3 ms·
The website grabs a single certificate from the persona server the first time it sees a particular e-mail hosting domain; all this reveals is that someone in th
by azernik 13y ago
The website grabs a single certificate from the persona server the first time it sees a particular e-mail hosting domain; all this reveals is that someone in that domain (no specifics as to who) tried to log in at the beginning of the lifetime of that certificate in the cache. Until the cache expires, an arbitrary number of users can log in to the site without any communication touching the persona server. It doesn't reveal who logged in, when in the cache lifetime they logged in, or even how many people logged in.
- Amadou 13y agoAt most that certificate is good for 24 hurs. The user has to get his assertion signed by the identity provider too, and it is possible to get them pre-signed up to that same 24 hours. So the window of users is narrowed to the list of sites that queried the identity provider and the users who had an assertion signed within those 24 hours. Which is weakly anonymous for high-volume sites and no protection at all for low-volume cases. However, the kicker is the protocol doesn't protect against the identity provider setting the expiration to something like 5 minutes, effectively unmasking the client and the website by requiring them both to talk to identity provider within that 5 minute window.