TLS client certificate authentication is technically quite good, better than anything else you have available in a browser.
Unfortunately:
* The UX for installing a certificate on a Windows or Mac machine is atrocious; it's incomprehensible even to people who understand X.509, and might as well not exist for laypersons.
* The browser UX for matching certificates to sites is not much better; the mechanism basically only works if you have a single client cert you use for every site.
* Getting certificates from a CA introduces yet another nearly incomprehensible UX element, and leaves your site to the mercy of the CAs you trust.
* Issuing your own certificates involves you building a hopefully- less- incomprehensible UX for getting certs into the hands of users, and also implicates a chicken/egg problem of figuring out when it's OK to issue a cert to whom.
Comments
TLS client certificate authentication is technically quite good, better than anything else you have available in a browser.
Unfortunately:
* The UX for installing a certificate on a Windows or Mac machine is atrocious; it's incomprehensible even to people who understand X.509, and might as well not exist for laypersons.
* The browser UX for matching certificates to sites is not much better; the mechanism basically only works if you have a single client cert you use for every site.
* Getting certificates from a CA introduces yet another nearly incomprehensible UX element, and leaves your site to the mercy of the CAs you trust.
* Issuing your own certificates involves you building a hopefully- less- incomprehensible UX for getting certs into the hands of users, and also implicates a chicken/egg problem of figuring out when it's OK to issue a cert to whom.