Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage is that a future integration into the browsers will reduce the phishing risks. Also, the identity provider will not be notified about the sites someone logs in to, which is good from a privacy point of view.
What are the issues with BrowserID/Persona compared to OpenID/OAuth/Facebook?
I like the idea, but I too have many questions left open. Please do not see this as any form of bashing, because I wrote it trying to apply my authentication experience to this new scheme.
I am concerned about (in no particular order) :
Details below. First a one line summary (in bold italic) and some clarifications.
The private key will be protected by the client, with varying degrees of security.
I am worried that any the private key will be used without my consent. When trying to authenticate, a signing operation will take place. I must be prompted before it is used, or else a rogue script could get my browser to sign a logon ticket and submit it. Rogue script could come from a widget, add or other XSS. Implementation of this mechanism will vary in every browser, and even on different platforms for the same browser, or different versions, etc. With a somewhat inconsistent visual, users are at a greater risk to being lured to approve a logon request.
It was desinged to work with web mail accounts. Enterprise "fat" mail clients are somewhat left behind.
For Browser ID to work, you need a browser that supports it. In the meantime, some browserid.org issued "JavaScript shim that implements the missing functionality using standard HTML5 techniques and cryptographic routines implemented in JavaScript".
Users in a corporate environment who use fat mail client (Outlook, Notes, Thunderbird) will be late adopters, because the protocol will have to be implemented in those clients too. Not to mention that Outlook does not share a keystore with Firefox, or Thunderbird with IE.
It leads to a proliferation of private keys, because the scheme does not to have a central authority.
And there is a mobility problem. I will have to register (generate a private key) for every computer I use. How will I go about deleting my private key in an internet kiosk, or a borrowed computer ? Even with a single computer, how will I revoke a key stored in a stolen computer ? Since for a single user, multiple signature keys are valid (because each of my computers have its own valid private key), from the service provider point of view, any access token signed by a known authority must be valid.
Access to the key must be authenticated, which brings passwords back in the picture.
It can protected by a password (limiting its malicious reuse), but if I ever change my password somewhere, it will not synchronize unless I use some browser/cloud based sync network. Having a password to remember somewhat defeats the purpose of this scheme. Chances are the same password will be used to secure every key, much like the same password is used now to authenticate to multiple websites.
There is a gap between the access request and key generation, wich an attacker could use for phishing.
It is unclear to me how the email provider/certificate authority will handle CSRF issues. How will they know that a request for key generation is legitimate ? Will my spam folder be filled with certificate generation requests ? Or will key issued only with DKIM email servers ? What if the request was intercepted on its SMTP way to the server, could it be modified ?
Using a tag allows browserid.org to break the same origin policy.
And using a script tag to include the browserid.js allows them to bypass the same origin policy. BrowserID.org will (have the power to) know about every logon attempt you make. Or you will have to host the script yourself (assuming it is self contained), and upgrade it if/when security flaws will be identified in it.
Stack exchange also has a detailed comparison of BrowserId and WebID. As argued there BrowserId is very close to WebID (a W3C Incubator Group at the W3C). Here are some points that need to be made in defence of both protocols usually as they are very different from how public key cryptography is usually done.
Private key encryption on the client: All modern computers come with a keychain that stores your passwords and keys, and that are protected with a password.
There is a lot that OS vendors can work on to improve security here. On OSX I get asked for a special password, and I can give different tools access to the keychain more or less easily. Of course the keychain should NEVER give out the private key. Giving out the public key is not a problem at all of course :-)
But of course for desktops one can go even further and use crypto keys as shown in the video Cryptokeys, WebID and Internet Cafes - though it would require browser vendors to improve the UI somewhat. Here you have a hardware token to guarantee that the private key has not been copied. Anyway for BrowserID they would need to integrate this into the keychain, or find a JavaScript way of sending x509 certificates stored in the keychain over the wire.
Oh God! I should create an account here once again to post this comment! No wonder Facebook has destroyed the Blogosphere. There you just need 1 password and you can comment on everything you wish.
I'm submitting a response to the six points in the accepted answer as a new answer ...
In the case of the Javascript BrowserID implementation, the private key is stored in local storage under the login.persona.org domain. So a rogue script would have to be hosted on that domain to have access to it. Scripts hosted elsewhere can only access the key indirectly through a restricted PostMessage-based API.
BrowserID works with any email account or mail client. The Javascript shim is there to support browsers without a native implementation. Nothing needs to be added to mail clients.
An important thing to point out here is that keys are short-lived. If you are on an Internet kiosk, keys are valid for only 1 hour, if you are on your own device, they are valid for 1 day. A new one will generated as needed once it has expired, provided that you are still authenticated with login.persona.org. No need for backups.
If you want to clear your private key, just clear cookies (which also clears local storage -- where the keys are stored).
If your computer is stolen, there is a small window during which an attacker could use the key, but as long as you change your password on login.persona.org, the login.persona.org will be invalidated and the thief won't be able to get a new key.
In order to get a new key signed by your identity provider, you need to be authenticated with it. If that authentication expires, then you'll need to type your password again. This is similar to cookie-based sessions that seem to be the norm on the web.
The private key is not all that valuable because it is short-lived. In that respect, it has more in common with cookies than with X.509 client certificates.
The identity provider knows that a request is legitimate because the user is authenticated with them. The fallback identity provider only signs keys after it has confirmed ownership of the email address (in the standard "send users a link with a random token to click on" manner).
The certificate generation / signing happens between the browser and the identity provider via a Javascript API. It's not based on sending emails, so users will not receive any emails beyond the "please confirm your email address" message that the fallback identity provider sends at account creation time.
Once the API is stable enough, it will be possible for others to host include.js themselves. Right now, we recommend against that.
Another point at which persona.org can see the sites you log into is with the online verification tool at https://verifier.login.persona.org/verify. Once the data format is settled, we will encourage people to verify assertions themselves (e.g. using an Open Source library) and persona.org will not be getting this data anymore.
BrowserID is designed to be a fully decentralized protocol to enable real privacy. However, it also provides centralized fallbacks to work-around the current lack of native support.
One disadvantage of BrowserID in its current form compared to some of the alternatives is that anything beyond the core functionality is difficult: further discovery of information requires other protocols such as WebFinger, whereas e.g. an OpenID URL can provide links. For instance, it is difficult to get a display name or profile picture from BrowserID (although, since BrowserID gives you an email address, you can get the latter from Gravatar).
One more competing protocol to add to the list: WebID : http://webid.info/
For more extensive information on BrowserId/Persona, I eventually found what Daniel contributed to the related Q&A on BrowserId/Persona and WebID. (I tried to convince him to post here, but he suggested I do so.)
Security, Privacy and Usability Requirements for Federated Identity by Michael Hackett and Kirstie Hawkey provides a comparison between WebID and Mozilla Persona, which at the time was still referred to as BrowserID.
The main differences that were noted (in Table 1) are:
I suggest reading the paper for more detail. It is freely available online, no digital library access needed.
