Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

31–40 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#31
post #7

I find Keepass and/or Lastpass are better solutions - you can have different logins for different sites, generate truly strong random passwords and login with two clicks in any modern browser. I don't want Google (or God forbid, Facebook) knowing what sites I login to and part of my credentials, and I don't want websites to know my email address. I know you say they don't have this information, but it's not hard to g…

The problem Facebook Connect solves isn't just logging in to multiple accounts but also signing up with them.

Re: Open Letter to Mozilla: Bring Back Persona

#32

Earlier quoted context omitted.

Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.

That depends on context, of course. As an obvious example, if you're actually selling something, you very much do need to know the real name and possibly real address of the person you are contracting with.

Yes, I was only talking about usernames and how they're often unnecessary for most sites, especially the login process.

Re: Open Letter to Mozilla: Bring Back Persona

#33
post #30

Earlier quoted context omitted.

Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.

So what happens when I want to change my email? I lose all my accounts?

You... just update your email. Or add the new one if the service supports multiple.

Re: Open Letter to Mozilla: Bring Back Persona

#34
post #25
post #7

I find Keepass and/or Lastpass are better solutions - you can have different logins for different sites, generate truly strong random passwords and login with two clicks in any modern browser. I don't want Google (or God forbid, Facebook) knowing what sites I login to and part of my credentials, and I don't want websites to know my email address. I know you say they don't have this information, but it's not hard to g…

> Google Web History already creeps me out :-) You know that you can turn off most of their tracking by doing a privacy checkup? I can't guarantee that they don't know a lot about me and that they're still not tracking me, but I can guarantee you that my Google history is completely blank.

I did, though I might need to recheck it, since they used the word "paused" instead of "disabled" :-)

Re: Open Letter to Mozilla: Bring Back Persona

#35
post #17

> Anyone with access to your email account can simply reset any password on any site. The right solution is to make your email account very, very secure. No, the right solution is to stop using email as sole identification for password resets. Yes, there are other solutions you can implement right now without waiting for some big company to save you. The most obvious one it to create a second factor of authentication…

SMS is an awful point of failure to inject into a protocol. It is plain-text, monitored in many countries, and can be unreliable and expensive in emerging markets, and just no.

"But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. Really? Can you cite anything here that indicates this is the case?

Users treat email access differently, seeing as how it's bound to user identity, usually across dozens, if not hundreds of services.

Re: Open Letter to Mozilla: Bring Back Persona

#36
Anyone who wants to see a demo of it, just sign-in here (top right): https://login.persona.org/

Anyone who wants to see how easy it is to deploy (JS on your page, a button, and callback verifier on your server): https://developer.mozilla.org/en-US/Persona/Quick_Setup

Anyone who wants to see it in action: https://www.lfgss.com/

I love everything about Persona except for the fact that Mozilla are no longer supporting a team around it, and it was given to the community in almost an abandon-ware fashion.

The idea that this could have made an impact faster is laughable, choosing an auth provider is such a slow process requiring considerable points of trust to reinforce it... one of the most significant points of trust was Mozilla itself, but it also needed a social reinforcement as more people adopted it. Mozilla didn't give Persona the time it needed.

My criticisms of Persona are nothing to do with the fungible nature of email as identity, which I think is OK enough in principle (it's no less identifying than anything else and changes less frequently than a phone number), but to do with:

1) The way Persona wants to centrally log-out from all sites, when a user's experience is that they can sign-out from one site and remain signed-in on another.

2) The lack of 2FA in the default instance they shipped/supported.

3) Some of the phrasing and language confuses users, especially after changing to Persona. i.e. They were still a user on my site identified by email address, but Persona would declare that they were not recognised... so I'd have to spend time telling the user to ignore that and sign-in anyway.

The core product though, was exactly what the web needed, and exactly what I needed for all of the sites I run.

Re: Open Letter to Mozilla: Bring Back Persona

#37

This might be a silly question, but why do we need Mozilla to build this system? Is it a matter of trust in Mozilla and a greater likelihood of adoption if Mozilla is the organization providing this service?

> Is it a matter of trust in Mozilla

Yes. Mozilla has helped bring a large number of Web-related standards while maintaining consistently high privacy and security requirements.

Note that Persona isn't a one-central-service system, though. You can have a ton of identity providers, assuming they all follow the same standard. You do need one service to get started, however.

Re: Open Letter to Mozilla: Bring Back Persona

#38
> As security people like to say, “put all your eggs in one basket and stick the basket in Fort Knox”

I'm not so sure I want to do that. The point is, even that single Fort Knox can be breached at some point, and if it is, then everything is lost.

I agree that nowadays, email is almost unanimously the way to verify a password reset, and hence all your eggs are already in one basket, but shouldn't there be further protections?

Re: Open Letter to Mozilla: Bring Back Persona

#39

> I don’t know if something like a Kickstarter campaign to raise some money to pay for engineer time would help sway Mozilla at all, but I’m perfectly happy pledging a few hundred dollars and running the campaign, if necessary. I just really want to see Persona succeed. I mentioned this by email, but I'll repeat it here: I believe in the design behind Persona. I believe a well structured, free authentication provider…

Did I ever get back to you on that with the update?

For people not in the loop: I would also like to pledge my time in developing a Persona or Persona alternative. I'm just a bit apprehensive on such a project's chances if it weren't backed by a big company like Mozilla. Then again, maybe we should just go for it.

Re: Open Letter to Mozilla: Bring Back Persona

#40
post #36

Anyone who wants to see a demo of it, just sign-in here (top right): https://login.persona.org/ Anyone who wants to see how easy it is to deploy (JS on your page, a button, and callback verifier on your server): https://developer.mozilla.org/en-US/Persona/Quick_Setup Anyone who wants to see it in action: https://www.lfgss.com/ I love everything about Persona except for the fact that Mozilla are no longer supporting a…

To address some of your points:

1) That is completely controlled by the site owner. In my sites, for example, I just disabled the Persona JS while the user was logged in, so there was no global log-out possible.

2) I believe the bridge was just a proof of concept, with the intention of email providers supporting Persona directly so all the security could be implemented there. I know you said "default bridge", but my side-project here supports 2FA: https://persowna.net/

3) That is very true, some UX changes were necessary, but imagine if the browser itself could just pop up a window saying "do you want to log in to this site using your email address? Yes/No", done.

Post reply on HN