Federated Credential Management API

wicg.github.io

3 points·dane-pgp··3 comments

> This specification provides an API enabling a website to request a users federated credentials from a user agent, and to help the user agent store the users federated credentials for future use.

It would be nice if creating an account on a new website was as simple as a couple of clicks, and didn't require providing any personal information or anything linkable between sites.

I suspect, though, that websites (Relying Parties) will want some sort of guarantee that only one account per meatspace human is created on their site, to prevent Sybil attacks, and that might lead to there being just a short whitelist of acceptable Identity Providers (as is currently the case for much of the web).

Interesting proposal. I am liking it so far. Probably going to take years before it can be used?

If it really has the backing of Google, I could imagine it being deployed into Chrome and available on some Google sites this year. It would be nice if other browser makers gave early indications of support too, as that should give confidence to web developers that it's worth experimenting with and deploying.

Also, I'm sure that it will be designed to work in a backwards compatible way, i.e. the page can detect whether the feature is supported and fall back to a traditional username/password or social login system as needed.

Reply on news.ycombinator.com