{"id":203,"date":"2011-12-14T14:00:11","date_gmt":"2011-12-14T22:00:11","guid":{"rendered":"http:\/\/blog.mozilla.org\/webappsec\/?p=203"},"modified":"2011-12-14T14:00:11","modified_gmt":"2011-12-14T22:00:11","slug":"securing-browserid","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2011\/12\/14\/securing-browserid\/","title":{"rendered":"Securing BrowserID"},"content":{"rendered":"

One of the important projects that Mozilla has been building\u00a0 in 2011 is BrowserID, a user-centric identity protocol and authentication service.\u00a0 Significant work has gone into building out and testing the infrastructure and protocol to make sure that it is a robust, open, and simple to adopt authentication scheme.\u00a0 If you want to learn more about BrowserID, here is a quick 12 minute video<\/a> that explains what it is, and why we are doing this.<\/p>\n

BrowserID continues to evolve as we build support for it across Mozilla properties and encourage adoption from 3rd parties.\u00a0 To date there almost 1000 different websites that rely on BrowserID, but we still have a long way to go to see large scale adoption!<\/p>\n

Much of the effort we have put into reviewing the protocol and implementation of BrowserID is discussed in a recent presentation, a recording of which can be found below:
\n[Slides: html<\/a> | html(zip) <\/a> | pdf<\/a>]
\n(if the video doesn’t appear, click here<\/a>!)<\/p>\n

In addition to ongoing application and infrastructure security work in the next year, we are aiming for two significant milestones in 2012.\u00a0 First we will engage two third party security reviews of the Browserid.org site, and the cryptography used in BrowserID (including the protocol, the algorithms used, and the libraries we are relying on).\u00a0 Our objective in doing the third party review is to remain as transparent as possible in the development and review of the security aspects of BrowserID.\u00a0 This commitment to transparency includes:<\/p>\n