Identity at Mozilla

Home of the Mozilla Identity team

1. ID provider support now live on BrowserID

   Feb 7, 2012 — by millsd

   Last week we pushed out a BrowserID feature that gets us closer to the decentralized identity system we envision for the Web. But more than that, it enables a truly awesome user experience—registration flows go from 8 screens to one simple sign-in. Seriously! See for yourself:

   
   

   Chicken or egg

   Some context: Building a distributed system is a chicken and egg problem - you have to design a system that can demonstrate the power of your idea and the advantages of a distributed architecture while you bring in participants who will become actual nodes in the system. That’s why, so far, BrowserID has operated with scaffolding that uses the BrowserID service itself to vouch for email addresses.

   With our latest update, however, we’re setting aside some of that scaffolding and allowing a fully decentralized system to emerge: Identity providers can become full-fledged participants in BrowserID and directly vouch for their users’ email addresses.

   What’s changed and what you need to know

   If you’re a website that’s already implemented BrowserID, you don’t have to do a thing: BrowserID is just better for you! Up to this point, Browser ID has been vouching for users’ email addresses on behalf of participating websites. Now email providers can directly vouch for their users, eliminating the need for an email confirmation step or a BrowserID password.

   Note that this change only takes effect when the email provider for a given address implements BrowserID support. Other email addresses continue to work in the same way they do today, with an email confirmation and password from the BrowserID service.

   With ID provider support, users will have a better, faster, smoother registration experience.

   Give it a spin.

   Attention email providers large or small: whether you’re an enterprise, an ISP, a university or institution, you owe it to your users to check out this key new feature of BrowserID. Now it’s easy and incredibly simple for any email provider to become an identity provider for their users.

   Try out our demo ID provider at eyedee.me and your @eyedee.me address on any BrowserID site. Take a look at our code and documentation. Let us know what you think via our mailing list, IRC channel, or via the Twitter hashtag #browserid.

2. BrowserID Represents @NodeSummit

   Jan 23, 2012 — by haviland

   If you’re a regular reader of this blog or a developer working with Browser ID, no doubt you already know that it’s fundamentally a node.js project built on a Node.js platform. Not surprising then that we’ll be at Node Summit, a 2-day event that begins tomorrow at San Francisco’s Mission Bay Conference Center.

   Node.js pioneer Mark Mayo is now a principal engineer in Mozilla’s innovation group, where he works on identity and compute platform projects. Mark will be on a Tuesday afternoon panel called “Large Scale Web,” discussing how Node.js is used by players like Mozilla, Google and Yahoo to keep up with humongous web-scale demand.

   Mozilla CTO and Javascript creator Brendan Eich will be on a Wednesday morning panel called “The Evolution of Javascript,” along with Ryan Dahl, who started the Node.js project, and other industry leaders.

   BrowserID core team engineer Lloyd Hilaiel will be at Node Summit also, along with some other talented Mozilla technologists.

   If you plan to attend, look for us there. If you’d like to learn more about Node.js, it’s not too late to register. If you want to discuss BrowserID implementation or technology, you can always reach us on the dev-identity list or via the #browserid hashtag on Twitter.

3. Open Source Rookie of the Year

   Jan 19, 2012 — by haviland

   Even in the Open Source world, tooting one’s own horn is a reason to blog, right? Along with educating, announcing new features, raising awareness, inviting adoption and participation, and asking for feedback.

   This post is one of those shameless brag moments. We wanted to to quack proudly about the fact that the 4th annual Black Duck Software Rookies of the Year program has recognized BrowserID as one of their 2011 winners. We’re honored by the recognition and thrilled to be included in the company of friends and colleagues from projects like Bootstrap and Cloud Foundry.

   Black Duck Software (@black_duck_sw) is a leading provider of products and services for enterprise scale adoption of open source software (OSS), offering automated management, governance, security and compliance tools for licensing OSS across a range of industries.

