Mozilla's BrowserID (single sign-on for the web) is live • Hacker News Board

Re: Mozilla's BrowserID (single sign-on for the web) is live

#61

Post by stephank » Fri, Dec 16, 2011, 5:09 PM UTC

Newky wrote: post #35

It would be interesting for this to get some exposure from a large web-service. Being realistic, Facebook nor Google would be interested in replacing their own system. But I think it is an interesting idea which now is no longer just theory.

Well, Google wouldn't replace their login process because they are the BrowserID primary. If you have a gmail account, BrowserID expects you to be logged in with it, which essentially means you're logged in to Google. (They could add it for non-gmail Google accounts, I guess.)

But Facebook could benefit from this. Maybe not at this early stage, but the way you log into Facebook is using your email account. That's exactly the step BrowserID wants to make easier.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#62

Post by romaniv » Fri, Dec 16, 2011, 5:27 PM UTC

I was hopeful about this protocol, but now I'm kind of disappointed. It uses email and is built into the browser, so why does it require JavaScript on the user side and a complicated verification server on the server side? I was a hoping for something simpler.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#63

Post by MatthewPhillips » Fri, Dec 16, 2011, 5:29 PM UTC

MatthewPhillips wrote: post #56

>Include the BrowserID include.js library in your site by adding the following script tag to your pages tag https://browserid.org/include.js type="text/javascript"> Not minified. Come on Mozilla, you did the same thing with the (rather large) Open Web Apps library. Minification is required. You are Mozilla, you should know this. YUI Compressor takes a few seconds at most.

Looks like I was either wrong or they've fixed it. Apologies.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#64

Post by zobzu » Fri, Dec 16, 2011, 5:30 PM UTC

philikon wrote: post #26

A lot of questions here revolve around how this is different from OpenID and single sign-on solutions like Google Accounts or Facebook Connect. Here's a rough list (may be incomplete or inaccurate by now; while I work for Mozilla, I'm not involved in this project): * federated (like OpenID) * open standard (like OpenID) * no passwords / no typing / no memorizing (e.g. like FB Connect) * possibility of browsers provid…

this post should be on browserid.org i find it difficult to find what it does, how its different, etc.. well until your post that is

Re: Mozilla's BrowserID (single sign-on for the web) is live

#65

Post by lisper » Fri, Dec 16, 2011, 5:32 PM UTC

For an even simpler alternative to BrowserID see: http://dswi.net/

Re: Mozilla's BrowserID (single sign-on for the web) is live

#66

Post by zobzu » Fri, Dec 16, 2011, 5:44 PM UTC

alexchamberlain wrote: post #52

gizzlon wrote: post #48

Earlier quoted context omitted.

Probably because client-based SSL certificates have been around forever, but no-one uses them. Probably not a coincidence either, my bank used to rely on client side certificates but gave up after, I guess, an insane amount of support calls.

They are brilliant, but they need to be more accessible. Hmmmmm... maybe I should provide a patch for Chromium/Firefox.

i wouldnt say brillant the CA model is still a pita where you've to pay for certified authorities that are backed up by the vendors

and then, those certified authorities still fail to secure themselves

it certainly made a lot of sense but in reality its not that good

Re: Mozilla's BrowserID (single sign-on for the web) is live

#67

Post by zobzu » Fri, Dec 16, 2011, 5:49 PM UTC

sp332 wrote: post #55

thristian wrote: post #12

Earlier quoted context omitted.

OpenID requires the user to remember what sites they have accounts on that provide OpenID authentication, and requires them to remember their authentication information for those sites every time they want to log into an OpenID-using site. In its current form, BrowserID requires the user to do the email-verification dance once for each email address they want to authenticate as, and from then on they can just pick it…

I don' really need a foo@browserid.org address to register there right? So I could actually get the same email address verified through multiple providers. How would the browser know which one I actually want to use?

you can use the email you like you select which of your registered email you want to use at first sign in (sign in that doesnt require password)

Re: Mozilla's BrowserID (single sign-on for the web) is live

#68

Post by jaredhanson » Fri, Dec 16, 2011, 5:55 PM UTC

For anyone interested in using BrowserID authentication from a Node.js app, Passport (which I developed) has a BrowserID module: https://github.com/jaredhanson/passport-browserid

Just drop in a few lines of code and you have single sign-on.

Re: Mozilla's BrowserID (single sign-on for the web) is live

#69

Post by lloydhilaiel » Fri, Dec 16, 2011, 5:59 PM UTC

MatthewPhillips wrote: post #56

>Include the BrowserID include.js library in your site by adding the following script tag to your pages tag https://browserid.org/include.js type="text/javascript"> Not minified. Come on Mozilla, you did the same thing with the (rather large) Open Web Apps library. Minification is required. You are Mozilla, you should know this. YUI Compressor takes a few seconds at most.

Hi MatthewPhillips,

That's just the license header that's not stripped. I agree, that's a bit draconian. lemme see if I can fix that for you.

lloyd

Re: Mozilla's BrowserID (single sign-on for the web) is live

#70

Post by lloydhilaiel » Fri, Dec 16, 2011, 6:02 PM UTC

MattBearman wrote: post #30

I like the idea of this, seems like a much better solution than Open ID, and I've never been a fan of sign in with Facebook/Twitter/Google/etc. However I'm a little disappointed that they tell you to add it as a blocking (synchronous) JavaScript include in the head of your document.

the include file is about 4.7k minified and compressed. You don't need to include it in head, that's lame. we'll update the docs.

lloyd