Search code examples
encryptionpublic-key-encryptionbrowserid

Where can I find a description of BrowserID local verification

The FAQ recommends I don't do local verification of BrowserID (persona) security assertions, however I've never been good at following instructions.

So... I want to implement local verification anyway. It looks like the only thing the client libraries pass to the server side is a block of encrypted stuff called an "assertion". Presumably it is encrypted or signed using some public key encryption scheme, but I'm having trouble finding any details.

Can anyone explain it, or point me to the details?

Solution

  • The spec is currently not up to date with the latest data format changes, but this Python library has the ability to verify Persona assertions by itself (i.e. not using verifier.login.persona.org):

    http://pypi.python.org/pypi/PyBrowserID