Does BrowserID addresses in any way authorization? Is it compatible with OAuth2?
Mozilla's BrowserID (single sign-on for the web) is live
51–60 of 92 posts
Re: Mozilla's BrowserID (single sign-on for the web) is live
#52Why has this been developed? I would have like to have seen a way for clients to generated client-based SSL certificates and submitting them to a server for signing automatically. This would be little new technology and proven cryptographically.
Probably because client-based SSL certificates have been around forever, but no-one uses them. Probably not a coincidence either, my bank used to rely on client side certificates but gave up after, I guess, an insane amount of support calls.
They are brilliant, but they need to be more accessible. Hmmmmm... maybe I should provide a patch for Chromium/Firefox.
Re: Mozilla's BrowserID (single sign-on for the web) is live
#53Hmm.. so if my browser has integrated support, then any site I visit can add itself to my list of primarity authorities as evil-username@evil-domain. And I will be asked to choose one of these authorities to log in to other sites. And a rogue authority can impersonate me on the sites where I use it. Is this correct?
I can see a slight potential to trick the user into using a rogue authority. Imagine the evil email address is somehow tailored to a site the user is expected to log in to, in a way that makes it look like the "right" selection for that site, in the BrowserID dialog. I can't think of an explicit example right now, but when you allow untrusted parties to inject text into trusted dialogs, there are often many possibilities for trickery.
Re: Mozilla's BrowserID (single sign-on for the web) is live
#54Earlier quoted context omitted.
Am I the only one who has a dozen of OpenIDs, none of which I remember?
Yes you are. Because others use the same openid in every openid enabled site where you open yet another openid account.
I have Facebook, Google, and Blogger OpenIDs, and probably some others I have forgotten. Probably Yahoo and Flickr, maybe WordPress and maybe even LiveJournal. I really have no idea.
Re: Mozilla's BrowserID (single sign-on for the web) is live
#55Earlier quoted context omitted.
I had to create an account a couple of days ago because it was the only way to log in to openphoto.me. Are there any clear differences between BrowserID and OpenID?
OpenID requires the user to remember what sites they have accounts on that provide OpenID authentication, and requires them to remember their authentication information for those sites every time they want to log into an OpenID-using site. In its current form, BrowserID requires the user to do the email-verification dance once for each email address they want to authenticate as, and from then on they can just pick it…
I don' really need a foo@browserid.org address to register there right? So I could actually get the same email address verified through multiple providers. How would the browser know which one I actually want to use?
Re: Mozilla's BrowserID (single sign-on for the web) is live
#56>Include the BrowserID include.js library in your site by adding the following script tag to your pages tag https://browserid.org/include.js type="text/javascript">
Not minified. Come on Mozilla, you did the same thing with the (rather large) Open Web Apps library. Minification is required. You are Mozilla, you should know this. YUI Compressor takes a few seconds at most.
Re: Mozilla's BrowserID (single sign-on for the web) is live
#57A lot of questions here revolve around how this is different from OpenID and single sign-on solutions like Google Accounts or Facebook Connect. Here's a rough list (may be incomplete or inaccurate by now; while I work for Mozilla, I'm not involved in this project): * federated (like OpenID) * open standard (like OpenID) * no passwords / no typing / no memorizing (e.g. like FB Connect) * possibility of browsers provid…
> no passwords / no typing / no memorizing (e.g. like FB Connect)
FB Connect requires you to memorize your Facebook password. It also requires you to have a Facebook account. BrowserID requires neither an "account" or a password.
Re: Mozilla's BrowserID (single sign-on for the web) is live
#58I'm not seeing how BrowserID differs from the standard email verification sign up. I went through the sign up process (enter email, click link in verification email, enter password, sign in with password). I also read Mozilla's 'really short version' explaining browserid ( https://wiki.mozilla.org/Labs/Identity/VerifiedEmailProtocol ) and will give the longer version a shot.
Right, this is caving cowpaths. Most sites have this flow, so if we can lift that up into the Browser and your Primary identity provider, than you can stop doing this on each new website you visit.
Re: Mozilla's BrowserID (single sign-on for the web) is live
#59What does BrowserID do that every existing OpenID provider cannot? The BrowserID FAQ says the architecture is "decentralized", but login relies on Mozilla's browserid.org server.
The design of BrowserID is more aligned with real user behavior in the wild. An example is users remember an email instead of a URL. The API/Protocol for an implementing website is much easier, based on implementer feedback.
Re: Mozilla's BrowserID (single sign-on for the web) is live
#60I'm pretty sure I understand how this works, but please correct me if I'm wrong. As currently implemented, it appears that if the Primary Identity Authority or Secondary Identity Authority keys are compromised, then all accounts for which that authority is trusted are also compromised. This enables accounts to be compromised en masse, rather than individually. It would seem that by de-centralizing authentication, bro…
I think the intention is for the primary to be your email provider. So if they become compromised to that extent, then I wouldn't feel very safe about my email account in the first place. Pretty much all of my credentials everywhere depend on that.
Until secondaries go away, Mozilla seems like a very competent and trustworthy organization to have in charge of browserid.org, IMHO. Much better than even Google. It's great to see that even the branding on browserid.org is minimal.
My guess is that, concerning nonces and revocation, they didn't consider the current situation (OpenID, OAuth for login, etc.) any better. BrowserID doesn't seem to do away with the strong advice to run HTTPS for such sites.