https://indieauth.com
Of course domains aren't as popular as email addresses, but OpenID used domains… This is like OpenID done right.
Open Letter to Mozilla: Bring Back Persona
131–140 of 243 posts
Re: Open Letter to Mozilla: Bring Back Persona
#132I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…
> And, I didn't even know it was an option until it stopped being an option. Not to take away from your overall point, but you can still very much use persona: https://developer.mozilla.org/en-US/Persona (linked from https://login.persona.org/ )
Cool. I'll give it a shot. There is a Drupal module for it (I run Drupal on my current primary site, for now), though it only has 38 active installs, which is somewhat worrying.
Re: Open Letter to Mozilla: Bring Back Persona
#133The main problem with Persona was not the tech, Persona is great and works well. The problem is that building federated identity services is hard. Persona is not a centralized login system such as "login with Facebook". With Persona, once you decide to login with your email account, first Persona looks for an IdP with your domain/provider, the if not found it goes back to the persona catchall service. For a while gma…
> What killed Persona was not tech but the lack of traction. Developers loved it but failed to use it.
The idea was always that Mozilla would ship native integration in Firefox. There were very very pretty mockups going around and everyone was holding their breath for that to happen.[1] Even announcing they would ship it in the next version would mean 1) it’s stable now and 2) Mozilla is behind it.
My guess is Google (their sponsor at that time) made them drop it because they were preparing to launch G+.
I know it’s a conspiracy theory, but it frankly makes more sense than all those other non-reasons I keep hearing about in this thread.
[1] http://www.extremetech.com/wp-content/uploads/2011/07/firefo...
Re: Open Letter to Mozilla: Bring Back Persona
#134Earlier quoted context omitted.
You can have a password reset feature, but it would be optional. If the person decides not to include their email, they would have to bug a mod who would maybe reinstate them. You could also use SMS or a twitter handle or even snail mail instead of requiring an email address.
You'd rather share your phone number or home address than your email address?
Instead of hiding my identity from the site, maybe I'd rather hide my use of the site from my email provider.
Re: Open Letter to Mozilla: Bring Back Persona
#135I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…
> but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". For me those big fat "sign in with google/facebook" buttons are an annoyance when it takes several clicks to get the old-fashioned account management. Some sites don't even have an option to not use a 3rd-party identity. Not everyone has google/facebook.
And more importantly, signing in with fb is simply handing over our personal details.
I use gmail, I have no problem trading my info for goods and services - I know what they're realistically worth and judge accordingly.
But for Fred's Arbitrary Website? Go fuck yourself Fred, I'll hand over exactly as much information as I like.
Re: Open Letter to Mozilla: Bring Back Persona
#136Earlier quoted context omitted.
Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.
What's the benefit? And, more than this, why do I must provide anyone my mail address? Why do I have to provide it at all? I understand and I'll provide my email address, my JID, my phone number and whatever else I'm willing to provide, if I want someone to contact me. But contact details are technically completely unnecessary to just have an account.
Password reset. Services need to identify you in another way to authenticate you that isn't your password.
If you don't want that, use Mailinator and forget about it. It's insurance against stupid support requests is what it is.
Re: Open Letter to Mozilla: Bring Back Persona
#137Earlier quoted context omitted.
> but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". For me those big fat "sign in with google/facebook" buttons are an annoyance when it takes several clicks to get the old-fashioned account management. Some sites don't even have an option to not use a 3rd-party identity. Not everyone has google/facebook.
And more importantly, signing in with fb is simply handing over our personal details. I use gmail, I have no problem trading my info for goods and services - I know what they're realistically worth and judge accordingly. But for Fred's Arbitrary Website? Go fuck yourself Fred, I'll hand over exactly as much information as I like.
To be fair, Fred's Arbitrary Website probably only captures your email address, if that. OAuth2 permissions and the like.
But I agree, some users would rather cut out the middleman than be chained to the social network du jour.
Re: Open Letter to Mozilla: Bring Back Persona
#138Earlier quoted context omitted.
> I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Why not just 'log in with email address'? The user provides his email address; you send him an email with a URL of the form http://www.invalid/path/to/resource?access_token=aSBkb25lIGF... (where aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw is a cryptographicall…
This is essentially the same thing as having your password emailed to you and is insecure for all the same reasons. Youre putting the responsibility of security on the email provider, which you can't control.
The emailed login link is a short-lived, one-time password and can be associated with a cookie already set on the website's "send me a login email" page.
Re: Open Letter to Mozilla: Bring Back Persona
#139My first experience with Persona was through my mobile phone provider, Ting. They still use Persona: https://ting.com/account/login. I loved it then, and I love it now.
Re: Open Letter to Mozilla: Bring Back Persona
#140I've hit the upvote button, tweeted Stavros that I think this is awesome - but I still want to document my support with a post.
I don't have a FB account and don't use my Google account a lot. I should really delete the latter.
But it would be so much easier with Persona. Yes, a lot of sites won't adopt it, at least at first. But with a well supported alternative that I want to use, I'd have an easier time to say "fuck it" and close the browser window.
Right now I'm trying to go for the next best thing: Different accounts per service (vs braindead "Log in with Silicon Valley Corp").
Alas .. Persona would simplify my password store a LOT. I'd back a campaign. Not sure if I could offer hundreds of dollars, but let me state here that I'd find a way to add 50-80 right away/as an incentive to adopt the project again and I definitely would be able to contribute a recurring amount (a la Patreon etc) for the ongoing development.