Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla's BrowserID (single sign-on for the web) is live

github.com

Post reply on HN
Print view View original

41–50 of 92 posts

Re: Mozilla's BrowserID (single sign-on for the web) is live

#41

Post by thristian »

jmathai wrote: post #20
skrebbel wrote: post #17

Maybe I'm stupid, but the linked article gives me the idea that JavaScript is requirement to be enabled to allow log-in. Is this true? I know, I know, it's 2011, but still I feel it's unnecessarily limiting.

At the moment the BrowserID team provides a Javascript shim but the goal is that it will be supported natively in the browsers. The shim if a fallback (which applies for all browsers atm).

Even if the API is supported natively in the browser, it's still a JavaScript API, so you still need to allow the website to run JavaScript so that it can call that native method.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#43

Post by alexchamberlain »

Why has this been developed? I would have like to have seen a way for clients to generated client-based SSL certificates and submitting them to a server for signing automatically. This would be little new technology and proven cryptographically.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#44

Post by mattmanser »

dhx wrote: post #38

Why? Firefox already stores passwords in a local database and it wouldn't be that hard to automatically log users into sites. The method they describe here requires every web site be changed and requires cross-domain JavaScript to be enabled such that browserid.org will know which websites you visit. You _could_ place include.js on your local domain to avoid this issue. However history has shown that sites will tend…

local database

That's why.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#45

Post by icebraining »

resnamen wrote: post #6
cpeterso wrote: post #4

What does BrowserID do that every existing OpenID provider cannot? The BrowserID FAQ says the architecture is "decentralized", but login relies on Mozilla's browserid.org server.

It provides a canonical identifier for your account without compromising your identity to BrowserID-enabled services. The OpenID spec divulges who you are.

The OpenID spec divulges who you are.

How so? As far as I know, the only mandatory information is the OpenID identifier (the URL you need to input to authenticate). While more information can be exchanged, that's completely optional and up to the user. For example, MyOpenID always asks what "persona" - if any - you want to send when you authenticate.

BrowserID is no better: you need to input your email address.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#46

Post by icebraining »

mattmanser wrote: post #44
dhx wrote: post #38

Why? Firefox already stores passwords in a local database and it wouldn't be that hard to automatically log users into sites. The method they describe here requires every web site be changed and requires cross-domain JavaScript to be enabled such that browserid.org will know which websites you visit. You _could_ place include.js on your local domain to avoid this issue. However history has shown that sites will tend…

local database That's why.

Uh, from the "How BrowserID works" page:

    The user stores the keypair and certificate locally.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#47

Post by zerostar07 »

Perceptes wrote: post #29
zerostar07 wrote: post #27

Earlier quoted context omitted.

This is a more pragmatic approach than openid. Most users have a secondary email for logins anyway, and browserid makes switching a snap. I think it will catch on, mainly because there s nothing new for users to learn, and everyone has an email addr

Most users have a secondary email for logins anyway It seems to me the opposite is true. What is your source for this?

all the people in my non-IT office use a secondary hotmail/gmail to avoid being spammed from the sites they sign up to every day.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#48

Post by gizzlon »

alexchamberlain wrote: post #43

Why has this been developed? I would have like to have seen a way for clients to generated client-based SSL certificates and submitting them to a server for signing automatically. This would be little new technology and proven cryptographically.

Probably because client-based SSL certificates have been around forever, but no-one uses them.

Probably not a coincidence either, my bank used to rely on client side certificates but gave up after, I guess, an insane amount of support calls.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#49

Post by gcp »

dhx wrote: post #38

Why? Firefox already stores passwords in a local database and it wouldn't be that hard to automatically log users into sites. The method they describe here requires every web site be changed and requires cross-domain JavaScript to be enabled such that browserid.org will know which websites you visit. You _could_ place include.js on your local domain to avoid this issue. However history has shown that sites will tend…

Because you don't need to create an account on each and every site you visited (together with decoding a similar number of CAPTCHA's, etc)

Re: Mozilla's BrowserID (single sign-on for the web) is live

#50

Post by StavrosK »

jmathai wrote: post #24
Ecio78 wrote: post #23

I'm working on a webapp that will be used by not-so-tech-savvy working people and this could be an interesting way to subscribe to the service without implementing generic openid (i think most of them wont understand it) or facebook/twitter etc.. login (it's a service for businessman). I must check if it's more difficult to implement than an all-internal email subscription and verification process.

BrowserID is super easy to implement. It's 8 lines of Javascript and about 8 lines of code on the backend to verify that a user owns an email address. I've implemented it on OpenPhoto and absolutely love it.

Can you give me an invite code? I'd love to try BrowserID out and openphoto looks interesting! My email is in my profile, if you need it.
Post reply on HN