Viewing profile — badida

or until we give you a library you can audit and host yourself, which we're working on.

You should tell them you'd like them to :)

Choose your identity providers (and thus email addresses) wisely. They should be filtering spam for you / letting you control things. And they shouldn't be doing it by forcing you …

Oh wait, I misread your point. Yes, the attacker can log into all Persona web sites if they know your Yahoo password. But that's the way the cookie crumbles with federated identity…

No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona. However, if you use t…

Very good points, and we agree. We're going to bridge more Identity Providers. We're working on native implementations (though I suspect that those are less pressing than the other…

To be fair, if you want to understand why something is supposedly secure, you will have to spend some time :) Let's see if I can help. Your identity is tied to your ability to prov…

Let's see if I can help provide some answers here: a) certificates are stored in localStorage for https://login.persona.org . They are very short-lived (hours), so that we don't ha…

The are all good arguments, and again I want to point out that we are considering them. But there is a big security concern with DNS spoofing (and DNSSEC is not quite easy yet.) So…

Every time you create an account at a new site, you're opening up a way to get hacked. Because, like most humans, you probably reuse passwords, or at least have password similariti…

Sorry, that's my bad. It's fixed now if you pull the latest eyedee.me.

I think the criticism that we haven't made a strong enough point of why this makes the Web more secure is legitimate. We haven't made this point as well as I'd like. I'll take that…

Thanks! Another good way to help Mozilla make the Web better for all is to implement Persona on web sites you build. It's easy and respects your users. Here's how you can do it in …

It's worth pointing out that, a couple of years ago, we tried to make OpenID easier through Firefox integration. There was no good way to do it. The OpenID protocol doesn't lend it…

Exactly right: we hate the NASCAR array of buttons that is publisher-centric, rather than user-centric. I wrote about this a few days ago on the Persona blog: http://identity.mozil…

Yes, that is exactly right, and it's also why certs are short-lived (hours). When certs are renewed, the site the user plans on logging into is not revealed to the Identity Provide…

We're discussing the addition of a DNS discovery option. Not clear yet that this is something that can be secured as well as HTTPS discovery (which I don't consider abusive, given …

not yet, but we're working on it: https://github.com/mozilla/browserid/issues/3119

Check the Techcrunch article I cited: http://techcrunch.com/2012/11/30/email-social-signup-rockmel... - major social sites have seen data indicating that 50% of potential users don…

In earlier identity experiments at Mozilla, we tried. It never felt good as a user experience, in large part because OpenID was designed to not include the browser.