FedCM

You should take a look at https://github.com/WICG/email-verification-protocol and https://github.com/w3c-fedid/FedCM ... they also share a lot of the historical lessons learned with Mozilla's BrowserID.

I am a little sad the original pretty interesting FedCM work got reduced to this. There was some neat work underway to allow using identity providers without the site even knowing the provider! https://github.com/w3c-fedid/FedCM/issues/677 But after some work the team scoped down, to focusing on email verification. I think that's what lead to this spec? https://groups.google.com/a/chromium.org/g/blink-dev/c/rwu9w...

I don't speak for Mozilla, but I did see a bug in bugzilla which showed the blocking bugs for FedCM. I don't have the link now, but can share it later. That's what I thought of when I stated Firefox has committed to it. But I could be wrong. I do see a Mozilla employee engaging regularly. You can see some of the issues he has filed here: https://github.com/w3c-fedid/FedCM/issues?q=is%3Aissue%20sta...

If it's a new standard, it must have… some kind of cross-industry support right? I ask because it looks like https://github.com/w3c-fedid/FedCM/graphs/contributors is mostly people who work at Google (I gave up once I hit people with ten or fewer commits)…

The Chrome experience is actually part of a new standard, Federated Credential Management (or FedCM for short). The idea is to create a browser mediated login experience that gives the identity provider and web app what they need without being able to correlate requests across the Internet. I am working on an article on this topic. If you are interested in learning more, here's a video from a recent auth focused conference (full disclosure: my company put it on and I emceed): https://m.youtube.com/watch?v=FBAD4x7MWdI They are actively working on the standard and Firefox has committed to it. Edge already supports it. They are looking for identity provider feedback. More here: https://github.com/w3c-fedid/FedCM (we meet weekly on Tuesdays).

It is decentralized. The holder provides the data, which was ultimately provided to them by the government, they're the client. The verifier is the entity that wants to know how old the holder is, the server. The form are eg things like the JSON Web Token (JWT), Digital Credentials, and the Federated Credential Management API (FedCM).[1][2][3][4][5] The software can be anything since they're expected to use open protocols, so yes, web browsers.[6] Per the Commission, "For remote presentation flows, … the Wallet Instance implements the OpenID for Verifiable Presentation protocol OpenID4VP in combination with the W3C Digital Credentials API."[7] [1] https://en.wikipedia.org/wiki/JSON_Web_Token [2] https://github.com/w3c-fedid/digital-credentials [3] https://w3c-fedid.github.io/digital-credentials/ [4] https://github.com/w3c-fedid/FedCM [5]

Logout across multiple systems is pretty complicated. You can do it with browser redirects, at least for now[0], but that relies on every system succeeding. What am I missing? 0: the fedcm work is going to impact redirects. https://github.com/fedidcg/FedCM/blob/main/explainer.md

Some federated identity protocols, including SAML, depend on third party cookies. I've been watching the Federated Identity W3C community group work through some of the issues for a couple of years. You all might be interested in checking out their GH repo: https://github.com/fedidcg/FedCM

Some of us are proactively working on this problem [1]. Not trivial, but I think we are making forward progress to reconcile and mediate login in browser UX. [1] https://github.com/fedidcg/FedCM/blob/main/meetings/2021/Web...

Has support for IndieAuth and/or FedCM (when stable enough) been considered? https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web https://github.com/fedidcg/FedCM