3 ms·
Maybe I do not understand the system well enough, but isn't there too much room for fake accounts? The web site implementing BrowserID must trust the browser or
by vlasta2 15y ago
Maybe I do not understand the system well enough, but isn't there too much room for fake accounts? The web site implementing BrowserID must trust the browser or the 3rd party validation service that the user really owns the specified email, right? Wouldn't it be super-easy for a hacker to simply return bogus values from navigator.id.getVerifiedEmail() when that gets implemented in browsers? (more specifically, what is the verification procedure of the "Primary Identity Authorities" and what stops a hacker to create a fake one?)
I am all for simple log-in procedures, but as a web site owner, I want to be really sure, the email at least exists to prevent a bit of spam or low-quality content.
- thristian 15y agoAs I understand it, the authentication token you get back from BrowserID is signed by the entity that verified that the email address is real; at the moment, only browserid.org is signing tokens, but presumably there'll be some scheme where you say "I have a token for foo@example.com, so I'll request the public key of example.com and validate the signature on this token". I guess it's possible for somebody to set up a website that will sign absolutely any token anybody offers them, but (a) as a website operator, you can tell that the token "foo@example.com signed by example.com" is different from "foo@example.com signed by evil.com" and (b) you could always have a blacklist/whitelist of entities you trust to verify BrowserIDs.