Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

81–90 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#81
post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.

They are not necessarily unique over time. There's no guarantee that jrandom@example.com today is the same person it was a year ago or a year hence. Or in the case of services like mailinator, even unique at all.

Re: Open Letter to Mozilla: Bring Back Persona

#82
Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor many sites. This is all just my own personal opinion.

I was very bullish on Persona early on, but the fact of the matter is, we failed. And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product.

We failed for a thousand reasons. It should've been supported directly within the Firefox chrome ASAP. It had branding different than the site you logged in to and was in a popup[1]. It took the name of another Firefox feature that users already knew about. Because the team was experimenting fast, the code quality of the service was such that outside contribution to it (or even cross-team contribution internally) was hard to impossible. There was no (or very limited) metadata available for things like a shared avatar or display name.

We had enough time to do these things, but we didn't. The team accomplished something really amazing, but it wasn't enough, and most importantly, putting more effort into what already existed was not going to work. This idea that Mozilla can just turn around and throw effort at Persona and make it win now is, IMO, wrong.

Identity needs more experimentation, that much is certain. But harping bringing back Persona in particular is beating a dead horse. We need a successor or a new project.

[1] Not only did this make Persona look incredibly sketchy without a lot of priming users, it had a major privacy issue of leaking your identity provider and relying party to Mozilla via a centralized iframe we host. A mailing list thread among the Persona devs and community failed to find a solution to this.

Re: Open Letter to Mozilla: Bring Back Persona

#83

Earlier quoted context omitted.

Theoretically yes, but it's not as simple as that. Every identity can have more than one email associated with it, and emails can change over time. So "username == email" is fine as long as the concept of a username mutating is fine.

I don't see a problem, it just means you can login with multiple emails then. They're still unique to you. LinkedIn and Facebook and other services already do this. A username/real name can still be used as the "name" if this is an online community or something similar.

> They're still unique to you.

Nope. Most free email providers out there (including gmail) have policies for username expiration, some even quite aggressively (like one month without login). "Me" on one of these services might not be "me" in three months' time, but you-website won't know that and will happily send a password reset link to my old email.

Re: Open Letter to Mozilla: Bring Back Persona

#84
post #82

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor many sites. This is all just my own personal opinion. I was very bullish on Persona early on, but the fact of the matter is, we failed . And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product. We failed for a thousan…

Hey Michael! Aw :( Do you think these problems can be solved with an extension or a different protocol? How close were you to a solution for this?

Re: Open Letter to Mozilla: Bring Back Persona

#85
post #22

Earlier quoted context omitted.

Functionality such as "forgot password"?

Completely optional. Like HN for example.

I thought so too. But then people started forgetting their passwords, so i made email mandatory. People will rarely write down/take note of their password to a website that they "just want to check out".

Re: Open Letter to Mozilla: Bring Back Persona

#86
post #82

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor many sites. This is all just my own personal opinion. I was very bullish on Persona early on, but the fact of the matter is, we failed . And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product. We failed for a thousan…

Hey Michael! Aw :( Do you think these problems can be solved with an extension or a different protocol? How close were you to a solution for this?

The only thing that has a chance of happening is some external party coming up with a different protocol or extending the existing one, and gaining traction as an identity provider. Then, like we did with Pocket and "Save for Later", it's not unreasonable to think that Firefox would accept a system add-on that is compatible with this protocol to ship an in-browser UI.

"gaining traction as an identity provider" being the hard part, of course.

Re: Open Letter to Mozilla: Bring Back Persona

#87
post #55
post #2

For more (and better) counter arguments, start with this thread (which was about one particular comparison with Facebook Connect: possibly click to see the parent for context) and then follow my chain of earlier comments I link at the bottom of that one (which were more general, going into the flawed assumptions in Persona about email). https://news.ycombinator.com/item?id=7243172 (By the way, I am going to try to av…

While I agree that dealing with lost/defunct email addresses and thus accounts can be a challenge there may be other solutions to these (e.g. SMS confirmation, backup pass phrases). In any case it seems we're letting the perfect be the enemy of good with this line of argument. Persona provides significant privacy and perhaps security to alternatives.

The problem at that point becomes you start to implement a service, rather than a protocol. I'm not sure there is necessarily a solution for identity with the way email is currently implemented.

Re: Open Letter to Mozilla: Bring Back Persona

#89

> I don’t know if something like a Kickstarter campaign to raise some money to pay for engineer time would help sway Mozilla at all, but I’m perfectly happy pledging a few hundred dollars and running the campaign, if necessary. I just really want to see Persona succeed. I mentioned this by email, but I'll repeat it here: I believe in the design behind Persona. I believe a well structured, free authentication provider…

I am! Federated authentication would be a beautiful thing. I'll lend my dev/sysadmin experience to a project like this.

Re: Open Letter to Mozilla: Bring Back Persona

#90
post #82

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor many sites. This is all just my own personal opinion. I was very bullish on Persona early on, but the fact of the matter is, we failed . And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product. We failed for a thousan…

I agree with you on most of this. And yes, a "Persona 2.0" should really just take the Persona lessons and learn from them, avoid the mistakes.

That's also why I mentioned in my other reply that I'd be willing to help a project that has a chance to succeed - and that means being lead by someone who has themselves learned all the lessons from Persona. Someone who was on the original dev team.

But this also needs backing from Mozilla, or a corporation like mozilla (there aren't many).

While a lot of devs, including Mozilla devs, agree that Persona needs a successor... there's no sign of any such backing.

Post reply on HN