Hacker News Reader

Comment by ams6110 | Hacker News Reader

This seems to encourage using the same credentials everywhere which I think most agree is a "bad idea." If BrowserID is compromised, the attackers have access to all the sites where I use browser id, right?

View on HN

The same could be said about OpenID and OAuth providers like Twitter, Facebook, Google, etc. The idea of having a centralized authentication provider is definitely not a new one. There are many advantages to using 3rd party authentication providers. The biggest security advantage 3rd party auth providers have is that they do security right and often they implement their authentication service using a commonly defined protocol. Many websites that choose to roll their own systems make many security mistakes and many people use the same credentials on many sites. So if any website is not secure authentication a user's login information is likely compromised across multiple websites because people generally use the same credentials.

Once this is supported by browsers and email providers there is no "BrowserID" to be compromised, your email provider would have to be compromised (which already gives attackers access to all the sites that you use that email on).

(Unless you meant "BrowserID" the protocol.)

There is a large distinction here - the provider (in the video, BrowserID.org) would have to be compromised, as only they have your credentials. This is quite a bit different and more secure than using the same credentials with many different providers, because in that scenario, the weakest of any party could get compromised and that way compromise all parties.

In addition to that, since the ID provider does not get any sort of information about which websites you visit with your ID, it would be impossible to know where exactly the ID is in use.

At least that's how I understand it.

Isn't that what happens when someone compromises your email too?

Reply on news.ycombinator.com