I'm the author of this, now quite dated, article and by now I really don't agree with its contents any more - at least not fully:
1) this is not truly two-factor authentication as the certificate is stored right there on the machine I'm using for authentication. If this would ever get widespread use, we'd have issues with malware extracting the key from the browser. Not even password-protecting the key (giving you something comparable to SSH authentication) would help much as malware presumably has access to your memory anyways.
2) With the problems inherent to the SSL protocol in conjunction with renegotiation (http://www.kb.cert.org/vuls/id/120541), this becomes a bit annoying because you can't safely have resources for which you check a client certificate on the same server as resources where you don't. Remember: The article predates the vulnerability by a year.
3) More and more people are beginning to have multiple devices they use. There's not even a "main" machine any more. Not having access to the client-side certificate is annoying though with the various browser syncing solutions out there, this might become a non-issue over time.
None the less. My personal complaint about the overly complicated UI still stands - heck, this is even annoying for me and I would (aside of point 2 above) have good use for this at times - but clicking through this jungle of dialog boxes remains annoying to this date.
The UI is still ridiculous, yeah. But that seems to be par for the course for anything security-related, especially around client-side public keys. Setting signatures for your email is ridiculous, as is receiving them - epic warnings on every client I've tried means I know I can't send signed emails to my family, because they'll freak out and delete the message or shut down the computer immediately. Until that changes, you can be guaranteed it will never gain widespread adoption.
I agree with your reasoning in the article and in point 3 here.
I used to work at a tech firm, we used this SSL Certificates to authenticate against our internal CA. Sysadmins got it wrong, devs got it wrong, qa got it wrong and nobody else stood a chance.
The worst thing about it by far was managing keys between machines. For example, it made it impossible to work from home on an impromptu basis without someone available to help you out.
The bad thing is that it remembers what certificate you want to use and logging out and loggin back in doesn't ask you what certificate you want to use :-(
I've had this issue with the fact that I have two CACert accounts (due to not remembering I had already created one before) and I just recently moved all domains to the newest account...
1) this is not truly two-factor authentication as the certificate is stored right there on the machine I'm using for authentication. If this would ever get widespread use, we'd have issues with malware extracting the key from the browser. Not even password-protecting the key (giving you something comparable to SSH authentication) would help much as malware presumably has access to your memory anyways.
2) With the problems inherent to the SSL protocol in conjunction with renegotiation (http://www.kb.cert.org/vuls/id/120541), this becomes a bit annoying because you can't safely have resources for which you check a client certificate on the same server as resources where you don't. Remember: The article predates the vulnerability by a year.
3) More and more people are beginning to have multiple devices they use. There's not even a "main" machine any more. Not having access to the client-side certificate is annoying though with the various browser syncing solutions out there, this might become a non-issue over time.
None the less. My personal complaint about the overly complicated UI still stands - heck, this is even annoying for me and I would (aside of point 2 above) have good use for this at times - but clicking through this jungle of dialog boxes remains annoying to this date.