I wonder why SSL Client Certificate Authentication hasn't become popularized for the web.
1. Browser visits a site that needs authentication.
2. Browser checks if there's already an existing client cert.
3. If not, browser generates one.
4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.
1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.