qian1000

[Aminda Suomalainen]

如果Launchpad将来支持B，那将很好.qian1000
 是由Mozilla https：/ / browserid替换的qia n1000 .org /。

[Robert Collins (lifeless)]

I'm somewhat inclined to wontfix this at this stage, browserid is problematic from an account management perspective, as it -all- it does is validate that a user has an email address. We depend on a richer system because:
 - folk change email address
 - logins to Launchpad can be used to change the content of Ubuntu, sent to large numbers of users.

[François Marier (fmarier)]

Regarding the first point (folk changing email addresses), the ability to add multiple addresses to your launchpad account already works quite well. Presumably, this hypothetical BrowserID support would allow you to login using any of the email addresses you have confirmed in your Launchpad account.

As far as the second point is concerned, I assume you mean that the password that protects one's LP account needs to be very strong? Of course, the password that actually matters is your email password, because you can always reset your LP password via email.

While the BrowserID password currently is separate from your email password, the goal is for users to authenticate directly with their email provider. For anybody with a GMail, Yahoo or Hotmail address, this will be the case in a few weeks hopefully.

[William Grant (wgrant)]

Bug #210943 is about being a general OpenID consumer. Parts of bug #881019 (particularly comment #15) describe changes needed to allow arbitrary authentication providers, which is most of the work needed for both generic OpenID and BrowserID support. I see no reason not to allow both, although as Robert says it's likely that some organisations will want to restrict the authentication methods that crucial members can use.

François, Ubuntu Single Sign On has two-factor authentication support in testing, and users will soon be able to ask Launchpad to require 2FA for important operations (like changing an email address, OpenPGP key, SSH key, etc), so compromising an email account will no longer be sufficient. So there *are* some security concerns with allowing other providers, but it's nothing insurmountable.

[François Marier (fmarier)]

This 2FA support is very exciting. I especially like the distinction between common and important operations.

I guess that BrowserID and non-Ubuntu OpenID are a bit tricky on that front because in both cases, the identity provider may or may not be using 2FA, but as a consumer, LP can't tell the difference.

[zhonguowuhan.site (zhonguowuhan)]

rtyry