Hacker News Reader

Comment by glassx | Hacker News Reader

I believe that a native implementation has been on their plans from the start, but I haven't heard much about it lately. Here's some mockups:

http://people.mozilla.com/%7Efaaborg/files/projects/firefoxA...

There's also some work on integrating existing e-mail providers, so you can get instant identities:

http://identity.mozilla.com/post/17207734786/id-provider-sup...

This is probably the web-thing I'm most excited about today, even though the development is kinda slow. I really want to implement it as a sole identity provider on my websites some day.

EDIT: I also began writing a Safari extension that would work like the mockup above, but gave up halfway since it was too convoluted and totally insecure... maybe I should try writing a SIMBL plugin or something like that.

View on HN

A website relying on a single service to serve as a sole identity provider seems replete with risks. That sounds remarkably similar to Microsoft's Passport, an idea that was a non-starter for everyone except Microsoft.

It's hard to explain, but it's not much a "service" - the current implementation is just a "shim", since no browser supports it natively. Client-wise, it's just a JavaScript API. In the future, your browser will store your keys, not Mozilla.

But even with the current implementation it is possible to validate the assertion in your server without contacting browserid.org, but AFAIK nobody did it yet.

(I tried to find a reference for that, but they took it down from their Wiki. It used to say "You may choose to validate assertions on your own server": https://github.com/mozilla/browserid/wiki/How-to-Use-Browser... - the verification code is still online, though)

Your browser already stores your keys, even with the shim. :)

Faaborg's mockups are awesome, but they're well over a year old and not really guiding our current work. Still, definitely take a look at them, if nothing else than for the cool way of doing mockups!

You can definitely do your own verification without having us in the loop, but we'd urge you to hold off until this fall; the IETF is still standardizing some of the data formats we're using, so the exact serialization of keys and assertions might change between now and then. By using our verifier, you're certain to be up to date.

The easiest way to verify-it-yourself is to just run our code locally; it's all open source, after all :) https://github.com/mozilla/browserid

(PS: The docs are now on MDN, instead of the GitHub wiki: https://developer.mozilla.org/en/BrowserID )

We're a completely decentralized protocol, so there's no need to rely on a single service. To help with bootstrapping, we do offer a fallback to provision users without native support from their email providers, but there's nothing that ties any of this to Mozilla or a centralized service.

Reply on news.ycombinator.com