BrowserID is based on public key cryptography. It just provides a mechanism to (a) attach public keys to an identity (in this case an email address) and (b) ena

BrowserID is based on public key cryptography. It just provides a mechanism to (a) attach public keys to an identity (in this case an email address) and (b) enable easy, widespread adoption by websites and browsers. Public-key crypto may be easy to understand and secure, but until now it's not had good browser integration, it's been hard for websites to manage, and there's been no adoption. (For example, if you write your own public-key auth mechanism for a website, you need to program all the backup mechanisms in case the user loses their key due to browser failure, needs to recover their account because of a security problem, or whatever. BrowserID outsources that to email providers or secondary authorities.) Check out the detailed protocol explanation: https://wiki.mozilla.org/Labs/Identity/VerifiedEmailProtocol https://wiki.mozilla.org/Labs/Identity/VerifiedEmailProtocol