Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

Post reply on HN
Print view View original

41–50 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#41

Post by StavrosK »

jaybosamiya wrote: post #38

> As security people like to say, “put all your eggs in one basket and stick the basket in Fort Knox” I'm not so sure I want to do that. The point is, even that single Fort Knox can be breached at some point, and if it is, then everything is lost. I agree that nowadays, email is almost unanimously the way to verify a password reset, and hence all your eggs are already in one basket, but shouldn't there be further pro…

Like you say, email is already the basket, so there are only advantages in migrating (such as not leaving your passwords all around the web).

Re: Open Letter to Mozilla: Bring Back Persona

#42

Post by nalck »

SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

While I too would love to see continued development of Persona and Thunderbird by Mozilla, it's important to remember that as open-source projects they're still freely available. I still use both, and see no reason to stop. Development can continue without Mozilla.

Re: Open Letter to Mozilla: Bring Back Persona

#43

Post by amsb »

manigandham wrote: post #10
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.

It depends on the security needs of the service. Email addresses are discoverable making it easier for an attacker to target a particular account while usernames give the user the opportunity to further insulate themselves from being discovered on a service and potentially brute-forced or cross-ite attacked. Perhaps less important for a social sharing service and more important for a financial service, but it depends on the user.

Re: Open Letter to Mozilla: Bring Back Persona

#44

Post by StavrosK »

prodmerc wrote: post #7

I find Keepass and/or Lastpass are better solutions - you can have different logins for different sites, generate truly strong random passwords and login with two clicks in any modern browser. I don't want Google (or God forbid, Facebook) knowing what sites I login to and part of my credentials, and I don't want websites to know my email address. I know you say they don't have this information, but it's not hard to g…

> I know you say they don't have this information, but it's not hard to get access to it if they feel they want to.

The protocol makes it impossible for the identity provider to know where you're logging in, so they can't even if they wanted to, really.

Re: Open Letter to Mozilla: Bring Back Persona

#45

Post by slasaus »

tajen wrote: post #16

- Can Mozilla set up a kickstarter for this project? - Is it technically possible to create a Bash/SSH integration? The Linux world pretty much has SSO now, it would be an awesome argument to have this and Persona extend each other.

The client that wants to login always needs to execute a browser (or at least a render and JavaScript engine). See this (stalled) proposal to make it more compatible with non-browser/simpler agents: https://groups.google.com/d/msg/mozilla.dev.identity/L2ETKkd...

Re: Open Letter to Mozilla: Bring Back Persona

#46

Post by StavrosK »

tajen wrote: post #16

- Can Mozilla set up a kickstarter for this project? - Is it technically possible to create a Bash/SSH integration? The Linux world pretty much has SSO now, it would be an awesome argument to have this and Persona extend each other.

To your second question, yes, it is. Your identity provider can do whatever you want, so as long as you can make a website that shows you a "connect with your SSH now" prompt and have that turn green when you connect, then Persona can go on top of that.

Persona is just a way for your email domain to say "yes I know this person". The way the site does that doesn't matter to Persona, and there was a service similar to mailinator that just let you log in with a disposable email address everywhere, with no other authentication.

Re: Open Letter to Mozilla: Bring Back Persona

#47

Post by StavrosK »

nalck wrote: post #42
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

While I too would love to see continued development of Persona and Thunderbird by Mozilla, it's important to remember that as open-source projects they're still freely available. I still use both, and see no reason to stop. Development can continue without Mozilla.

I used it two weeks ago for a weekend project (shameless plug: https://www.pastery.net/, a beautiful pastebin), and it's just not the same. Feature requests go into the void, although the team at Mozilla was kind enough to answer even though it's not their job any more, but you can't really use it for a "serious" site while it's very unsupported.

Re: Open Letter to Mozilla: Bring Back Persona

#48

Post by um_ya »

Don't know why persona never caught on, it was probably the best developer/user logon experience I've ever used. When I created my last site, I was very excited about persona, until I realized nobody was developing it anymore, which made me decide against using it. I wish Mozilla would have completed persona before abandoning it.

Re: Open Letter to Mozilla: Bring Back Persona

#49

Post by zanny »

tajen wrote: post #16

- Can Mozilla set up a kickstarter for this project? - Is it technically possible to create a Bash/SSH integration? The Linux world pretty much has SSO now, it would be an awesome argument to have this and Persona extend each other.

Man, Linux desktops would have a huge gain to usability if we could get a distributed accounts framework in place for all the distros so if you signin using online credentials through Persona on one desktop all your config files and preferences are carried over. Its annoying to have to manually sync my laptop and desktops config files.

Re: Open Letter to Mozilla: Bring Back Persona

#50

Post by scrollaway »

StavrosK wrote: post #39
scrollaway wrote: post #6

> I don’t know if something like a Kickstarter campaign to raise some money to pay for engineer time would help sway Mozilla at all, but I’m perfectly happy pledging a few hundred dollars and running the campaign, if necessary. I just really want to see Persona succeed. I mentioned this by email, but I'll repeat it here: I believe in the design behind Persona. I believe a well structured, free authentication provider…

Did I ever get back to you on that with the update? For people not in the loop: I would also like to pledge my time in developing a Persona or Persona alternative. I'm just a bit apprehensive on such a project's chances if it weren't backed by a big company like Mozilla. Then again, maybe we should just go for it.

You did not :) Have you talked to Dan Callahan yet?
Post reply on HN