wbamberg/browserid-field-guide — comment on commit 65b7cab3d465d2f8a4761c43f0f98411f25dac4d
File: how_browserid_works.html line 69
By wbamberg:

> You log into an identity provider once in a great while.

Hmm, then I'm confused. My understanding is that you log into an identity provider to get a user certificate: essentially, to get the provider to bind a public key to your email address. The cert has an expiry date: Whenever that certificate expires, you need to get a new one, so you need to log in again.

If someone steals your private key (maybe by attacking the browser, or maybe just by getting access to your browser) then they can impersonate you. One way of dealing with this is by supporting certificate recovation, but browserID doesn't use certificate revocation. Instead, the certs are made short-lived - "some number of hours" according to http://lloyd.io/how-browserid-works#comment-254187808.

But in that case, it seems to me that the user would need to log into their identity provider again in "some number of hours" not once in a great while.

Can you point me at where am I going wrong here?