Identity at Mozilla

Home of the Mozilla Identity team

  1. BrowserID this week: better, faster, more secure.

    Dec 1, 2011 — by benadida

    Today, we released an important set of new features for BrowserID. These features make BrowserID more useful, faster, and more secure. We look forward to your feedback, as always on the mailing list or on Twitter using the #browserid hashtag.

    Features

    BrowserID now lets you stay signed in to web sites of your choosing. This will work only with web sites that want to allow persistent sign-in, and of course it only happens if the user specifically opts in. There are clearly web sites to which users want to always be logged in: we want to make that easy as long as it’s the user’s choice. You can always change your mind and log out.

    BrowserID now also lets web sites specify a required email for logging in. This is useful when the web site already knows the user’s email address via other means. For example, if Alice shares a photo with Bob using a BrowserID-enabled photo-sharing site, the web site needs to authenticate Bob against the exact email address Alice used to invite him. With this new feature, Bob doesn’t need to type his email. Even better, Bob isn’t misled into using an email that will lead to an authentication dead-end because it’s not the email Alice used to share the photo with him. (You may be familiar with this unfortunate situation if you use Google Docs extensively but are logged in with the “wrong” email address.)

    If you’d like to add these features to your site, check out Advanced BrowserID Features on our wiki.

    Speed and Security

    We’ve changed the digital signature algorithm used in BrowserID so that signing in is much faster. It’s so much faster, in fact, that we’ve been able to increase our key size to a much more secure level than before while retaining a much faster experience. Even on mobile devices, logging in is now quite fast.