Mozilla's BrowserID (single sign-on for the web) is live

Post by ranit8 » Sat, Dec 17, 2011, 2:17 PM UTC

philikon wrote: post #26

A lot of questions here revolve around how this is different from OpenID and single sign-on solutions like Google Accounts or Facebook Connect. Here's a rough list (may be incomplete or inaccurate by now; while I work for Mozilla, I'm not involved in this project): * federated (like OpenID) * open standard (like OpenID) * no passwords / no typing / no memorizing (e.g. like FB Connect) * possibility of browsers provid…

> no exposure to identity provider (this is unlike any existing solutions; if you log into a site, your OpenID provide, Facebook, Google, etc. will know which site it was; not with BrowserID!)

Unfortunately that might be what prevents this or http://webid.info/ from getting traction. The big guys wouldn't like losing that data, and OpenID/OAuth already do the job well enough for them.

A comparison WebID/BrowserID can be found here: http://security.stackexchange.com/questions/5406/what-are-th...

Post by gizzlon » Mon, Dec 19, 2011, 10:51 AM UTC

icebraining wrote: post #80

zobzu wrote: post #66

Earlier quoted context omitted.

i wouldnt say brillant the CA model is still a pita where you've to pay for certified authorities that are backed up by the vendors and then, those certified authorities still fail to secure themselves it certainly made a lot of sense but in reality its not that good

The CAs don't need to play any part in client-cert based authentication. You just generate a cert locally and then copy the public key to the site when you register. Subsequent logins are performed by the server checking if you own the right private key that matches the public key used on registration. It's like SSH, not HTTPS. CAs are only useful to match a cert to a domain and/or known organization, or inside an or…

"You just generate a cert locally and then copy the public key to the site when you register."

But how do you know you're copying your key to the right site and not some fake? Answer is, of course, you don't, so you need something else. And it's not stronger than the weakest link..

Re: Mozilla's BrowserID (single sign-on for the web) is live

Re: Mozilla's BrowserID (single sign-on for the web) is live