This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
Like a lot of people, I browse more and more on a tablet and my smartphone. For "unauthenticated" browsing, that's not a problem.
However, once we have to start browsing "authenticated" sites, things get more complicated. Typing a password on a smartphone is a pain. Having to type complex passwords for every site we visit is way too much pain. For most people, it's an incentive to simplify their passwords, by reducing diversity (same password everywhere) and reducing complexity (as I mentioned before, it's hard to type a complex password on a small screen… and a small keyboard). So we end up with a system that, instead of encouraging better habits, creates the opposite effect.
The "band-aid" I use is a password manager. It gives me access to my keychain of complex passwords without having to memorize them. However, the poor integration with the web browser (and here it's not the developers' fault, but the very design of iOS) prevents the kind of integration we see on the desktop. So to enter a complex password, it takes me 7 steps (switch apps, first 1Password unlock, select the password, second unlock, copy the password, go back to the web page and paste the password) to get into my account. It's too long and discourages going that route.
I believe it's our responsibility as security professionals to stop taking the easy road for ourselves and to offer our clients and employers innovative approaches to managing authentication.
In that respect, the much-maligned X.509 certificate offers an interesting avenue for making the authentication process transparent between the smartphone and the website. It's also possible to use levers like OAuth (Twitter+OAuth+iPhone, anyone?). Mac OSX and iOS also offer the Keychain service, which stores passwords and certificates. Being a very novice iOS programmer, I can't really say what's possible on that front. At the very least, there should be better integration between the desktop and smartphone components, like all the third-party password managers do.
The other avenue is to build a dedicated App to access a service. From then on, authentication to that service is built right into the iOS Keychain, which makes authentication transparent to the user (Twitter, YouTube, Facebook, LinkedIn). The user experience is improved, while gradually moving us into Apple's or Google's "walled garden". Ease of use has the pernicious effect of leading us toward "curated" systems.
These avenues offer solutions that can work and even become dominant. Before diving headfirst into one of them, it's worth looking at the side effects of using it.