Privacy/Reviews/BrowserID.org: Difference between revisions

Privacy/Reviews/BrowserID.org (view source)

Revision as of 22:23, 10 October 2011

435 bytes removed , 10 October 2011

→‎BrowserID User-Agent Window

BenAdida

668

edits

@@ Line 180: / Line 180: @@
 === BrowserID User-Agent Window  ===
-This component is a browser window that contains content in the origin
+This component is a browser window that contains content in the origin "https://browserid.org".  This is a combination of code served from the Implementation Server component and the browser's local storage data for this domain. It communicates with the BrowserID Implementation Server, which is its expected backend server, and with the RP User-Agent Window, using a postMessage channel.
-"https://browserid.org".  This is a combination of code served from the
-Implementation Server component and the browser's local storage data for this
-domain.
 '''Stored Data:'''
@@ Line 192: / Line 189: @@
 ! Where
 |-
-| attestation certificates
+| email ownership certificates
-| localStorage for browserid.org
+| localStorage for https://browserid.org
 |}
 '''Communication with Implementation Server'''
-{| class="wikitable"
-|-
-! Direction
-! Message
-! Data
-! Notes
-|-
-| ''In:''
-| return from register()
-| static content.
-| ("you'll get an email, please click the link")
-|-
-| ''In:''
-| return from sign_in()
-| list of email addresses, certificates
-|-
-| ''Out:''
-| register()
-| user's email and a password
-| Password is for browserid.org, not the email
-|-
-| ''Out:''
-| sign_in()
-| user's email and a password
-| Password is for browserid.org, not the email
-|}
-(In this case, the outbound messages are HTTP requests and the message is the
+See the Implementation Server section.
-endpoint.  The inbound messages are HTTP responses and any payload is listed.)
 '''Communication with RP User-Agent Window'''
@@ Line 236: / Line 206: @@
 ! Notes
 |-
-| ''Out:''
+| ''In:''
-| register()
+| getVerifiedEmail()
-| email address, certificate, assertion, session cookie
+| RP hostname
-| via postMessage to other browser window.
+| inherently via postMessage
 |-
 | ''Out:''
-| authenticate()
+| getVerifiedEmail()
-| email address, certificate, assertion, session cookie
+| certificate and signed assertion of email, time, and RP hostname
-| via postMessage to other browser window.
+| via postMessage, to other browser window.
 |}