Hacker News Reader

Comment by latchkey | Hacker News Reader

This is full of fail. Your email address is not your identity. I must be able to change my email address without having to change my identity.

View on HN

It's not that simple. They authenticate against your Account at Browser ID. I would assume you can go into Browser ID and add / remove email addresses from your account which makes it even easier when you change your email. Now you don't have to visit 20 different sites to update them.

Is there some sort of account ID other than an email address? It looks like the email is all that gets sent to the website (although I didn't read deeply enough to be sure). If you change (add new, remove old) your email address at browserid.org then revisit a site you authenticated to before, what happens?

Indeed. Ideally, the site would end up with the user's public key, and optionally their email address; they should use the former as the primary key in their database, and the latter as an easily-changed property.

That would be nice except I think that you will have different keys for different browsers, and for different machines.

Presumably you could sync them up if you really wanted to, but it would be an awful user experience if that was mandatory.

The implementation at browserid.org returns the email only. So there's no way to change the email without visiting all the sites you've registered in using browserid.

Reply on news.ycombinator.com