Portier – An email-based, passwordless authentication service
portier.github.io
Portier – An email-based, passwordless authentication service
1–10 of 89 posts
Re: Portier – An email-based, passwordless authentication service
#2Real question here is 'why isn't auth built in to the browser'. Lack of browser support is the reason oauth is so complicated (it relies on HTTP redirect to pass information around).
Imagine a web experience sans cookies and sans JS. If you take into account the economics of content, it can only happen with browser-mediated login.
Re: Portier – An email-based, passwordless authentication service
#3Real question here is 'why isn't auth built in to the browser'. Lack of browser support is the reason oauth is so complicated (it relies on HTTP redirect to pass information around). Imagine a web experience sans cookies and sans JS. If you take into account the economics of content, it can only happen with browser-mediated login.
Could it be done in a non-spoofable, decentralised way?
Xanadu is/was specified to include user authentication. No idea about the implementation there.
Re: Portier – An email-based, passwordless authentication service
#4Real question here is 'why isn't auth built in to the browser'. Lack of browser support is the reason oauth is so complicated (it relies on HTTP redirect to pass information around). Imagine a web experience sans cookies and sans JS. If you take into account the economics of content, it can only happen with browser-mediated login.
Could it be done in a non-spoofable, decentralised way? Xanadu is/was specified to include user authentication. No idea about the implementation there.
Yes. Mozilla Persona was explicitly designed with the intent of having auth as a feature in every browser.
Re: Portier – An email-based, passwordless authentication service
#5Real question here is 'why isn't auth built in to the browser'. Lack of browser support is the reason oauth is so complicated (it relies on HTTP redirect to pass information around). Imagine a web experience sans cookies and sans JS. If you take into account the economics of content, it can only happen with browser-mediated login.
[deleted]
Re: Portier – An email-based, passwordless authentication service
#6Real question here is 'why isn't auth built in to the browser'. Lack of browser support is the reason oauth is so complicated (it relies on HTTP redirect to pass information around). Imagine a web experience sans cookies and sans JS. If you take into account the economics of content, it can only happen with browser-mediated login.
It is*
Credential Management[1] is newly ratified (or will be ratified soon I lose track at this point. Mike West works fast). Either way, the api is exposed to chrome.
The best I can understand is that Google and Apple both want to store your passwords in the browser/keyring, and sync them between your devices. Apple has begun "suggesting" passwords in Safari that are fairly strong.
It's scary to think about, but "browser" is already the most used "password manager". It just is not full featured yet.
[1] https://w3c.github.io/webappsec-credential-management/
* you are using chrome
Re: Portier – An email-based, passwordless authentication service
#7Real question here is 'why isn't auth built in to the browser'. Lack of browser support is the reason oauth is so complicated (it relies on HTTP redirect to pass information around). Imagine a web experience sans cookies and sans JS. If you take into account the economics of content, it can only happen with browser-mediated login.
Basically you're asking for an authentication standard.
Some de facto standards are completely client side.
Browsers embed at least the "fill form/remember password" authentication method. It's not a standard and some people use it. Some people use an external password manager instead (I do, keepassx). Some password managers come with addons for the major browsers. Other people don't use anything and try to remember passwords, sorry for them.
Maybe your question was why don't browsers embed oauth?
About the sans cookies experience, with oauth or without it, there should be a standard way for browsers to send authentication info in the request. I don't see another way, but I might be wrong. Basic auth is a way, cookies are another. Both are ok only with https. What do you suggest instead?
Re: Portier – An email-based, passwordless authentication service
#8Hi! A few of us have been hacking on this scaled-down, spiritual successor to Persona.
The core idea is that you treat this (self-hostable!) microservice like a black box: email address goes in, validated proof of identity comes out. No passwords, and no secrets to store in your application’s database. The service itself is also effectively stateless: aside from caching, the longest lived key in Redis has a TTL of 15 minutes, and no other datastore is required. So it should scale pretty reasonably, and be easy enough to administer for hobbyists.
Behind the scenes, it works similarly to a password reset or passwordless login workflow, but with progressive enhancement so that, e.g., Gmail users go through Google Sign-In instead of having to check their email.
Re: Portier – An email-based, passwordless authentication service
#9Note that Mozilla Persona did not support passwordless authentication. Specifically, you would still need to create a Persona password if you didn’t use a Gmail/Yahoo email address.
I’ve tested this service with one of those 10-minute emails and it seems to work without any passwords, so true passwordless authentication.
Re: Portier – An email-based, passwordless authentication service
#10Note that Mozilla Persona did not support passwordless authentication. Specifically, you would still need to create a Persona password if you didn’t use a Gmail/Yahoo email address. I’ve tested this service with one of those 10-minute emails and it seems to work without any passwords, so true passwordless authentication.
Yep! Requiring a separate account for Persona was, in hindsight, misguided. I've written a bit about what Persona got right and wrong, and how we* plan for Portier to be different, at https://github.com/portier/portier.github.io/blob/master/Oth...
*Though Mozilla supported my work on this, Portier is an independent side project with significant code contributions from folks outside Mozilla.