Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

Post reply on HN
Print view View original

71–80 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#71

Post by icebraining »

_pmf_ wrote: post #9

Is there a short introduction as to how Persona deviates from the original decentralized OAuth approach? I'm a bit unclear why what didn't work for decentralized OAuth should work for Persona.

What was the decentralized OAuth approach? Are you referring to OpenID?

If so, the difference is that Persona works with whatever email address/account the user already owns, just like plain email/password authentication; they don't have to figure out that they need to create an account in some "identity provider", which then gives them an URL to copy-paste into the site.

Re: Open Letter to Mozilla: Bring Back Persona

#72

Post by drdaeman »

manigandham wrote: post #10
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.

What's the benefit? And, more than this, why do I must provide anyone my mail address? Why do I have to provide it at all?

I understand and I'll provide my email address, my JID, my phone number and whatever else I'm willing to provide, if I want someone to contact me. But contact details are technically completely unnecessary to just have an account.

Re: Open Letter to Mozilla: Bring Back Persona

#73

Post by wpietri »

SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Having used Persona on my last project, I'd agree.

The article brushes aside the "no traction" bit and says, basically, "the idea was awesome". But that's why we test ideas and measure them by results like traction: not all great ideas turn into great products.

Persona as deployed was an appealing idea that did not provide a great user experience (or really, a great developer experience). To fill the gap, you need to A) deliver lots of value, or B) target an audience that has some special motivation (e.g., idealism) to use the product. Persona did not do A, and general-audience users definitionally lack B. A site's developers might have that motivation, which is why some people tried Persona out. But if the users don't share the motivation, then to them it's just a low-grade experience.

If Mozilla wants to go after the identity market again, they need to do something different. The obvious thing to do would be to leverage their browser market share and make something lower friction than existing systems, rather than Persona's higher friction. But since this is an obvious idea and there are plenty of smart people at Mozilla, I presume there's some good reason they didn't do that in the first place.

Re: Open Letter to Mozilla: Bring Back Persona

#74

Post by doctorpangloss »

SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Facebook Anonymous Login is definitely a step in the right direction to address those concerns. And yet it's hardly adopted anywhere.

I think you're underestimating the importance of Facebook information towards making viable free content. The basic, accurate information you receive from the FB SDK really helps salespeople identify qualified leads for trial-to-paid conversions; the info also can be used to tell you what other websites people visit or software they use. This really helps make sales and improve your software in a way that seems generally net positive for consumers and producers.

Re: Open Letter to Mozilla: Bring Back Persona

#75

Post by wpietri »

hexis wrote: post #70

I haven't looked into Persona since they shut it down, but is it a protocol or a service? If it was actively developed again, would one be able to use Persona without integrating with any Mozilla service at all or would there always be a Mozilla layer involved?

It is a service. Plus some code to make service integration into your website easy. Sadly, my experience was that it was not very reliable.

Re: Open Letter to Mozilla: Bring Back Persona

#76

Post by Twisell »

If someone at Apple is reading this... please fork it (or built up from scratch) a solid open source SSO system and become an official (but optional) identity provider for your millions customers.

This would be a win-win as this could help AppleID and TouchID becoming even more central for your users while demonstrating at the same time that you care about privacy and are willing to develop an open standard to support strong and distributed identity management system as an alternative to Google and Facebook centralized and privacy unfriendly solution.

Re: Open Letter to Mozilla: Bring Back Persona

#77

Post by icebraining »

romaniv wrote: post #17

> Anyone with access to your email account can simply reset any password on any site. The right solution is to make your email account very, very secure. No, the right solution is to stop using email as sole identification for password resets. Yes, there are other solutions you can implement right now without waiting for some big company to save you. The most obvious one it to create a second factor of authentication…

"But SMS costs money!" No, for most providers you can send an email to a special address reserved for the phone number. It will get translated to SMS automatically.

That's mostly an US-only solution. In most countries, there's no free email2sms gateway, since our incoming SMSs are free.

Also, I don't want to share my phone number with you, random Internet site owner. Email spam is worse enough as it is.

"But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. You don't expect them to loose access to their email, but that happens all the time.

They won't lose or forget it; they just won't save it in the first place, except maybe for a couple of very important sites. If people don't use password managers, what makes you think they'll manage some database (physical or not) of reset codes for each site they register for?

