61–70 of 243 posts
Persona is an inherently bad protocol that continues the unnerving trend to shift the concept of identities from something that's owned to something that's merely leased and temporarily granted.
It's better than "Login with $Provider" in a sense that $Provider doesn't get the data, but it's equally worse in a sense that $Provider still owns your identity.
I wrote about it here: https://news.ycombinator.com/item?id=10595347
> I don’t know if something like a Kickstarter campaign to raise some money to pay for engineer time would help sway Mozilla at all, but I’m perfectly happy pledging a few hundred dollars and running the campaign, if necessary. I just really want to see Persona succeed. I mentioned this by email, but I'll repeat it here: I believe in the design behind Persona. I believe a well structured, free authentication provider…
Email providers don't have significant incentive to become Identity Providers; Web site owners do not have significant incentive to accept persona at least until many users adopt/request it; Users are mostly unaware of Persona's existence and the argument in favor for many is rather weak as the people who seem to care about privacy seem to be in an exclusive club.
There are a few keys to success that I can think of off the top of my head:
1. Solid awareness campaign to explain benefits to non-HN type users. Would depend on solid benefits of security, convenience/simplicity, and privacy.
2. Fantastic "default" identity provider as most email providers will not, in the short term, become Identity Providers. This has to work without sacrificing UX, security, convenience/simplicity, and privacy.
3. Adoption by at least 1 major email provider (e.g. FastMail).
While I don't bring much in the way of development skills (not my strength at all), I would be very willing to help on the strategy, partnerships / business development, marketing etc. front.
What killed Persona was not tech but the lack of traction. Developers loved it but failed to use it. By providing options such as FB, Google, Twitter and other logins, the user choose the familiar service and never tried Persona. In the end, the lack of traction together with the overall difficulty of building federated identity services killed it.
But what is dead cannot die! Persona still works, I still use it every day in lots of Mozilla properties and if I had to build some service that required logins, I would use it even today. It is in the hand of the community but with some care and more traction this can become cool again.
I will look into the source code and see if I can help somewhere.
Earlier quoted context omitted.
Completely optional. Like HN for example.
So if someone forgets their login details, they're basically screwed? Because I've used some sites like that, and they're a royal pain whenever something goes wrong. For example, TV Tropes didn't used to have a password reset, so every time something went wrong, you'd pretty much have to either register a new account or bug someone on the forums about it. Same with another site I was on, except the usual solution was…
The best way to get Persona adopted would be to have someone significant other than Mozilla to adopt it. If IE, Safari, or Chrome had adopted, it would have had a great chance at success.
I don't see other browser vendors implementing Persona before (if ever) it is an otherwise widely accepted thing.
Earlier quoted context omitted.
Theoretically yes, but it's not as simple as that. Every identity can have more than one email associated with it, and emails can change over time. So "username == email" is fine as long as the concept of a username mutating is fine.
I don't see a problem, it just means you can login with multiple emails then. They're still unique to you. LinkedIn and Facebook and other services already do this. A username/real name can still be used as the "name" if this is an online community or something similar.
It may not sound like a big distinction, but there is a big distinction there. Instead of your username being your email address, they've abstracted the authentication from the core user record such that usernames are not used for authentication, so don't have to mutate if the authentication identifier (email address, phone number) changes, just some auth settings. This is obviously a much more extensible and robust way to deal with authentication over time, but it's also obvious it's much more complex than a simple username/password pair.
Earlier quoted context omitted.
Completely optional. Like HN for example.
So if someone forgets their login details, they're basically screwed? Because I've used some sites like that, and they're a royal pain whenever something goes wrong. For example, TV Tropes didn't used to have a password reset, so every time something went wrong, you'd pretty much have to either register a new account or bug someone on the forums about it. Same with another site I was on, except the usual solution was…
These days I prefer to require an email address. That way, the few users that want to opt-out can insert a bogus one.
Please, don't. Persona is an inherently bad protocol that continues the unnerving trend to shift the concept of identities from something that's owned to something that's merely leased and temporarily granted. It's better than "Login with $Provider" in a sense that $Provider doesn't get the data, but it's equally worse in a sense that $Provider still owns your identity. I wrote about it here: https://news.ycombinator…
It seems from the other thread that you believe WebID to be a better alternative to Persona/BrowserID. How practical and usable is it right now, and what key advantages does it offer in your opinion?
Earlier quoted context omitted.
So if someone forgets their login details, they're basically screwed? Because I've used some sites like that, and they're a royal pain whenever something goes wrong. For example, TV Tropes didn't used to have a password reset, so every time something went wrong, you'd pretty much have to either register a new account or bug someone on the forums about it. Same with another site I was on, except the usual solution was…
You can have a password reset feature, but it would be optional. If the person decides not to include their email, they would have to bug a mod who would maybe reinstate them. You could also use SMS or a twitter handle or even snail mail instead of requiring an email address.