? A
soft token? A hard token? Smartcards are still notoriously
dependent on drivers (despite all claims to the contrary).

Not for nothing did apple try to drop support for smartcards
in a recent release - this stuff is rarely used outside the
controlled environments of certain enterprises or the US
government.

Even soft-tokens are not that simple - provisioning isn't
even close to being cross-platform so you'll have to do
separate "calls" into the browser (eg javascript) cert-store
hooks for each major browser + at least 2 mobile platforms.

I don't want to discourage you from trying, just be aware
there be dragons aplenty here.

I'd look at 2-factor tokens based on oath if you can do
rate-limiting in a good way (or you hit the birthday problem)
or maybe tiqr.org.

	Cheers Leif

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlAERIsACgkQ8Jx8FtbMZndL4gCfSQO8JVQlB0SBrGFv5W1XcEqi
8ToAn02jOrMHH2ZdMIK5LpKN/J20mpNV
=MQ7Q
-----END PGP SIGNATURE-----