<html><body bgcolor="#FFFFFF"><div>This is a good article, though I can cone up with a few more concerns. </div><div><br></div><div>"What are the downsides of BrowserID compared to OpenID/OAuth/Facebook? 6 useful questions that need answers. <a href="http://j.mp/rcRC5h">http://j.mp/rcRC5h</a> #browserid"<br>
<br>=nat via iPhone</div><div><br>On 2011/07/17, at 8:44, John Bradley <<a href="mailto:john.bradley@wingaa.com">john.bradley@wingaa.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>I posted this to the specs-ab list earlier today.<div>
<br></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">Links for those that haven't looked yet.</div>
<div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "> </div></div><div><blockquote style="margin-top: 5pt; margin-bottom: 5pt; ">
<div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: 'Courier New'; "><a href="https://browserid.org/" style="color: blue; text-decoration: underline; "><a href="https://browserid.org/">https://browserid.org/</a></a></span></div>
</blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt; "><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-family: 'Courier New'; "><a href="http://arstechnica.com/web/news/2011/07/mozillas-browserid-aims-to-simplify-authentication-on-the-web.ars" style="color: blue; text-decoration: underline; "><a href="http://arstechnica.com/web/news/2011/07/mozillas-browserid-aims-to-simplify-authentication-on-the-web.ars">http://arstechnica.com/web/news/2011/07/mozillas-browserid-aims-to-simplify-authentication-on-the-web.ars</a></a></span></div>
</blockquote><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "> </div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
They are using asymmetrically signed JWT with an introspection endpoint.</div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
</div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">There are limitations on attributes, identifiers and other serious issues with what Mozzila is proposing.</div>
</div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "> </div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
Though it is relatively close to what Nat and I were thinking with asymmetrically signed id_tokens, and a introspection endpoint.</div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
</div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">In some ways our flow would be simpler if the id_tokens were always asymmetrically signed and anyone not supporting that uses the introspection endpoint, as they propose.</div>
</div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "> </div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
If the RP doesn't understand asymmetric signatures it just throws to the introspection endpoint. </div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
The big advantage is for smart clients. They would not need to manage shared secrets to validate tokens.</div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
</div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">For a smart client I suppose that you could let it generate it's own access tokens if those access tokens are JWT and they wrap a JWT containing the client's public key and some scope constraints etc. In principal that could lower the IdP's authorization load. It could also be a way to prevent the IdP from knowing who the RP is in the simple SSO case.</div>
</div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "><br></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
If the browser supports asymmetric keys securely (they are using html5 local storage keyed to a trusted domain) you could have the smart client provide it's public key to the OP and have a assertion without an audience generated and signed. The client would then over-sign with an audience. (some potential size issues with double base46 encoding)</div>
<div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "> </div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">
Just some things to think about.</div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "> </div></div><div>
<div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">John B.</div></div><div><br></div><div><br><div><div>On 2011-07-16, at 9:25 AM, David Recordon wrote:</div>
<br class="Apple-interchange-newline"><blockquote type="cite"><div>Thoughts?<br><br><a href="http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid"><a href="http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid">http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid</a></a><br>
_______________________________________________<br>specs mailing list<br><a href="mailto:specs@lists.openid.net">specs@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs">http://lists.openid.net/mailman/listinfo/openid-specs</a><br>
</div></blockquote></div><br></div></div></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>specs mailing list</span><br><span><a href="mailto:specs@lists.openid.net">specs@lists.openid.net</a></span><br>
<span><a href="http://lists.openid.net/mailman/listinfo/openid-specs">http://lists.openid.net/mailman/listinfo/openid-specs</a></span><br></div></blockquote></body></html>