Slashdot Mirror
Mozilla BrowserID: Decentralized, Federated Login
An anonymous reader writes "Mozilla Labs has just launched the prototype of its BrowserID project and the accompanying Verified Email Protocol standard. Basically, BrowserID is a browser-based federated login provider like Facebook Connect, but without the privacy leaks. Fundamentally, BrowserID is public key encryption. You register an email address with your browser, which is then confirmed with a standard 'click here to confirm' email. A public/private key pair is then generated; your browser keeps the private key, and your email provider keeps the public key. Now, when you visit Facebook (or any site that supports BrowserID), your browser gives Facebook your email address and an identity token signed with your private key. Facebook queries your email provider for your public key, decrypts your identity token, and logs you in — voila, secure, private, browser-based logins. Oh, and the prototype is written in HTML and JavaScript — so it works across every modern browser, too."
Nor does logging into your online bank account with a normal username / password. This looks to just be a wrapper for a more secure, trusted identity.
You can still have pseudonymity, just sign up for an e-mail address and don't use your real name.
The right to protest the State is more sacred than the State.
yeeeeeeeeeeeeeeeeeeeeeeeeeeessssssss!
finally. thank the deities.
Ah, so when i have to reinstall my OS due to HDD death or OS death and for whatever reason, can't save my profile app data files (depending on where it stores the key)... then what?
Will i just be able to do a "Forgot my password" type action to regenerate a private key?
As I understand it, the browser keeps your private key in your profile, just as it keeps your bookmarks and cookies in your profile. And as the protocol spec states: "It does not forbid synchronization" of the private key across devices. So back up your profile.
Trusting yet another 3rd party service with authentication data. What could possibly go wrong?
Not sure if you're trolling or not (you probably are), but in 2nd and 3rd world countries Internet Cafes and cellphones are the primary means of Internet access...
The biggest problem with the current "e-mail address as username" is spam. So how does this prevent the site in question from selling my e-mail address to spammers?
isn't the browser basically the most targeted piece of software on a computer? if the private key is stored in the browser, doesn't that mean that potentially one successful exploit in the browser would let a hacker log into any website as you?
according to this wiki entry it is possible to create multiple key pairs for one address, so public keys are not compulsorily unique identifiers.
The same way nearly all signup forms request your email in order to be able to recover your account if you forget your password. Oh I forgot people create fake emails if they do not trust the site
Not just that, but now you have to remember to back up your browsers private key, and have them synced across different browser installs...
So wait - why doesn't this use the existing PGP web of trust and software?
And how does it mitigate the MITM/Phishing attacks that plagued OpenID?
I'm skeptical, but encouraged to see some efforts here...
Semantics is the gravity of abstraction
So where does this leave Internet users whose e-mail providers decline to implement Verified Email Protocol?
My browser will automatically provide my e-mail address? The very thing I do NOT want to provide when signing in with the majority of sites?
Also, as a web developer, I think it is a real bad design error to use an e-mail address as a login. What happens if you change your provider? Do you log in with your new (thus unknown) e-mail address? Or do you want to send the lost password to the no longer existing one?
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
If only I hadn't used used "password123" when I signed up for Hotmail, Gawker, Neverwinter Nights, etc.
This system adds nothing to the security of identity as it does nothing the change typical user behavior.
Well then you don't use this system in an internet cafe. I dont use my fingerprint scanner outside my house, i just have to remember a password, urgh
Seems Mozilla is back on the straight and narrow and innovating ideas again. They lost their way for a long time, and allowed Google in. Glad to see they are back in the game and giving Chrome competition. After all, Mozilla are the only ones out there who actually genuinely care about web and want it to thrive into something even more beautiful. Microsoft and Google both have their own personal agendas.
Dont know, if you want to use your cell phone you may be able to syc your keys to that browser, however if you are really going to an internet cafe, maybe you should remember your password.... So you hate this extra security, because your choice in browsing is innately insecure... No ones problem but your own.
When you cant win, ad hominem.
they get access to all your shiznit.
OOoops! too late your browser has already given you up...
And what if you need to have multiple identities?
Rick B.
This does nothing to protect my anonymity.
I didn't know Facebook allowed anonymous logins.
No sig today...
