openphoto/mobile-android — Issue #15: BrowserID alternative for mobile applications
Author: jmathai
Created: 2011-10-15 06:38:52+00:00
State: open

There are random issues with BrowserID on mobile applications. Below is a proposal to resolve it.

1. Require the user to log into their OpenPhoto account (ideally from a non mobile device).
1. Under their settings page they can generate a 6 character "mobile passphrase" which lasts 15 minutes. After 15 minutes the passphrase is invalidated.
1. From the mobile application the user is redirected to the same oauth page with an additional `mobile=1` parameter.
1. Instead of seeing the "sign in" link the user will be prompted to input their mobile passphrase.
1. Once entered the user will be authenticated and can complete the OAuth flow without invoking BrowserID.

I believe this is secure and resolves the issues we're seeing not only on Android but also on iOS.

CC @patricksan & @pboos for comments.