I find Keepass and/or Lastpass are better solutions - you can have different logins for different sites, generate truly strong random passwords and login with two clicks in any modern browser. I don't want Google (or God forbid, Facebook) knowing what sites I login to and part of my credentials, and I don't want websites to know my email address. I know you say they don't have this information, but it's not hard to g…
Open Letter to Mozilla: Bring Back Persona
31–40 of 243 posts
Re: Open Letter to Mozilla: Bring Back Persona
#32Earlier quoted context omitted.
Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.
That depends on context, of course. As an obvious example, if you're actually selling something, you very much do need to know the real name and possibly real address of the person you are contracting with.
Re: Open Letter to Mozilla: Bring Back Persona
#33Earlier quoted context omitted.
Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.
So what happens when I want to change my email? I lose all my accounts?
Re: Open Letter to Mozilla: Bring Back Persona
#34I find Keepass and/or Lastpass are better solutions - you can have different logins for different sites, generate truly strong random passwords and login with two clicks in any modern browser. I don't want Google (or God forbid, Facebook) knowing what sites I login to and part of my credentials, and I don't want websites to know my email address. I know you say they don't have this information, but it's not hard to g…
> Google Web History already creeps me out :-) You know that you can turn off most of their tracking by doing a privacy checkup? I can't guarantee that they don't know a lot about me and that they're still not tracking me, but I can guarantee you that my Google history is completely blank.
Re: Open Letter to Mozilla: Bring Back Persona
#35> Anyone with access to your email account can simply reset any password on any site. The right solution is to make your email account very, very secure. No, the right solution is to stop using email as sole identification for password resets. Yes, there are other solutions you can implement right now without waiting for some big company to save you. The most obvious one it to create a second factor of authentication…
"But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. Really? Can you cite anything here that indicates this is the case?
Users treat email access differently, seeing as how it's bound to user identity, usually across dozens, if not hundreds of services.
Re: Open Letter to Mozilla: Bring Back Persona
#36Anyone who wants to see how easy it is to deploy (JS on your page, a button, and callback verifier on your server): https://developer.mozilla.org/en-US/Persona/Quick_Setup
Anyone who wants to see it in action: https://www.lfgss.com/
I love everything about Persona except for the fact that Mozilla are no longer supporting a team around it, and it was given to the community in almost an abandon-ware fashion.
The idea that this could have made an impact faster is laughable, choosing an auth provider is such a slow process requiring considerable points of trust to reinforce it... one of the most significant points of trust was Mozilla itself, but it also needed a social reinforcement as more people adopted it. Mozilla didn't give Persona the time it needed.
My criticisms of Persona are nothing to do with the fungible nature of email as identity, which I think is OK enough in principle (it's no less identifying than anything else and changes less frequently than a phone number), but to do with:
1) The way Persona wants to centrally log-out from all sites, when a user's experience is that they can sign-out from one site and remain signed-in on another.
2) The lack of 2FA in the default instance they shipped/supported.
3) Some of the phrasing and language confuses users, especially after changing to Persona. i.e. They were still a user on my site identified by email address, but Persona would declare that they were not recognised... so I'd have to spend time telling the user to ignore that and sign-in anyway.
The core product though, was exactly what the web needed, and exactly what I needed for all of the sites I run.
Re: Open Letter to Mozilla: Bring Back Persona
#37This might be a silly question, but why do we need Mozilla to build this system? Is it a matter of trust in Mozilla and a greater likelihood of adoption if Mozilla is the organization providing this service?
Yes. Mozilla has helped bring a large number of Web-related standards while maintaining consistently high privacy and security requirements.
Note that Persona isn't a one-central-service system, though. You can have a ton of identity providers, assuming they all follow the same standard. You do need one service to get started, however.
Re: Open Letter to Mozilla: Bring Back Persona
#38I'm not so sure I want to do that. The point is, even that single Fort Knox can be breached at some point, and if it is, then everything is lost.
I agree that nowadays, email is almost unanimously the way to verify a password reset, and hence all your eggs are already in one basket, but shouldn't there be further protections?
Re: Open Letter to Mozilla: Bring Back Persona
#39> I don’t know if something like a Kickstarter campaign to raise some money to pay for engineer time would help sway Mozilla at all, but I’m perfectly happy pledging a few hundred dollars and running the campaign, if necessary. I just really want to see Persona succeed. I mentioned this by email, but I'll repeat it here: I believe in the design behind Persona. I believe a well structured, free authentication provider…
For people not in the loop: I would also like to pledge my time in developing a Persona or Persona alternative. I'm just a bit apprehensive on such a project's chances if it weren't backed by a big company like Mozilla. Then again, maybe we should just go for it.
Re: Open Letter to Mozilla: Bring Back Persona
#40Anyone who wants to see a demo of it, just sign-in here (top right): https://login.persona.org/ Anyone who wants to see how easy it is to deploy (JS on your page, a button, and callback verifier on your server): https://developer.mozilla.org/en-US/Persona/Quick_Setup Anyone who wants to see it in action: https://www.lfgss.com/ I love everything about Persona except for the fact that Mozilla are no longer supporting a…
1) That is completely controlled by the site owner. In my sites, for example, I just disabled the Persona JS while the user was logged in, so there was no global log-out possible.
2) I believe the bridge was just a proof of concept, with the intention of email providers supporting Persona directly so all the security could be implemented there. I know you said "default bridge", but my side-project here supports 2FA: https://persowna.net/
3) That is very true, some UX changes were necessary, but imagine if the browser itself could just pop up a window saying "do you want to log in to this site using your email address? Yes/No", done.