How BrowserID differs from OpenID

http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid

by joeyespo • 15 years ago

95 28 15 years ago

identity.mozilla.com

pschlump• 15 years ago

I just finished implementing BrowserID in an application that I am building. It is quick and easy to use. Perhaps 20 minutes to get it to work. I used OpenID before. OpenID is annoying and difficult. I spent 3 full days working on it.

jmathai2• 15 years ago

I'm really excited about BrowserID. I think for the end user it makes more sense than OpenId which was doomed from the start because it was too difficult to understand what it was.

If only people owned their email addresses then this would be a truly decentralized (eventually) and portable identity system. I do think emails are the best global handle for users that we have currently - we should treat it as such.

sambeau• 15 years ago

I am too. My only concern is that it is still effectively a demo. Do we have any real commitment from Mozilla to keep it around?

wisty3• 15 years ago

OpenID kinda scares me, security wise. There's too many ways for developers to screw it up. Witness the ones who used Facebook names as unique user identifiers.

At least with email, provided by the email host, the string you get from them will be unique.

HedgeMage• 15 years ago

FAIL

Why would I want to use my email address as an identity? I already get more than enough spam.

_pdeschen• 15 years ago

Speaking of such (which is a valid concern) I always use a nice feature from gmail which gives the ability to append +anything to your username. Mail will be forwarded to your inbox as usual where you can apply filtering to know whom as leaked your email. Hence you can use username+foobar@gmail.com while registering for foobar webapp.

This assumes that foobar webapp accepts + as a valid email local part character which is not always the case unfortunately (and against RFC) but that is another story.

Just sayin

doublec• 15 years ago

Given that everyone knows about this feature, what's to stop spammers just stripping of the '+' portion?

wisty3• 15 years ago

Virtually every site does this already, this just makes it more constant, secure, and convenient.

drdaeman2• 15 years ago

A lot of experienced users out there tends to provide each service a different email address (username+servicename@example.org, servicename@bar.example.org, etc.)

BrowserID breaks this.

Osiris• 15 years ago

I do like their last point that the system is designed to be integrated directly into the browser. That avoids the issue of OpenID requiring that a popup be displayed to the user from their OpenID provider, which was a significant usability problem.

Having the browser handle the authentication makes for a much more seamless experience.

wmf2• 15 years ago

If you have browser support, the browser could log you in to your OpenID provider so there'd be no popup.

simcop2387• 15 years ago

The problem is that OpenID doesn't specify that part of it. I could have one that needs a key-fob token to authenticate there.

StavrosK• 15 years ago

I hope and pray a single sign-on system that doesn't depend on a specific third party catches on. Any system, OpenID, BrowserID, I don't care. It's about time we do away with the insecure and complicated system of one password per site.

JoshTriplett• 15 years ago

BrowserID only depends on a third party if you have a browser that doesn't handle BrowserID natively.

riobard• 15 years ago

I never understand why we keep drafting all sorts of identity mechanisms instead of using public key. It's easy to understand, very secure, and battle-field tested.

capnrefsmmat• 15 years ago

BrowserID is based on public key cryptography. It just provides a mechanism to (a) attach public keys to an identity (in this case an email address) and (b) enable easy, widespread adoption by websites and browsers.

Public-key crypto may be easy to understand and secure, but until now it's not had good browser integration, it's been hard for websites to manage, and there's been no adoption.

(For example, if you write your own public-key auth mechanism for a website, you need to program all the backup mechanisms in case the user loses their key due to browser failure, needs to recover their account because of a security problem, or whatever. BrowserID outsources that to email providers or secondary authorities.)

Check out the detailed protocol explanation:

https://wiki.mozilla.org/Labs/Identity/VerifiedEmailProtocol

aaaaaaaaaaa• 15 years ago

Yet, another protocol from Mozilla? It has even less features and is way more complicated than the last abandoned attempt: https://wiki.mozilla.org/Labs/Weave/Identity/Account_Manager...

Periodic• 15 years ago

One use case I still am hesitant about for email-as-username is the situation where a family shares an email address for a household. I know that ISPs like Comcast still just provide a main email address when they set up the account, and I expect many people don't bother to make more for the rest of the family.

With all the free email options available I doubt this would be a serious problem. I also know some sites are requiring unique email addresses in their DB now. I simply wonder how many users still do this and if it would negatively impact them.

How BrowserID differs from OpenID

Related Stories