I remember seeing another Mozilla video about good password habits. One of the pieces of advice given was to pick a "base" password and add a couple different letters depending on what site you were signing up for (somehow incorporating the website name), this way your passwords would be different across all the sites you visit, and one being compromised wouldn't necessarily mean that your entire online identity would be gone.
However, this BrowserID seems to function (from strictly a user standpoint) as a password manager would. You have one global password that logs you into each and every site. So aren't we back to square one? Isn't that a Bad Thing? Or is there something I'm missing?
And will this make attacking the browser even more lucrative? Things are already pretty bad.
If you've got malware then you're screwed anyway....
No sig today...
I create fake emails even when I trust the site !
The Cloud - because you don't care if your apps and data are up in the air.
I tried the demo at http://myfavoritebeer.org/ and the result was:
"Error encountered while attempting to confirm your address. please try again. (error message: unknown)"
So this system just gives your verified email address to whatever site wants to have it?
One verified address. So just set up the system so that the browser can manage more than one such id. For most sites, you'd then use the id tied to a throwaway hotmail address. Or to a specialized server that only generates email lookalikes which you cannot actually deliver to.
What I'd like to have is something simpler, and this was suggested by another /. person:
Go to a site. Type in your username. It will have a string of random character (or perhaps a timestamp + some random characters) that is copy/pastable. Copy this text. Sign it with your PGP/gpg private key. Paste the result back, and log in.
The advantage of this is that PGP/gpg is pretty much platform agnostic, the keys can be stored in secure locations such as smart cards, or TPMs, PGP has proven itself and stood the test of time, and one's private key remains theirs, generated by the mechanism they so chose. For example, if I wanted a key that was generated on a smart card and would never leave that physical enclosure, I can do so. I even can have an offline computer to do the signature validations, although it is a PITA to type that in though.
This should be done over SSL, as an attacker could grab the session once authenticated, but as for passwords stored, there isn't much an attacker can do with a bunch of public keys unless they happen to have a spare TWIRL or quantum factorization machine in their basement.
As for ISPs, the older mom and pop ISPs, I'd mostly trust. However, some other ISPs like some in the UK can't even be trusted to not actively MITM your Web connections, much less actually be worthy of housing secure credentials.
But it doesn't.
It is just a way to verify the the email-address you already own, but without waiting for the email to arrive (or having it getting stuck in spamfilters) and clicking a link.
Now you click a link only ones to connect your browser to your email address (and obviously you only share the email-address information to site the sites you want).
This allows for a lot more interresting UI changes to make it easier for users to do so:
https://wiki.mozilla.org/images/4/4c/IdentityInTheBrowser.png
Also it prevents Facebook from tracking you all over the web, like they currently do with the Facebook Connect-button (!)
New things are always on the horizon
It can be the same as with username/password authentication: when you log into your email provider, you see a box that says "store this login info", and you don't check it.
To whatever site you decide to give it to. User intervention (at least one click in the browser chrome) is required.
(This is obvious, why do people assume that new systems do the dumbest thing possible and not even bother to check?)
Yes, Mozilla created a seperate specification that others can implement.
BrowserID is the Mozilla project and Verified Email Protocol is the specification they created.
It should be really easy for a large mail provider like GMail to provide this and it needs to have is to store a public key and have it available to anyone who would want to check it.
New things are always on the horizon
Just to be clear, your email provider asks your browser to generate a new public/private keypair. The email provider only ever sees your public key.
"is there a passphrase you'll use to open it each time you launch the browser?"
That depends on the browser implementation, but I'm sure many will do so.
A new form of "Single Sign-On" ?
New things are always on the horizon
Got damn Feds is getting involved in everything these days.
Hell, pretty soon they're gonna be all up in my Social Security and Medicare. That's why I'm a-voting for that pretty Mi-chele Bachmann. And let me tell you, I'd like to show her what a real man is. You know she ain't getting it from that big homo she's married to. And by homo, I mean gay as pink ink. Dude has to tie weights to his shoes so they don't float right out of the closet. He's queerer than a box of monkeys on DMT. Gay cubed.
You are welcome on my lawn.
The tech isn't novel, but it's not crippled by client cert's terrible UI.
Yes, they tried to levarage OpenID a few years ago, it didn't work out.
So now they created this.
And good thing is, a lot of proven technology already (client cert).
New things are always on the horizon
Encrypt all the passwords and keys before storing them on disk and have the user provide a passprase before using the browser.