   The folks at Black Duck are “dedicated to the effective and informed use of open source software” - and so are we. We’re honored to be recognized by a vendor noted for their rigor and professionalism. And it’s great to feel like a rookie, with the best years of Browser ID development and deployment ahead of us.

   Thank you.

   

   Photo credit: Anas superciliosa rogersi (Pacific Black Duck) by Arthur Chapman

4. BrowserID deployments at Mozilla

   Jan 6, 2012 — by benadida

   Mozillians enjoy their holidays by… deploying awesome code. In the last few weeks, a number of Mozilla properties have deployed BrowserID:

   • Mozilla Apps Developer Preview
   • Firefox Affiliates
   • Mozillians
   • Mozilla Add-On Builder
   • Mozilla Developer Network (MDN)

   We’re deploying BrowserID internally because the best way to ensure that we build it right is if we’re using it in mission-critical environments. The early comments we’re getting from users are very encouraging and helpful: we know we’re on the right track, and we also know how to prioritize issues based on how they’re affecting our users.

   We’re also making sure to be respectful of the inherently global nature of the Mozilla community. Because BrowserID is not localized yet, we’ve chosen to deploy it only on sites that are predominantly English-speaking, or only on the English locales. As we localize, we’ll expand to other locales.

   Enjoy BrowserID on Mozilla web sites and, as always, send us your feedback by joining the mailing list or by tweeting with the #browserid hashtag.

5. BrowserID this week: better, faster, more secure.

   Dec 1, 2011 — by benadida

   Today, we released an important set of new features for BrowserID. These features make BrowserID more useful, faster, and more secure. We look forward to your feedback, as always on the mailing list or on Twitter using the #browserid hashtag.

   Features

   

   BrowserID now lets you stay signed in to web sites of your choosing. This will work only with web sites that want to allow persistent sign-in, and of course it only happens if the user specifically opts in. There are clearly web sites to which users want to always be logged in: we want to make that easy as long as it’s the user’s choice. You can always change your mind and log out.

   

   BrowserID now also lets web sites specify a required email for logging in. This is useful when the web site already knows the user’s email address via other means. For example, if Alice shares a photo with Bob using a BrowserID-enabled photo-sharing site, the web site needs to authenticate Bob against the exact email address Alice used to invite him. With this new feature, Bob doesn’t need to type his email. Even better, Bob isn’t misled into using an email that will lead to an authentication dead-end because it’s not the email Alice used to share the photo with him. (You may be familiar with this unfortunate situation if you use Google Docs extensively but are logged in with the “wrong” email address.)

   If you’d like to add these features to your site, check out Advanced BrowserID Features on our wiki.

   Speed and Security

   We’ve changed the digital signature algorithm used in BrowserID so that signing in is much faster. It’s so much faster, in fact, that we’ve been able to increase our key size to a much more secure level than before while retaining a much faster experience. Even on mobile devices, logging in is now quite fast.

6. another introduction to BrowserID for WebFWD

   Nov 28, 2011 — by benadida

   A few days ago, we chatted with the WebFWD teams about BrowserID. WebFWD is Mozilla’s initiative to fund and support creative teams that build on the Open Web. The WebFWD blog summarizes the chat, and includes the screencast of our presentation:

   Download Video: MP4, WebM, Ogg
   HTML5 Video Player by VideoJS

7. Deploying BrowserID at Mozilla

   Nov 17, 2011 — by benadida

   Over the next few months, we’ll be deploying BrowserID on Mozilla web sites. When we do, we’ll point users to this blog post to explain what BrowserID is and why we think this is good for users. If you still have questions, remember you can easily join our mailing list or just Tweet with the hashtag #browserid.

   What is BrowserID?

   BrowserID is a very easy way to log into web sites by proving you own an email address. BrowserID is designed to be tightly integrated into your web browser for ease-of-use, and it is designed to be privacy-protecting: the only data exchanged is that which is strictly necessary to log in. BrowserID is a product of Mozilla, and we are working to standardize it so that other browser vendors can, if they choose, easily integrate it. In the meantime, Mozilla provides a simple JavaScript mechanism that lets web sites use BrowserID right away, across all modern browsers, on desktop and on mobile.

