Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

Post reply on HN
Print view View original

111–120 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#111

Post by NelsonMinar »

wpietri wrote: post #79
NelsonMinar wrote: post #60

We've had 10+ years now of failures to build a proper federated authentication system (RIP OpenID). The problem isn't technical, and it's only a little bit product design. The problem is political. The big companies with the influence to support a system like Persona don't want it. Facebook, Google, etc believe they can own identity on the Internet themselves, so they won't support a neutral identity provider. Which…

I totally agree with the first paragraph, but I'm not convinced on the second. Mozilla is right in the sense that they're independent and a not-for-profit. But they're also small relative to the other players, with more limited resources. They also just don't seem to be very good at politics and/or building business partnerships. In particular here they seemed to solve it as mainly a technical problem. They apparentl…

I agree the Mozilla organization has failed here. I guess I don't know any other neutral organization that could do this. We have precious few user-advocacy organizations out there. It's outside EFF's bailiwick. I don't think Apache is any better at politics than Mozilla.

Re: Open Letter to Mozilla: Bring Back Persona

#112

Post by quanticle »

waspleg wrote: post #110
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Why do you require a sign in/sign up in the first place? My ad blocking is configured to disable all that crap and I don't make accounts unless I really want whatever is behind it (which is exceedingly rare). On the other hand, I'm the only one I know personally who does not have a Facecrook account and when I tell people they're the product they just stare at me with doll eyes. shrug

An account of some sort is the only way for a website to store state about you, most notably for authentication/permissions. Do you have a better way of, for example, identifying whether I should be allowed to see a private Github repository or not?

Re: Open Letter to Mozilla: Bring Back Persona

#113

Post by SwellJoe »

waspleg wrote: post #110
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Why do you require a sign in/sign up in the first place? My ad blocking is configured to disable all that crap and I don't make accounts unless I really want whatever is behind it (which is exceedingly rare). On the other hand, I'm the only one I know personally who does not have a Facecrook account and when I tell people they're the product they just stare at me with doll eyes. shrug

My website has:

- Shopping cart for selling our software and support products.

- Forums for discussing our software. Email notifications are available for users who want to follow threads.

- Ticket tracker for reporting bugs and making support requests about our software. Email notifications are, once again, available for users to follow threads.

- License manager, so that people who have bought our software can get the keys to download the software.

How would you suggest we accomplish those tasks without having a sign-in, at all?

Re: Open Letter to Mozilla: Bring Back Persona

#114

Post by cmurf »

Even though I didn't use Persona, having read this, I think this is a big WTF moment for all of us, not just Mozilla. Now I want this thing I didn't know existed because I have, and have had, a need for exactly this. I use a password manager, but I don't really want to use one. I certainly don't like my parents using them, because in fact I have to use them for them because the UI/UX varies so much among web sites. There is no standard UI for changing passwords or doing account resets. All of that shit could go away with this. Fuck. We need to go retrieve that ship!

Re: Open Letter to Mozilla: Bring Back Persona

#115

Post by wtbob »

SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

> I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password".

Why not just 'log in with email address'? The user provides his email address; you send him an email with a URL of the form http://www.invalid/path/to/resource?access_token=aSBkb25lIGF... (where aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw is a cryptographically-authenticated account identifier). When he follows the URL, you can set a cookie if you want him to be automatically logged in next time he visits your site, or not if you don't.

Extending this to be one-time only (to prevent replay by an email provider) is an exercise for the reader.

Re: Open Letter to Mozilla: Bring Back Persona

#116

Post by SwellJoe »

rsync wrote: post #101
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

"the annoyance that is "Sign up with a username, email address, and password"." I know of an easy way to remove 33% of that ... Email addresses are globally unique, and everyone already knows theirs ... email + password seems like a simple, well accepted and workable solution. Right ?

Our website has forums and an issue tracker. Many users do not want to reveal their email address in those contexts.

For a couple of service-oriented sites I'm working on, which won't have forums or public issue trackers, they only use email address (which is change-able). But, it's just not an option for my primary business website.

Re: Open Letter to Mozilla: Bring Back Persona

#117

Post by ossreality »

Almost every single time it came up on HN it was met with FUD or straight out lies about what it was, how it worked and what it was like compared to other login mechanisms.

I distinctly remember, both during development of Persona, and shortly after the discontinuation of it... people who had this BRILLIANT IDEA! They would send a token to your email /every time you wanted to login/.

They repeatedly were lacking in every way to Persona but somehow managed to capture more of peoples' attention.

Actually, congrats, there are several users doing it right here in this thread.

Re: Open Letter to Mozilla: Bring Back Persona

#118

Post by agentdrtran »

wtbob wrote: post #115
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

> I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Why not just 'log in with email address'? The user provides his email address; you send him an email with a URL of the form http://www.invalid/path/to/resource?access_token=aSBkb25lIGF... (where aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw is a cryptographicall…

Medium does this, but I'm not a fan because it takes longer than just using a username/password generated with LastPass.

Re: Open Letter to Mozilla: Bring Back Persona

#119

Post by 21echoes »

SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

> And, I didn't even know it was an option until it stopped being an option.

Not to take away from your overall point, but you can still very much use persona: https://developer.mozilla.org/en-US/Persona (linked from https://login.persona.org/ )

Re: Open Letter to Mozilla: Bring Back Persona

#120

Post by SwellJoe »

doctorpangloss wrote: post #74
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Facebook Anonymous Login is definitely a step in the right direction to address those concerns. And yet it's hardly adopted anywhere. I think you're underestimating the importance of Facebook information towards making viable free content. The basic, accurate information you receive from the FB SDK really helps salespeople identify qualified leads for trial-to-paid conversions; the info also can be used to tell you w…

"I think you're underestimating the importance of Facebook information towards making viable free content. The basic, accurate information you receive from the FB SDK really helps salespeople identify qualified leads for trial-to-paid conversions; the info also can be used to tell you what other websites people visit or software they use."

I generally consider this kind of information warehousing and sharing unethical. While I understand the business case for it, and I understand that facebook has permission from their users because of the ToS agreement, I don't want to inflict it on my customers (who are often Open Source and Free software nerds who take their security somewhat seriously). I am a facebook user, but I don't like what facebook does to privacy. Google, same story.

So, I view participating in those login systems as low-grade evil, as it contributes to the incredible stockpile of data facebook and Google have about all of us. I don't make a big deal about it, and I use sites that require it, but I don't have to like it. And, if there were a way for me to provide a similarly nice user experience to my customers without invading their privacy in any way, I would do so.

Post reply on HN