I expect that is how it will work.
New things are always on the horizon
What exactly are you going to man-in-the-middle? The only things being sent are public keys and signed assertions.
Which is depends on a whole lot of big protocols which are much more complicated than need be.
Have a look at the specification:
https://wiki.mozilla.org/Labs/Identity/VerifiedEmailProtocol
https://wiki.mozilla.org/Identity/Verified_Email_Protocol/Latest
New things are always on the horizon
(This is obvious, why do people assume that new systems do the dumbest thing possible and not even bother to check?)
Because setting up that click event to be the close box on a pop up is beyond simple.
Having to work for a living is the root of all evil.
Erm... Is this an advertisement/spam or a legit post? I can't quite tell...
On the one hand, it's well written, unlike most ads. On the other, it has the same one-link-to-paragraph-of-information I've seen several times before.
If it had been written by AC, I'd have considered it spam, but...
To whatever site you decide to give it to. User intervention (at least one click in the browser chrome) is required.
(This is obvious, why do people assume that new systems do the dumbest thing possible and not even bother to check?)
Because on slashdot, naming the most obvious flaws in a new idea is what passes for insightful. I'm starting to think the between-the
-lines subtext is, "I did not think of this cool idea and am slightly envious, therefore it must be fatally flawed." because surely the people who come up with new ideas are incapable of thinking of these obvious and sometimes crippling flaws on their own.
Except who uses the same email for all logins? I have one for professional use, one for personal use, one for sites I don't know if I can trust, and at least 2 alternates for different ids. I'm not going to setup 6 profiles and open close the browser depending on which one I need. Worse yet it means others using my computer can authenticate themselves as me.
It's just a bad idea all round.
I wonder how hard this is to set up if you run your own email servers. I like postfix on linux...would it be something in coordination with that, or just another stand alone app that I'd run on a server I have from my domain?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
You don't need to open/close the browser.
There will be a UI for that, where you choose what identity you want to use for the site you are looking at.
New things are always on the horizon
Or...set up a real anonymous email account with a nym server...?
Set up this account that bounces through a few remailers....will be a real email account, but virtually untraceable.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
You need:
* the normal stuff to handle email:
- like a domain
- like an incoming/outgoing mail server, probably spamfiltering
- probably a IMAP/POP-server
- or maybe a webserver for webmail
- and the a webmail program
If you want to implement the Verified Email Protocol, this adds:
You need a webserver for your domain which has a http://example.com/.well-known/host-meta file which points to an URL where the public-key-information can be queried.
That is all this adds.
If you want to set this up for users, you probably would want an extra settings page in the webmail-app for setting up the public key.
New things are always on the horizon
Not from what I saw in the UI, it's a click and done interface not click, choose, and done. Still doesn't address others being able to authenticate themselves as me.
But what exactly does this get me over SSL Client Certificates?
Frankly, I don't entirely understand why the world hasn't started using SSL Client Certificates, and I wonder what will make people use this scheme, when client certificates have lain unused for so long.
The Mozilla people should have had some very serious conversations with people working in the spam/phish/botnet space before going down this road. It doesn't matter how clever or robust this scheme is, in the contemporary environment it's absolutely worthless.
In fact: it's worse, because it provides a new attack vector to people who have already demonstrated that they're very adept.
Why didn't it work out? (I don't know much about OpenID.)
You need a webserver for your domain which has a http://example.com/.well-known/host-meta file which points to an URL where the public-key-information can be queried.
So, if you have only an e-mail domain (e.g., a domain purchased solely to allow you to have your own GMail domain), then you can't use this service.
There are also a lot of people who have e-mail through an ISP which either won't do this at all, or would screw it up in some way that your login wouldn't work (Verizon, Comcast, etc.). I don't even know if Google would support this, as all HTTP requests to gmail.com seem to redirect to google.com/mail.
It had damn well better be done locally, or you have no guarantee that your private key is actually private. Are they going to write the keygen code in Javascript?
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
Where Facebook rejects ALL traffic associated with a browser I am using?
"Flyin' in just a sweet place,
Never been known to fail..."
The image linked by Lennie shows multiple profiles that you can choose from on the fly. The last image has "Anonymous", "You" and "Create", which implies that you can have how many profiles you want.
