mozilla/browserid — Issue #853: Allow for one-time email assertion
Author: stickfigure
Created: 2012-01-07 01:46:17+00:00
State: open

BrowserID seems an excellent way to assert an email address even outside the context of authentication. For example, even standalone username/password systems need to be able to establish a verified email address. Right now this is almost always done with the standard confirmation email, but BrowserID could replace that process with much better UX. Also, many systems using BrowserID may have multiple login options (Facebook, G+, etc) and it would be convenient to use BrowserID for all change-email-address workflows.

Right now, if a system without BrowserID auth wants to use BrowserID for change-email-address workflow, users will be required to create a password when using the browserid.org secondary auth. This extra password requirement is confusing if the user didn't log in with BrowserID in the first place. It seems like this could be fixed by allowing a "one-time" email assertion; the relying website can save the trusted email address but the user will not necessarily be able to authenticate with it.

More in this thread:

https://groups.google.com/forum/#!topic/mozilla.dev.identity/L-C7WjGkb-Y