10 ms·

They seriously need to work on their communication skills. It took me a good 15min to figure out what this thing actually does. And I'm still not sure I got it

by SeoxyS 15y ago

They seriously need to work on their communication skills. It took me a good 15min to figure out what this thing actually does. And I'm still not sure I got it right. OpenID failed because it was too complicated for mere mortals. This, I fear, may be too confusing. At least form the way it's presented. After reading the protocol spec, I have a somewhat better understanding of this. If I got this right, this is basically what this does: * asymmetric crypto authentication in the backend. * control over email address == authentication. * allows a trusted third-party to authenticate the user. This could be a user or a web service (like browserid.org?). * falls back to regular email authentication we see every day. I'm still unclear how you can securely verify email ownership thru cryptographic means. Anybody care to explain it?

ignifero 15y ago
They give you a token, you do a GET request to browserid.org with it and get the user's email, that's all. The user has to register their email with browserid.org first.
- dave1010uk 15y ago
  Wasn't one of the benefits that you don't need to rely on a third party service?
  - ignifero 15y ago
    I believe you will definately rely on one (of many possible) 3rd parties.
  - JoshTriplett 15y ago
    The third-party service handles the case where the user's browser doesn't handle BrowserID natively, which makes it possible to adopt this service without waiting for user's browsers to catch up.
bct 15y ago
Ignifero described what happens when your browser or email provider don't support BrowserID. When your browser and email provider both support BrowserID: 1. You log into e.g. gmail. 2. Your browser generates a keypair and sends the public key to gmail. 3. Gmail signs your public key and sends your browser a certificate saying "this key is owned by whoever@gmail.com". 4. You click "sign in" on some site (e.g. Hacker News) that uses BrowserID. 5. Your browser sends Hacker News an message saying "my user is whoever@gmail.com", that is signed with the private key generated in step 2. 6. Hacker News looks at the "gmail.com", grabs gmail's public key (the one that signed your public key in step 3) and verifies the signatures. Hacker News now knows that you control whoever@gmail.com. The process is described fairly well (diagrams and everything) at http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works
- huhtenberg 15y ago
  Read through your link, and here's just an observation - > BrowserID is a decentralized identity system BrowserID effectively links identity an email service provider, and while I realize that not everyone shares their emails with Google, a vast majority of people still does. That's not that much of decentralization, is it? Practically speaking. (edit) Added practically speaking... and ease up on that downvoting, distinguished HN comrades. Non-natural post scores hurt my feelings.
  - JoshTriplett 15y ago
    "decentralization" doesn't mean "forced decentralization". Anyone can register a domain name and have their own email at that domain, so anyone can create an identity. And ignoring the transitional bits in BrowserID, eventually that identity gets controlled entirely by the public/private keys in the user's browser. Or, in other words: if you don't trust Google, don't use gmail; that someone else chooses to do so doesn't make this system less secure for you.
    - huhtenberg 15y ago
      Sure, I understand that of course. I am just saying that practically speaking this property is not going to matter much in the world where everyone and their dog is on GMail. It is certainly nice to have though.
TillE 15y ago
How did OpenID fail (it's widely used)? How is it complicated for the user? Properly implemented, OpenID looks like this to the user: http://springpadit.com/login http://springpadit.com/login And something like this for the average developer: https://github.com/omab/django-social-auth https://github.com/omab/django-social-auth
- ignifero 15y ago
  Do an online poll and ask people "Do you know your openID" vs "Do you know your email". Users are trained to use emails for login, and that's a significant investment already.
  - TillE 15y ago
    That was a brief failure of communication when OpenID was new. Have a Google or Yahoo account? Your email address is your OpenID. Of course nobody is going to manually enter an OpenID URL. Why would they need to?
- JoshTriplett 15y ago
  That site fails terribly at supporting OpenID: it only supports four authentication providers, and doesn't allow a user to enter an arbitrary OpenID URL. "Properly implemented", OpenID looks like http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit : a choice of common OpenID providers to help users who don't understand OpenID, an option to use an arbitrary OpenID, and an option to use a username and password. Properly implemented, BrowserID looks like one big shiny "sign in" button, and yet it still supports any service the user wants to use, and better yet no third-party service at all. Seems like a big improvement to me.
  - jancona 15y ago
    Why do you think a "properly implemented" OpenID site should allow the user to use any authentication provider? The relying party site is trusting the OpenID provider to authenticate its users. Wouldn't sites with real security requirements want to vet providers before trusting them?
joeyespo 15y ago
Wow, I had exactly the opposite experience. Tons of thoughts popped into mind as I watched. If my brain had a replay button, it would say: * Ok, what if I have multiple accounts? Ahh, nice. * Hmm it would be cool if it worked like LastPass, where you get great security and only one password to remem... ha, nice, it's very similar! * Email verification? ....yep, check. * Can you lock the browser so that nobody can just use your browser to sign in? (No direct answer, but I assume so. Or will be this way soon.) * Open source? Great. I didn't really expect any technical answers. But they did mention the blog and there's got to be some good posts coming soon. Subscribed.
- dschobel 15y ago
  Exactly, I think most users of LastPass or 1Password had the same thoughts. The question I do have: why would I use this over something like LastPass which already has plugins for every browser and device most people will ever care about?
  - Marwy 15y ago
    And let's not forget that you can add any site to Lastpass, while with BrowserID you can add a site that already implemented it. That sucks.
groby_b 15y ago
Read the "Verified e-mail protocol" thingy instead. The blurb the link on HN points to is indeed completely useless. They don't verify e-mail ownership through crypto means - they use the fact that e-mail is identity. Basically, your mailhost (or a proxy, like browserID) holds your public key, while your browser holds your private key. Now, when you authenticate against any BrowserID auth site, you simply sign with your private key and provide the e-mail address. Since the browser stores both, that's a trivial interaction. The site then verifies your signature with the mail host. (That's where the asymmetric crypto comes in) At least that's how I understand it - their explanation is indeed a bit cryptic. Hope they clean it up.
xiaoqmauii 15y ago
welcometo: http://www.fullmalls.com http://www.fullmalls.com The website wholesale for many kinds of fashion shoes, like the nike,jordan,prada,, also including the jeans,shirts,bags,hat and the decorations. All the products are free shipping, and the the price is competitive, and also can accept the paypal payment.,after the payment, can ship within short time. free shippingcompetitive priceany size availableaccept the paypal http://www.fullmalls.com http://www.fullmalls.com jordan shoes $32nike shox $32Christan Audigier bikini $23 Ed Hardy Bikini $23Smful short_t-shirt_woman $15ed hardy short_tank_woman $16Sandal $32christian loubo utin $80 Sunglass $15 COACH_Necklace $27handbag $33AF tank woman $17puma slipper woman $30 http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com
21echoes 15y ago
i thought the video demo was pretty clear for the consumer perspective-- to a user, they click sign in, tell a site what email they want to identify with to that site, don't have to make a specific login to that site, and the browser handles everything.

