5 ms·
I'm interested to know how Persona works server-side? AFAIK, it's entirely done in JavaScript. I can't imagine sending the browser ID over Ajax to make a sessio
by ancarda 14y ago
I'm interested to know how Persona works server-side? AFAIK, it's entirely done in JavaScript. I can't imagine sending the browser ID over Ajax to make a session, it seems far too easy to exploit.
Perhaps I'm missing something.
- callahad 14y agoCheck out around 16:00 to 20:30 in my talk: http://pyvideo.org/video/1764 http://pyvideo.org/video/1764 In short: it's bog standard public key cryptography. My browser has a keypair and my email provider has a keypair. My public key and email address are bound together and signed by my email provider's private key. When I want to log into a site, I pass along that certificate. I also pass along a document containing where I want to log in and and the current time, signed by my browser's private key. The latter document ties a given login request to a specific keypair. The former document ties a given keypair to an email address. Together, they identify me and prove that the person logging in really is the same person that was authenticated by the email provider.