What security does this provide that another token like a cookie does not?
Certificates provide value where you can independently attest that the client is who or what it appears to be.
Client certificates are the basis of MDM solutions, for example. In a corporate setting, I enroll my iPhone with the MDM, linking that device and phone number to my identity. The MDM solution issues certificates identifying my device and my identity to that device. That allows subsequent interactions with corporate systems to be authenticated.
If I drop the phone in the toilet, get a new one and restore it, I must re-enroll, as the phone serial number changed. The old certs are revoked. The key assumption is that the mobile device platform can be trusted to provide an accurate serial number, phone number, etc.
Browsers cannot be trusted much, if at all. A modestly clueful attacker can spoof all of the metadata provided to the website. I can take that client certificate and copy it to any other browser.
Comments
What security does this provide that another token like a cookie does not?
Certificates provide value where you can independently attest that the client is who or what it appears to be.
Client certificates are the basis of MDM solutions, for example. In a corporate setting, I enroll my iPhone with the MDM, linking that device and phone number to my identity. The MDM solution issues certificates identifying my device and my identity to that device. That allows subsequent interactions with corporate systems to be authenticated.
If I drop the phone in the toilet, get a new one and restore it, I must re-enroll, as the phone serial number changed. The old certs are revoked. The key assumption is that the mobile device platform can be trusted to provide an accurate serial number, phone number, etc.
Browsers cannot be trusted much, if at all. A modestly clueful attacker can spoof all of the metadata provided to the website. I can take that client certificate and copy it to any other browser.
1. you would require access to the user's system in order to gain access to the private key of the cert
2. it provides better security than username/password authentication
3. it makes our lifes easier because you wouldn't have to remember passwords