Introducing BrowserID: A better way to sign in • Hacker News Board

Re: Introducing BrowserID: A better way to sign in

#21

Post by NathanKP » Thu, Jul 14, 2011, 9:08 PM UTC

bct wrote: post #17

shockie wrote: post #5

What's the advantage over openid?

Some people think that using URLs instead of email address in OpenID was a big mistake. Having in-browser support for this kind of thing seems like a plus, too.

Email addresses are something that people are fairly familiar with when it comes to signing in. Trying to explain why URL's are used instead of email addresses in OpenID is difficult when you are dealing with a non techy user.

Re: Introducing BrowserID: A better way to sign in

#22

Post by jdunck » Thu, Jul 14, 2011, 9:15 PM UTC

sirn wrote: post #4

How is it different from OpenID, apart from it's not decentralized?

It actually is decentralized, in the sense that anyone can implement a BrowserID provider.

Re: Introducing BrowserID: A better way to sign in

#23

Post by ora600 » Thu, Jul 14, 2011, 9:15 PM UTC

What I'd really want to see is public-key authentication for website.

Let me upload my public key when I create an account on a website, and let the browser interact with my ssh-agent to authenticate.

Re: Introducing BrowserID: A better way to sign in

#24

Post by jdunck » Thu, Jul 14, 2011, 9:17 PM UTC

ams6110 wrote: post #10

This seems to encourage using the same credentials everywhere which I think most agree is a "bad idea." If BrowserID is compromised, the attackers have access to all the sites where I use browser id, right?

There is a large distinction here - the provider (in the video, BrowserID.org) would have to be compromised, as only they have your credentials. This is quite a bit different and more secure than using the same credentials with many different providers, because in that scenario, the weakest of any party could get compromised and that way compromise all parties.

Re: Introducing BrowserID: A better way to sign in

#25

Post by rufibarbatus » Thu, Jul 14, 2011, 9:18 PM UTC

shockie wrote: post #5

What's the advantage over openid?

There seems to be an implied trade-off between a usable system and a distributed system. Most users and most developers at this point will go for usable.

But then, Google, Facebook and Twitter have reduced the friction for identifying all over the internet, so Mozilla is kind of arriving late to the party.

Re: Introducing BrowserID: A better way to sign in

#26

Post by JanezStupar » Thu, Jul 14, 2011, 9:18 PM UTC

ora600 wrote: post #23

What I'd really want to see is public-key authentication for website. Let me upload my public key when I create an account on a website, and let the browser interact with my ssh-agent to authenticate.

This... A million times this. Where do I signup?

Re: Introducing BrowserID: A better way to sign in

#27

Post by yarone » Thu, Jul 14, 2011, 9:19 PM UTC

So, it's basically a traditional single-sign on system? Is that right? Like, in the old days, I integrated one of my products with AOL. You could click a link and it would automatically sign you into my product using you AOL Screenname and Password (behind the scenes, AOL would verify that the screenname and password are correct and my app would create a new user in my database).

Re: Introducing BrowserID: A better way to sign in

#28

Post by lucian1900 » Thu, Jul 14, 2011, 9:23 PM UTC

ora600 wrote: post #23

What I'd really want to see is public-key authentication for website. Let me upload my public key when I create an account on a website, and let the browser interact with my ssh-agent to authenticate.

This. Perhaps ssh+http is the solution.

Re: Introducing BrowserID: A better way to sign in

#29

Post by slowpoke » Thu, Jul 14, 2011, 9:23 PM UTC

jdunck wrote: post #24

ams6110 wrote: post #10

This seems to encourage using the same credentials everywhere which I think most agree is a "bad idea." If BrowserID is compromised, the attackers have access to all the sites where I use browser id, right?

There is a large distinction here - the provider (in the video, BrowserID.org) would have to be compromised, as only they have your credentials. This is quite a bit different and more secure than using the same credentials with many different providers, because in that scenario, the weakest of any party could get compromised and that way compromise all parties.

In addition to that, since the ID provider does not get any sort of information about which websites you visit with your ID, it would be impossible to know where exactly the ID is in use.

At least that's how I understand it.

Re: Introducing BrowserID: A better way to sign in

#30

Post by paulosman » Thu, Jul 14, 2011, 9:25 PM UTC

ora600 wrote: post #23

What I'd really want to see is public-key authentication for website. Let me upload my public key when I create an account on a website, and let the browser interact with my ssh-agent to authenticate.

Have you read the spec? https://wiki.mozilla.org/Labs/Identity/VerifiedEmailProtocol

That's essentially what this is... with a verification service and web based UI to help bootstrap it.