<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Thanks. <br>
<br>
Have they updated the BrowserID spec? <br>
I and several other people have been pointing out security holes.
<br>
Main one that interests me is how the user is identified. <br>
If I remember correctly, the user keypair gets regenerated from
time to time so the public key cannot be relied on as the user
identifier. In the old days, they were using email address as the
identifier, which is very bad as the identifier can be recycled
(e.g., Yahoo!). I asked them to introduce the never re-assigned
subject identifier, but I do not know if they have adopted it. <br>
<br>
Nat<br>
<br>
(2013/08/30 15:03), Tim Bray wrote:<br>
</div>
<blockquote
cite="mid:CAHBU6is83wgEojoeOoU7hS06K3WRF+wB0C3kRSruiXkKypqyDw@mail.gmail.com"
type="cite">
<meta http-equiv="Context-Type" content="text/html; charset=UTF-8">
<div dir="ltr"><span>One of the more visible competitors for OIDC
is Persona, from Mozilla; I integrated it with my testbed and
wrote up the experience: </span><a moz-do-not-send="true"
href="https://www.tbray.org/ongoing/When/201x/2013/08/28/FC4-Persona"
target="_blank" class="">https://www.tbray.org/ongoing/When/201x/2013/08/28/FC4-Persona</a></div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Nat Sakimura (<a class="moz-txt-link-abbreviated" href="mailto:n-sakimura@nri.co.jp">n-sakimura@nri.co.jp</a>)
Nomura Research Institute, Ltd.
Tel:+81-3-6274-1412 Fax:+81-3-6274-1547
本メールに含まれる情報は機密情報であり、宛先に記載されている方のみに送信することを意図しております。意図された受取人以外の方によるこれらの情報の開示、複製、再配布や転送など一切の利用が禁止されています。誤って本メールを受信された場合は、申し訳ござӓ
6;|
14;せんが、送信者までお知らせいただき、受信されたメールを削除していただきますようお願い致します。
PLEASE READ:
The information contained in this e-mail is confidential and intended for the named recipient(s) only.
If you are not an intended recipient of this e-mail, you are hereby notified that any review, dissemination, distribution or duplication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete your copy from your system.
</pre>
</body>
</html>