mozilla/browserid — Issue #794: Provide a way for user to specify email association of BrowserID assertions
Author: jrconlin
Created: 2011-12-22 16:24:45+00:00
State: open

Right now, each assertion contains a single verified email. The general thought was that "bob@example.com" and "bob@example.org" are different users. If a remote service wanted to associate the two, that was an exercise left to the server.

The problem is that there are some services where the user has a vested interest in having a connection and may want to provide multiple email accounts (e.g. a user sets up a personal business at Etsy with a gmail account, then with a second custom account.) In that situation, should one of the accounts be compromised, lost or destroyed, the user would want to be able to continue to conduct business with their Etsy account.

Currently, the only agent that knows there's a clear association between various emails is the user agent, which is generating the assertion for the server. I would like to recommend that the user be able to link emails that can be included in an assertion (specifying the additional as "secondary"). This would allow servers to associate future assertions containing those emails with the user.

I'd also recommend that if an email is not included in that list of secondaries, that the spec strongly recommend disabling access from that email. This would allow users to drop compromised emails easily. If an email is truly lost, the user could then delete that email via whatever server interface the remote site wishes to use.