711467 - browserid: Support multiple BrowserIDs for the same profile?

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: Sign-in, defect)

Description

[Les Orchard [:lorchard]]

Currently, a profile can have only one verified email address and thus can only be accessed from one BrowserID.

However, it might be nice to support multiple email addresses for a profile. Then, multiple BrowserIDs could be used to sign in. So, if a user ever loses control of one of them (eg. switches jobs, gets hacked), they could have a backup for sign in.

With legacy auth, if the user remembered the account's password, he or she could still log in and change the email address. With BrowserID, it seems like there could be trouble.

Maybe not, though? Does this just push the issue back to the BrowserID service, and remembering the password there still leaves a recovery path?

Comment 1

[Les Orchard [:lorchard]]

I was thinking that this would be a crucial feature. But, I'm starting to think it might end up a confusing power user feature and not any better than just remembering your password to your BrowserID service.

There's also bug 711474 for changing email addresses and switching a profile from one BrowserID to another.

Comment 2

[Les Orchard [:lorchard]]

Sticking in 2.0 for consideration, though this seems puntable

Comment 3

[Luke Crouch [:groovecoder]]

I'm going to punt to backlog unless/until users ask for it. Based on the BrowserID feedback we've gotten, I think bug 715811 (forgot my email address) is the real priority.

Comment 4

[Jannis Leidel [:jezdez]]

This is possible since we switched to allauth.