Identity/BrowserID/TransitioningSites: Difference between revisions

Identity/BrowserID/TransitioningSites (view source)

73 bytes removed , 6 December 2011

Confirmed users

920

edits

@@ Line 15: / Line 15: @@
 ==== Safe migration from legacy auth to BrowserID ====
 * Never trust that the email address currently associated with a profile is valid or usable
-** User could have lost control in the time since the user verified it
+** Stale data; user could have lost control in the time since first signed up and verified it
-** Another person could have claimed that email address out from under (unlikely, but possible)
 * Require legacy username / password auth followed by subsequent BrowserID signin
 ** Ensures verified hand-off from legacy auth to BrowserID