Comments on: Account Manager

By: tequixote

tequixote — Mon, 09 Aug 2010 06:48:24 +0000

I'm impressed, as well as surprised how few people get the point. The idea that a website–say, a new shopping website, CutePinkStuff–could let Firefox know that the user is currently not signed in, that users may be signed in or signed out, and which method of authentication CutePinkStuff requires for sign-in (user/password over SSL perhaps?), thus enabling Firefox to take care of all that by itself such that the user never has to think about it except to permit Firefox to register/sign him in… there is so much potential in a spec like that. I'm pretty fuzzy on implementation details until I read further, but so far, I'm liking the idea. Don't let the "what's the point? isn't this done already?" negativity get you down, keep up the good work!

By: Waleed Eissa

Waleed Eissa — Wed, 19 May 2010 14:25:49 +0000

How is this different from Information Cards? Microsoft already implemented it (CardSpace) in Windows. Are there specific reasons why Mozilla decided to come up with something new instead of implementing information cards? (esp. that I heard it's currently being standardized).

Also, is this going to handle the case when a website needs to send notifications to a user? There are a lot of cases when a website needs to notify the user of an event (for example when a user receives a message from another user) which is why many websites ask for the email address of the user and also ask them to verify it (which is quite annoying to most users). I came across so many websites on the internet that allow users to sign in using an identity provider (like facebook, twitter, google, openid .. etc — esp. using services like RPX and gigya), then ask the user to enter their email address after they sign in with the identity provider, which makes the whole thing useless.

The whole point of all this is to avoid having to register at every website. I mean, if the website won't get the information it requires to provide its service, and the user will be asked to provide additional information, then what's the point in using this feature in the first place?

I have checked the proposed specification draft but I didn't find anything about this (I haven't read the whole specification, so hopefully I didn't miss anything). Are there any plans to support this case in the specification esp. that it's extremely common on a lot of websites?

Thanks,
Wal

By: Frank J.

Frank J. — Sat, 01 May 2010 09:15:54 +0000

Hi,
it would be nice if there could be an option (or another extension)
for the users so they can create login mechanisms for pages that dont
support the account manager.
They could be shared like stylish-scripts or greasemonkey-scripts.
I know a lot of sites that are not going to support the login script
but it would be easy to create a login scipt by myself and share it
with others.
This would be really useful.

By: cesar

cesar — Wed, 28 Apr 2010 21:05:48 +0000

this work only for firefox in windows???… beacause i installed in FF 3.6.3 in ubuntu 9.10 and i dont see the key icon!

By: mozilla_labs

mozilla_labs — Wed, 28 Apr 2010 16:36:08 +0000

With this project, we are proposing a standard scheme for websites to advertise their login/logout and registration mechanisms in a machine-readable way. Any password management system (including 1Password) has to do some work to make it work with each site; we are creating an incentive to make this part of the web infrastructure so that your password management solution can work everywhere.

Our goal is also to create a standard user experience for all ways of "connecting" to a website, to enable the smooth rollout of systems other than password systems. Federated login systems like OpenID, or certificate based systems, could also use the infrastructure we describe.

By: nobby

nobby — Tue, 27 Apr 2010 22:17:32 +0000

What can this thing do what my beloved 1Password can not do at least equally good?

By: Ahriman

Ahriman — Mon, 26 Apr 2010 05:28:48 +0000

I love this extensiones, please continue the development and add to Firefox 4

By: mozilla_labs

mozilla_labs — Thu, 15 Apr 2010 19:14:17 +0000

Hi, Charlie – the one way of using SRP with HTTP is through HTTPS with SRP-TLS, as defined by RFC5054. Our hope is that by simplifying and unifying the user experience of connecting to a site, we can enable the graceful rollout of improved authentication technologies like these.

By: Charlie O'Keefe

Charlie O'Keefe — Thu, 15 Apr 2010 17:18:59 +0000

ps
I'll elaborate on this statement from my post above: "It [kerberos] is more secure than any other password-based HTTP authentication documented in any RFC that I know of."

There is also SRP: http://www.ietf.org/rfc/rfc2945.txt

…but I don't know of any defined way to use SRP with HTTP.

Probably the ideal solution would be some hybrid of SRP and Kerberos that incorporates SRP's strong mutual authentication with Kerberos' system of service tickets, requires no storage of any user-key-equivalents on the server, and cuts the HTTP authentication handshake down to the minimum possible number of steps. One can dream…

By: Charlie O'Keefe

Charlie O'Keefe — Wed, 14 Apr 2010 23:32:27 +0000

I'd love to see a nice friendly (and phishproof) interface like this on top of SPNEGO Kerberos authentication. This is already a widely used HTTP authentication method. It is more secure than any other password-based HTTP authentication documented in any RFC that I know of. The RFC is here: http://www.faqs.org/rfcs/rfc4559.html It is supported in browsers going back to, and including, IE6: http://msdn.microsoft.com/en-us/library/ms995329.... This won't be as easy to implement as what most consumer websites are doing currently, but then again, most of those websites are sending passwords and sensitive session cookies around in the clear (unless they pay for a CA-signed certificate and use SSL encryption). Anyone already using Kerberos, which is free software actively maintained by MIT, would be able to use this method. This includes the huge install base of large organizations using Active Directory (which uses Kerberos under the hood). The Kerberos Consortium has, in fact, already put quite a bit of work into enabling exactly this kind of account manager, and created an API for the express purpose of building one: http://www.kerberos.org/events/Board-12-11-07/4-E... There are a number of worthy authentication protocols that a browser could support in the way you're describing in this article. More than one should be supported. There are good technical reasons for each. For example, the type of authentication factor makes a difference (eg password, "something you know" vs certificate, "something you have"). I urge you to consider kerberos as a protocol worthy of building on for the account manager.