by SeoxyS 15y ago

ignifero 15y ago

They give you a token, you do a GET request to browserid.org with it and get the user's email, that's all. The user has to register their email with browserid.org first.

dave1010uk 15y ago
Wasn't one of the benefits that you don't need to rely on a third party service?
- ignifero 15y ago
  I believe you will definately rely on one (of many possible) 3rd parties.
- JoshTriplett 15y ago
  The third-party service handles the case where the user's browser doesn't handle BrowserID natively, which makes it possible to adopt this service without waiting for user's browsers to catch up.

bct 15y ago

Ignifero described what happens when your browser or email provider don't support BrowserID. When your browser and email provider both support BrowserID: 1. You log into e.g. gmail. 2. Your browser generates a keypair and sends the public key to gmail. 3. Gmail signs your public key and sends your browser a certificate saying "this key is owned by whoever@gmail.com". 4. You click "sign in" on some site (e.g. Hacker News) that uses BrowserID. 5. Your browser sends Hacker News an message saying "my user is whoever@gmail.com", that is signed with the private key generated in step 2. 6. Hacker News looks at the "gmail.com", grabs gmail's public key (the one that signed your public key in step 3) and verifies the signatures. Hacker News now knows that you control whoever@gmail.com. The process is described fairly well (diagrams and everything) at http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works

huhtenberg 15y ago
Read through your link, and here's just an observation - > BrowserID is a decentralized identity system BrowserID effectively links identity an email service provider, and while I realize that not everyone shares their emails with Google, a vast majority of people still does. That's not that much of decentralization, is it? Practically speaking. (edit) Added practically speaking... and ease up on that downvoting, distinguished HN comrades. Non-natural post scores hurt my feelings.
- JoshTriplett 15y ago
  "decentralization" doesn't mean "forced decentralization". Anyone can register a domain name and have their own email at that domain, so anyone can create an identity. And ignoring the transitional bits in BrowserID, eventually that identity gets controlled entirely by the public/private keys in the user's browser. Or, in other words: if you don't trust Google, don't use gmail; that someone else chooses to do so doesn't make this system less secure for you.
  - huhtenberg 15y ago
    Sure, I understand that of course. I am just saying that practically speaking this property is not going to matter much in the world where everyone and their dog is on GMail. It is certainly nice to have though.