Dilbert RSS feed
Secondary Authorities
As noted above, it is unrealistic to expect every mail host on the internet to adopt this protocol. A secondary authority is a trusted intermediary who verifies an email address on behalf of a relying party. Secondary authorities could be operated by entities that make strong guarantees about user privacy and authentication accuracy, and are perceived by users and developers to be both technically competent and commercially disinterested.
A secondary authority could verify an identity in whatever way it sees fit, but in one scenario, the user would simply provide their email address to the authority in a web page. The authority would then engage in a multi-stage authentication process, where it stores a cookie in the user's browser, sends a message to the provided email address, and, when the user clicks a link in the provided email message, establishes that this browser is being used by a user who controls that email address.
Dilbert RSS feed
It doesn't improve security on the client's side, but it does on the server; if Sony had implemented this (or OpenID, or any of those) they wouldn't have a database full of clear-text passwords delivered on a silver plate to any attacker.
Dilbert RSS feed
I've never heard of an email only domain..?
I think a domain is a domain is a domain. Just associating basically a name with an IP address....who is imposing this 'limit' on you for a domain you purchased? I've never seen this at place you buy domains at like GoDaddy...etc. You purchase the name, it is yours to do, or not do as you wish...?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
I just saw this at the bottom of my /. page
Get more comments "119 of 118 loaded"
Race condition or faulty logic? I would prefer a race condition as it makes me feel like I just won the lottery.
Sounds interesting, but right now the role of identity provider seems to be limited to (to quote the page itself) "dudes like Yahoo!, Google, Twitter, Facebook, and even github".
Well, thank you, but I run my own server and I own my own domain and I want to provide my own identity.
So, call me again when there's a Debian package for that. Until that happens, I'm not interested.
Assorted stuff I do sometimes: Lemuria.org
The spec actually explicitly envisages this:
https://wiki.mozilla.org/Labs/Identity/VerifiedEmailProtocol#Scope_of_the_system
"With some additional work, to create pseudonymous identities that allow a user to provide a different address per relying site"
I've never heard of an email only domain..?
I suspect that there are a lot of people who purchase domains to have a fixed e-mail address but don't set up a web server at that domain, especially now that you can use sites like Facebook to post the kinds of things that most people would put on their personal website.
Sorry to be the one to break the news to you, but the second world ceased to exist when the Soviet Bloc disintegrated in 1991. That was twenty years ago. Please stop misusing this obsolete term.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Or get Google to maintain Gmail.com for you!
Gmail has a "user+@gmail.com" facility which you can use to simulate individual addresses per correspondent.
Lets say your email address is 'Example@gmail.com'. Simply give out 'Example+BankOfAmerica_2011@gmail.com' when registering on Bank Of America's website. The '+BankOfAmerica_2011' bit is completely made up by you. Now any emails sent to you by BOA show up in your Gmail inbox, where you can sort by recipient. The only issue is remembering the email address you had cooked up in the first place, when logging into their website. :) But naming conventions and browser autocomplete help.
Of course, anyone with knowledge of Gmail's convention can figure out your 'real' email address by stripping out the bit after the plus sign. So these addresses are not really untrackable.
Misread it.
Thought they were talking about de-centralized identity.
Basically about as polar opposite as possible.
I need a new browser, I guess.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
1. If I use multiple computers, how do I log in? E.g. I'm at a friends house, and log in in their web browser. THAT computer doesn't have my private key. Or if I regularly use public computers at a school.
2. If my computer is hacked, what happens to my key collection?
3. If my drive crashes, how do I recover my key collection?
4. If I regularly use linux, mac and windows real and virtual machines, how do I keep my keys sync'ed when Mozilla can't even do this with my bookmarks.
Third Career: Tree Farmer Second Career: Computer Geek First Career: Teacher, Outdoor Instructor, Photographer.
Actually, no. Sorry if that came across as an ad, I just provided that link because I have had lots of good deals from that particular outfit. And as I said, they are hardly unique; given that you pay for postage by weight, you would generally buy such a product from someone who doesn't need to use international postage, so my link was obviously useful only for Australian readers.
Fair enough, thanks.
I use NoScript. The demo site requires code from googlecode.com to be permitted. While the Javascript provided by Google may be innocuous, I would personally not make this assumption. I don't think that it would be possible for it to get the private key, but I would suspect that it would do datamining which would reveal the email addresses in use.