Re: Open Letter to Mozilla: Bring Back Persona

#78

Post by danneu »

sp332 wrote: post #64
CM30 wrote: post #56

Earlier quoted context omitted.

So if someone forgets their login details, they're basically screwed? Because I've used some sites like that, and they're a royal pain whenever something goes wrong. For example, TV Tropes didn't used to have a password reset, so every time something went wrong, you'd pretty much have to either register a new account or bug someone on the forums about it. Same with another site I was on, except the usual solution was…

You can have a password reset feature, but it would be optional. If the person decides not to include their email, they would have to bug a mod who would maybe reinstate them. You could also use SMS or a twitter handle or even snail mail instead of requiring an email address.

It's not that obvious how to delegate out a task that involves giving someone full access to an account when they ask for it.

With an on-site "Contact Support" form, you can at least compare their IP address with historical login addresses. But that comes with its own weird problems like, for example, a sibling claiming their brother's account from the same household to read their juicy PMs or steal their credits or whatever. Or giving moderators access to more sensitive information and power than necessary.

Password reset being "optional" just means that people are going to use your support system for it when they eventually forget their password or the initial registration session expires. Reddit and HN have optional email while your new website's only user just forgot their password without an email address on file. What are you going to do when they ask for help off site?

And by the time you're fielding SMS and Twitter handle password resets, you may wonder why you didn't just put more emphasis on the email address input field. Now you're polishing your SMS or Twitter handle reset system that has far more narrow appeal/usage than an email system.

Of course, at the end of the day, it depends on the type of service you're operating. But "make email optional" is a trade-off, not universally good advice. Spend too much time in the HN echo chamber and you'll just do things that work against your users.

People can opt out via http://10minutemail.com/.

Re: Open Letter to Mozilla: Bring Back Persona

#79

Post by wpietri »

NelsonMinar wrote: post #60

We've had 10+ years now of failures to build a proper federated authentication system (RIP OpenID). The problem isn't technical, and it's only a little bit product design. The problem is political. The big companies with the influence to support a system like Persona don't want it. Facebook, Google, etc believe they can own identity on the Internet themselves, so they won't support a neutral identity provider. Which…

I totally agree with the first paragraph, but I'm not convinced on the second.

Mozilla is right in the sense that they're independent and a not-for-profit. But they're also small relative to the other players, with more limited resources. They also just don't seem to be very good at politics and/or building business partnerships.

In particular here they seemed to solve it as mainly a technical problem. They apparently launched it with the assumption that its existence alone was sufficient to generate uptake, which even at the time seemed naive to me. And then after a while they shrugged, said, "looks like it doesn't work" and closed it down. That doesn't seem like the right organization to me.

Re: Open Letter to Mozilla: Bring Back Persona

#80

Post by drdaeman »

sundarurfriend wrote: post #68
drdaeman wrote: post #61

Please, don't. Persona is an inherently bad protocol that continues the unnerving trend to shift the concept of identities from something that's owned to something that's merely leased and temporarily granted. It's better than "Login with $Provider" in a sense that $Provider doesn't get the data, but it's equally worse in a sense that $Provider still owns your identity. I wrote about it here: https://news.ycombinator…

Could you suggest a usable, practical alternative then? It seems from the other thread that you believe WebID to be a better alternative to Persona/BrowserID. How practical and usable is it right now, and what key advantages does it offer in your opinion?

Sadly, no alternative currently exists. Well, none I know of.

There were some attempts like WebID and gpgAuth, but none is usable at the moment. They have to be dug out of dirt of oblivion, carefully analyzed and improved with important features they're missing to be usable for ordinary people (at least key escrow and sync - both completely optional, of course).

What I want from authentication system, is complete independence and full and ultimate control and ownership of my own identity. I don't want to trust, depend or even need any third party just to have account with someone. Not even if this third party is a domain name registrar, not even if I have a legal agreement with them.

When we had just usernames and passwords - it was exactly like that, except for mandatory emails thingy (but that's another story). I met someone, we introduce yourselves, negotiate a shared secret - and we're now acquaintances. With OpenID/OAuth/SAML/JWT/Persona this is no more the case - we have to call a notary and the notary will tell us who I am. And I really don't like this and want to see this fixed.

I want to revoke any possibility of any third party to revoke or otherwise deny my identity. They may assert my identity (say they know me and I'm a good lad) and revoke their assertion about my identity (i.e. say they don't trust me anymore), but not the fact who I am.

Post reply on HN