valid-until -> expires?

[Gervase Markham]

Should this page:
https://github.com/mozilla/browserid/wiki/How-to-Use-BrowserID-on-Your-Site
say "expires" rather than "valid-until" in the example return?

Gerv

[Gervase Markham]

Er, and why is the browserid.org server sending responses with "expires"
set to the exact time the response was issued? Due to unavoidable
problems with relativity and the speed of light, I am unable to validate
responses before or immediately as they are issued, and so a direct
comparison between the expiry time and the current time will always fail...

$VAR1 = {
'email' => 'ge...@mozilla.org',
'status' => 'okay',
'audience' => 'bmo-4.0.localhost',
'issuer' => 'browserid.org',
'expires' => '1318932727587'
};

Returned time: 1318932727.587
Current time: 1318932731

Fail!

Gerv

[Lloyd Hilaiel]

Hi Gerv,

Apparently we overestimated the speed of light!

This bug is fixed in development right now: https://github.com/mozilla/browserid/issues/433

A temporary work around is to allow ~2mins difference from issue time and current time if you're verifying assertions, until this fix rolls into production next thursday.

lloyd

> _______________________________________________
> dev-identity mailing list
> dev-id...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-identity

[Brian Smith]

Lloyd Hilaiel wrote:
> A temporary work around is to allow ~2mins difference from issue time
> and current time if you're verifying assertions, until this fix rolls
> into production next thursday.

2 min seems like an extremely tight tolerance. In NSS, we allow ~24 hour clock skew for timestamp checks due to mis-set clocks.

- Brian

[Lloyd Hilaiel]

Assertions are signed using server time, so the unstated assumption is if browserid servers have broken clocks then we're screwed. Also if an RP wishes to locally verifying assertions, it must have a properly set clock. Client machines can be stayin' alive in the 80's for all we care.

At the point that we're doing completely decentralized assertion generation on the client we will have issues, but for now does this seem reasonable?

lloyd