I've been following the progress of Mozilla's BrowserID for some time now, and I'm a big fan. Having dove much deeper than most into the quagmire of fragmented authentication I've reached the same conclusion that Mozilla has: ultimately, authentication is a function that should belong to the user agent.
What is BrowserID?
BrowserID is a Single Sign-on service for the web, much like you can implement using OpenID or even Facebook or Twitter. However, BrowserID is fantastic for its simplicity: as an implementation of a simple "verified email" protocol, it is simply a way to be able to obtain the email of a user (and know that it's verified).
But, you ask, why do we want authentication in the browser? Browsers are called User Agents for a reason: they are simply tools that help connect you to the content of the internet that interests you. And a lot of that content right now requires you to manage dozens of different passwords and store sensitive login information with a third party. BrowserID doesn't entirely solve this problem in its nascent web-based form, but once it is integrated into the browser itself BrowserID becomes a single, secure way to access content on the internet.
BrowserID + OmniAuth
I want BrowserID to succeed, and it will only succeed if people start using it. To that end, I've created OmniAuth BrowserID, a simple OmniAuth strategy that works with the BrowserID protocol. You can use it in your application like this:
# in Gemfile gem 'omniauth-browserid' # in application use OmniAuth::Builder do provider :browser_id end
That's it! Now send your users to
BrowserID is an important idea and whether Mozilla's implementation is ultimately the one that gets adopted it's high time we started moving authentication to where it belongs: in the user agent.