Automatically verify email addresses with cryptographic proof rather than manually via OTPs

You should take a look at https://github.com/WICG/email-verification-protocol and https://github.com/w3c-fedid/FedCM ... they also share a lot of the historical lessons learned with Mozilla's BrowserID.

Thanks! I have been learning about FedCM recently, but I need to read more. My understanding is that it requires the relying party to allowlist which IdPs it trusts, is that correct? That always seemed like it would make it gravitate towards social sign-ins, and harder for self-hosted email domains to participate.

I haven't come across the Email Verification Protocol yet, will take a look! At a glance, the flow seems almost identical to BrowserID. I'm curious how the UX looks.

Live tweeting here: https://bsky.app/profile/sgo.to/post/3mge7u5pczk2j

Yeah, websites can choose any other identity provider, and in fact, do.

This sounds super interesting! I'd love to beta test it if you are looking for people to try!

You can find me at:

http://twitter.com/samuelgoto

Sure, I'd love to have your feedback. Let me package this into my first beta and I'll reach out.

Own your own domain? Want to Sign-in to websites with it? Register it with the browser!

Instructions:

https://github.com/w3c-fedid/idp-registration/issues/2#issue...

At this point, wouldn't "email authentication" simply be OpenID?