Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing BrowserID: A better way to sign in

identity.mozilla.com

Post reply on HN
Print view View original

51–60 of 188 posts

Re: Introducing BrowserID: A better way to sign in

#51

Post by Osiris »

pavel_lishin wrote: post #40
mbrubeck wrote: post #12

Earlier quoted context omitted.

This lets users sign in with an existing email address, so they don't need any new sevice or identifier to remember. It's decentralized; Mozilla has a service for web developers for convenience, but any site can implement the protocol itself instead (or use another provider). And it's designed to let browsers handle the login flow in the future, simplifying login and account creation for end-users.

Most of the oauth services I used allowed me to create an account with ... an e-mail and a password. Literally the same thing, here.

Isn't one of the advantages of this system is that your password doesn't get stored by the website? Just some type of token? If their database gets stolen or leaked, they shouldn't be able to hash attack your password and gain access to it since it's not there.

I'm just assuming it works this way, as passing the password along would defeat the security of the system and make you more vulnerable.

Re: Introducing BrowserID: A better way to sign in

#52

Post by SeoxyS »

They seriously need to work on their communication skills. It took me a good 15min to figure out what this thing actually does. And I'm still not sure I got it right. OpenID failed because it was too complicated for mere mortals. This, I fear, may be too confusing. At least form the way it's presented.

After reading the protocol spec, I have a somewhat better understanding of this. If I got this right, this is basically what this does:

* asymmetric crypto authentication in the backend.

* control over email address == authentication.

* allows a trusted third-party to authenticate the user. This could be a user or a web service (like browserid.org?).

* falls back to regular email authentication we see every day.

I'm still unclear how you can securely verify email ownership thru cryptographic means. Anybody care to explain it?

Re: Introducing BrowserID: A better way to sign in

#53

Post by codyrobbins »

bct wrote: post #17
shockie wrote: post #5

What's the advantage over openid?

Some people think that using URLs instead of email address in OpenID was a big mistake. Having in-browser support for this kind of thing seems like a plus, too.

To this day I still do not understand how this inane argument happened to be the single thing that killed OpenID. How is ‘cody.my-open-id-provider.com’ more confusing as a login than ‘cody@my-email-provider.com’? Hint: it’s not. I’m not one for conspiracy theories, but the whole URL-versus-email argument against OpenID seemed like the excuse various people used to put a nail in OpenID’s coffin when they didn’t like it for other less defensible reasons.

Re: Introducing BrowserID: A better way to sign in

#54

Post by ignifero »

SeoxyS wrote: post #52

They seriously need to work on their communication skills. It took me a good 15min to figure out what this thing actually does. And I'm still not sure I got it right. OpenID failed because it was too complicated for mere mortals. This, I fear, may be too confusing. At least form the way it's presented. After reading the protocol spec, I have a somewhat better understanding of this. If I got this right, this is basica…

They give you a token, you do a GET request to browserid.org with it and get the user's email, that's all. The user has to register their email with browserid.org first.

Re: Introducing BrowserID: A better way to sign in

#55

Post by bct »

stickfigure wrote: post #34

One huge problem: Email address != identity. I should be able to change my email address (and/or email hosting provider) without changing my identity on a bazillion sites around the internet. Facebook got this right from the beginning. Google is sort-of getting this, although the chasm between Google Accounts and Google Apps Accounts makes this really messy. Really this product should be called BrowserEmailAddress, n…

> Facebook got this right from the beginning.

What a weird double-standard. A feature of email (that you can have several, and you can change which one you use) is a failure, and a failure of Facebook (that it's one site, forever) is a feature?

We're all familiar with ways to migrate from one email address to another. If/when you leave Facebook/it disappears, how will you migrate your identity then?

Re: Introducing BrowserID: A better way to sign in

#57

Post by superuser2 »

My first ever programming project (I was 11) was basically this (edit: from a UI perspective, not under the hood), in PHP. I had no idea what I was doing, the architecture was questionable and at this point decentralization and OpenID were new and hot. It flopped horribly; it would have been a nightmare had it taken off, but it was fun.

My flow was basically this: website links to http://my-site/login?to=http://site.com/authenticate. User logs in against my MySQL database with an email I verified and a password. If successful, I generate a "ticket" number, my site makes an HTTP post to http://site.com/recevive with md5(ticket number + secret key) and the user's details, and then the user is redirected to http://site.com/authenticate?ticket=12345. Site.com verified the ticket using its API key and stuck it in its database. When the user hits site.com/authenticate, it looks it up by ticket number and has that person's details.

Obviously a terrible idea for a number of reasons (MD5, the race condition between the user and the ticket, and the reliance on my shared server being up) but my 11-year-old self thought it was pretty cool. Just thought I'd share.

Re: Introducing BrowserID: A better way to sign in

#58

Post by stickfigure »

51Cards wrote: post #47
latchkey wrote: post #33

This is full of fail. Your email address is not your identity. I must be able to change my email address without having to change my identity.

It's not that simple. They authenticate against your Account at Browser ID. I would assume you can go into Browser ID and add / remove email addresses from your account which makes it even easier when you change your email. Now you don't have to visit 20 different sites to update them.

Is there some sort of account ID other than an email address? It looks like the email is all that gets sent to the website (although I didn't read deeply enough to be sure). If you change (add new, remove old) your email address at browserid.org then revisit a site you authenticated to before, what happens?

Re: Introducing BrowserID: A better way to sign in

#59

Post by rubyrescue »

superuser2 wrote: post #57

My first ever programming project (I was 11) was basically this (edit: from a UI perspective, not under the hood), in PHP. I had no idea what I was doing, the architecture was questionable and at this point decentralization and OpenID were new and hot. It flopped horribly; it would have been a nightmare had it taken off, but it was fun. My flow was basically this: website links to http://my-site/login?to=http://site.…

that's a really cool project at 11 years old, both in terms of your idea and what you can actually accomplish! off topic, but when i was 11 i had a c64 and basic and couldn't dream of talking to another computer unless i saved my program to the tape drive and had my mom drive me to my friend's house to load it on his c64.
Post reply on HN