TillE 15y ago

How did OpenID fail (it's widely used)? How is it complicated for the user? Properly implemented, OpenID looks like this to the user: http://springpadit.com/login http://springpadit.com/login And something like this for the average developer: https://github.com/omab/django-social-auth https://github.com/omab/django-social-auth

ignifero 15y ago
Do an online poll and ask people "Do you know your openID" vs "Do you know your email". Users are trained to use emails for login, and that's a significant investment already.
- TillE 15y ago
  That was a brief failure of communication when OpenID was new. Have a Google or Yahoo account? Your email address is your OpenID. Of course nobody is going to manually enter an OpenID URL. Why would they need to?
JoshTriplett 15y ago
That site fails terribly at supporting OpenID: it only supports four authentication providers, and doesn't allow a user to enter an arbitrary OpenID URL. "Properly implemented", OpenID looks like http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit http://ikiwiki.info/ikiwiki.cgi?page=index&do=edit : a choice of common OpenID providers to help users who don't understand OpenID, an option to use an arbitrary OpenID, and an option to use a username and password. Properly implemented, BrowserID looks like one big shiny "sign in" button, and yet it still supports any service the user wants to use, and better yet no third-party service at all. Seems like a big improvement to me.
- jancona 15y ago
  Why do you think a "properly implemented" OpenID site should allow the user to use any authentication provider? The relying party site is trusting the OpenID provider to authenticate its users. Wouldn't sites with real security requirements want to vet providers before trusting them?

joeyespo 15y ago

Wow, I had exactly the opposite experience. Tons of thoughts popped into mind as I watched. If my brain had a replay button, it would say: * Ok, what if I have multiple accounts? Ahh, nice. * Hmm it would be cool if it worked like LastPass, where you get great security and only one password to remem... ha, nice, it's very similar! * Email verification? ....yep, check. * Can you lock the browser so that nobody can just use your browser to sign in? (No direct answer, but I assume so. Or will be this way soon.) * Open source? Great. I didn't really expect any technical answers. But they did mention the blog and there's got to be some good posts coming soon. Subscribed.

dschobel 15y ago
Exactly, I think most users of LastPass or 1Password had the same thoughts. The question I do have: why would I use this over something like LastPass which already has plugins for every browser and device most people will ever care about?
- Marwy 15y ago
  And let's not forget that you can add any site to Lastpass, while with BrowserID you can add a site that already implemented it. That sucks.

groby_b 15y ago

Read the "Verified e-mail protocol" thingy instead. The blurb the link on HN points to is indeed completely useless. They don't verify e-mail ownership through crypto means - they use the fact that e-mail is identity. Basically, your mailhost (or a proxy, like browserID) holds your public key, while your browser holds your private key. Now, when you authenticate against any BrowserID auth site, you simply sign with your private key and provide the e-mail address. Since the browser stores both, that's a trivial interaction. The site then verifies your signature with the mail host. (That's where the asymmetric crypto comes in) At least that's how I understand it - their explanation is indeed a bit cryptic. Hope they clean it up.

xiaoqmauii 15y ago

welcometo: http://www.fullmalls.com http://www.fullmalls.com The website wholesale for many kinds of fashion shoes, like the nike,jordan,prada,, also including the jeans,shirts,bags,hat and the decorations. All the products are free shipping, and the the price is competitive, and also can accept the paypal payment.,after the payment, can ship within short time. free shippingcompetitive priceany size availableaccept the paypal http://www.fullmalls.com http://www.fullmalls.com jordan shoes $32nike shox $32Christan Audigier bikini $23 Ed Hardy Bikini $23Smful short_t-shirt_woman $15ed hardy short_tank_woman $16Sandal $32christian loubo utin $80 Sunglass $15 COACH_Necklace $27handbag $33AF tank woman $17puma slipper woman $30 http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com http://www.fullmalls.com

21echoes 15y ago

i thought the video demo was pretty clear for the consumer perspective-- to a user, they click sign in, tell a site what email they want to identify with to that site, don't have to make a specific login to that site, and the browser handles everything.