Why OpenID Connect is More Secure then Certificates
Talkat Cloud Native Security Day North America 2020 · on Tuesday, 2020-11-17· at 15:50· Virtual , VIrtual·
summary
Certificates rely on an HSM and PKCS#11 to keep private keys safe but kubectl lacks PKCS#11 support and the Kubernetes API server has no CRL support, so long lived certs (examples: federal PIV five year lifetimes) remain valid unless manually revoked. OpenID Connect gives short-lived tokens and a one-time refresh token flow, supports browser MFA and impersonation, works with managed clusters, and can be deployed via OpenUnison or a reverse proxy that checks certs and uses impersonation. Vault-style hacks end up reimplementing OIDC refresh logic.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:10Why Certs
- 0:46Secure Certs
- 6:46OIDC In Action
- 8:10So, OIDC Is Perfect?
- 8:41But what about?
- 9:11BUT I WANT CERTS!!!!!
- 9:33Thank You
related talks
34mWho Are You? I Really Want to Know… the Magic Behind OIDC
01h 59mBuilding Secure Kubernetes Clusters with Identity Management
01h 02mBuilding Clients for OpenID Connect/OAuth 2-based Systems
27mAddressing the growing threat of non-human identities with PKI
59mOpenID Connect & OAuth 2.0 – Security Best Practices
29mEverything Wrong with K8s Authentication and How We Worked Around It
01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the Trenches
56mLock That Sh*t Down!