<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi all.<div class=""><br class=""></div><div class="">This is for Ryan Kelly (or anyone) to check what we’d like to do for payments to see if it’s sane. We started talking about it before but this email adds a few more details.</div><div class=""><br class=""></div><div class="">The goal: provide generic payment processing via Firefox Accounts so that any Mozilla site can sell premium services. The user should only have to log in *once* to purchase the product.</div><div class=""><br class=""></div><div class="">Abstract user flow:</div><div class=""><br class=""></div><div class="">- User decides to purchase 20GB more of Mozilla Backup storage for $9.99 / month (just an example)</div><div class="">- Click the purchase button</div><div class="">- Sign in with Firefox Account</div><div class="">- Enter credit card information</div><div class="">- Enjoy enhanced storage</div><div class=""><br class=""></div><div class="">Implementation proposal:</div><div class=""><br class=""></div><div class="">- On <a href="http://MozillaBackup.com" class="">backup.firefox.com</a> , the click of a purchase button begins an OAuth flow by requesting a code->token with the scope ‘profile payments’</div><div class="">- <a href="http://MozillaBackup.com" class="">backup.firefox.com</a> opens an iframe (or redirect) to <a href="http://payments.mozilla.com" class="">payments.mozilla.com</a> and passes the OAuth token as a GET parameter</div><div class="">- <a href="http://payments.mozilla.com" class="">payments.mozilla.com</a> verifies the token on the server and checks that it has the *payments* scope</div><div class="">- payment processing proceeds…</div><div class=""><br class=""></div><div class="">Does that sound sane? This makes token sharing sound scary: <a href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction#Security_considerations" class="">https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction#Security_considerations</a></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">-Kumar</div></body></html>