   How is this good for users?

   BrowserID makes it easier for users to register at new web sites and subsequently log back into those sites, using any email address they choose. Users are free to use different email addresses for different purposes, and the process of signing in becomes easier and safer. Users maintain complete control over their identity, only now they have fewer passwords to remember.

   At Mozilla specifically, it makes even more sense for our users to sign in with BrowserID: rather than have a dozen accounts with different Mozilla web sites, users need only one BrowserID account, which will let them partake in any site they choose at Mozilla. What’s the point of having multiple accounts, each with a different password, yet all with the same organization?

   It’s important to note that this is not automatic single sign-on. Users can log into a new Mozilla web site with only two clicks, but they are logged into only the specific Mozilla web sites where they choose to be logged in. BrowserID makes logging in easy, while maintaining complete user control.

   Some additional details

   BrowserID is new, so you probably still have questions. Here are some additional points we’ve found can be helpful in understanding BrowserID:

   • BrowserID does not share data between sites that use it.

   • Because BrowserID lets users choose any email address to log into a web site, it’s easy for a user to create a single-purpose email address to log into a given web site. BrowserID remembers which email you used on which site, so it helps you pick the same single-purpose email the next time you log in.

   • BrowserID stores your email addresses on Mozilla servers, protected by Mozilla’s infrastructure security team. We do not sell or transmit your information to third parties, and you can completely delete your account with us at any time. You can read our complete (and simple) privacy policy.

8. BrowserID now remembers the email you last used on a site

   Nov 11, 2011 — by benadida

   Every Thursday, we deploy a new version of BrowserID to all users transparently. The user experience continues to improve, browser support is expanding, and new features are added. As of this week, BrowserID remembers the email address you last used on a given web site. If you used your home email address on a shopping site, that address will be selected by default the next time you log into that shopping site. If you choose to use a single-purpose email address at another site, BrowserID will remember it and suggest that same email the next time you log into that web site, and only that web site. As always, you control when and how you log in. We’re just making it easier for you to present the same persona to a given web site over time.

   Because we aim to protect your data, the correspondence of email addresses to web sites remains locally stored within your browser. We don’t synchronize it via the BrowserID servers. If you use BrowserID with multiple computers and browsers, that means BrowserID won’t remember your login preference from one browser to the next. Over time, if we can do it safely, we’ll look into ways of synchronizing these preferences across browsers.

9. Note to Implementers: we changed the Verifier API

   Oct 18, 2011 — by benadida

   We usually leave the coding details of BrowserID to the mailing list. However, we deployed a change last Thursday that unfortunately broke a few sites that use BrowserID, so we want to help fix this issue ASAP.

   First, we’re sorry. We thought the API change was safe given our logs, but we didn’t look carefully enough. We’ll be working on a better process for backwards-incompatible API changes, even if we think the change shouldn’t break sites. We don’t expect this to happen very often, of course.

   So, what’s the issue? Once your web site obtains an assertion of the user’s email address, it calls the verifier to check the assertion. The verifier call, which used to be a GET request, must now be a POST. The reason for this change is simply that the length of our assertions has grown quite a bit, and we need to be sure that we don’t hit limits of HTTP client libraries and proxies. The complete developer instructions have been updated accordingly.

   If you have questions, please join our mailing list.

10. New BrowserID User Experience

    Oct 14, 2011 — by benadida

    Yesterday, in our weekly BrowserID release, we included a brand new design for the BrowserID website and popup dialog. The login flow is streamlined, the colors and overall design are more subtle, and the transitions are clearer. Try it out on myfavoritebeer or OpenPhoto and let us know what you think on the mailing list or by tweeting with #BrowserID. Those sites, like all BrowserID sites, automatically inherited the new user experience, of course.

    

Next » Archive