Web Authentication: Proposed API for accessing Public Key Credentials
Client-side TLS certs have been a thing approximately forever, yet everyone is hesitant to use them because... installing a cert in your browser is hard, I guess?<p>Many corporations and agencies use certificates either as the primary (only) auth method, or as supplementary auth. For example, DTrade, the US defense export licensing system: <a href="http://www.pmddtc.state.gov/DTRADE/index.html" rel="nofollow">http://www.pmddtc.state.gov/DTRADE/index.html</a><p>We use them at work and they work great. Pretty much instant auth to any internal site with no shenanigans.