Feeds

Mozilla outs un-Google site sign-in prototype

Token-free BrowserID

  • alert
  • submit to reddit

The Power of One Brief: Top reasons to choose HP BladeSystem

Mozilla has proposed a new method for signing into websites that avoids both site-specific passwords and existing cross-site sign-in services from corporate behemoths such as Google and Facebook.

Known as BrowserID, Mozilla's prototype is built atop a new "Verified Email Protocol", which uses public-key cryptography to prove that a particular user owns a particular email address. In essence, BrowserID lets you log into a website simply by clicking on a button and choosing an email address you wish to sign in with. Behind the scenes, the website, your browser, and a separate verification service use crypto keys to verify your identity.

"For a Web developer, creating a new application always involves an annoying hurdle: how do users sign in? An email address with a confirmation step is the classic method, but it demands a user’s time and requires the user to take an extra step and remember another password. Outsourcing login and identity management to large providers like Facebook, Twitter, or Google is an option, but these products also come with lock-in, reliability issues, and data privacy concerns," Mozilla says in a blog post, referring to services based on OpenID and similar protocols.

"With BrowserID, there is a better way to sign in. ... A user can prove their ownership of an email address with fewer confirmation messages and without site-specific passwords."

To set up BrowserID, the user supplies an email address and a password. This is then sent to the verification service, which returns an email to your inbox so you can verify that you indeed own that email address. (The process is similar to the email-based password-reset services so many websites use today). The service then creates a cryptographic key pair, keeping the public key and storing the private key with your browser.

When you later visit a website that's set up for BrowserID, you simply click on a "sign-in" button and select your registered email address (you can register more than one). The site then retrieves the keys to verify your identity.

The ultimate idea, however, is to convince mail providers to adopt the system, so that a separate verification service isn't needed. "Anyone with an email address can sign in with BrowserID, and email providers can implement BrowserID support to make the system even easier for their users," Mozilla says. But even with the verification service, the setup is quite simple.

The service does collect a list of sites you share your email with, and if mail providers enter ithe mix, they will have access to such data as well. But Mozilla argues that unlike other cross-site sign-in services, BrowserID doesn't leak data back to any other servers.

The open source outfit also says the system is superior to OpenID and other identity token–based protocols because it puts so little between the user and the site they're visiting. "A number of web-scale identity proposals start by creating a new identity token – for example a user ID or personal URL – and go on to describe how to use that token to authenticate the user," Mozilla says on a wiki describing the Verified Email Protocol. "What we've learned from several years of experience with OpenID (and related protocols) is that this isn't quite good enough: establishing an identity token, in isolation from the rest of the web, doesn't actually help a site engage with its users."

Developers can go here for the JavaScript needed to add BrowserID to their sites, and browsers uses can sign into a test site here. The prototype is built with HTML and JavaScript, so it runs on all newer browsers, including mobile browsers. ®

Seven Steps to Software Security

More from The Register

next story
KDE releases ice-cream coloured Plasma 5 just in time for summer
Melty but refreshing - popular rival to Mint's Cinnamon's still a work in progress
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Another day, another Firefox: Version 31 is upon us ALREADY
Web devs, Mozilla really wants you to like this one
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.