mozilla/browserid — Issue #887: auth with primaries
Author: skinny97214
Created: 2012-01-11 23:50:55+00:00
State: open
Labels: meta, needs discussion, needs UX input

Can we rely on the primary enough that we don't need to have a BID password? Please let the answer be yes. :D Explaining what password to use when is a wicked problem.

* Nail down primary security to prevent that as an attack vector.
* Notify when email is added and give user mechanism to disable that account if it's fraudulent.
* If a user is adding another address to their account and already has set up a BID password, do we ever ask them for that one again or do we then auth via primary?
* Is better to send users out to the primary for auth or should we do it in the popup UI?