Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

Post reply on HN
Print view View original

161–170 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#161

Post by wtbob »

debaserab2 wrote: post #127
wtbob wrote: post #115

Earlier quoted context omitted.

> I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Why not just 'log in with email address'? The user provides his email address; you send him an email with a URL of the form http://www.invalid/path/to/resource?access_token=aSBkb25lIGF... (where aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw is a cryptographicall…

This is essentially the same thing as having your password emailed to you and is insecure for all the same reasons. Youre putting the responsibility of security on the email provider, which you can't control.

> This is essentially the same thing as having your password emailed to you and is insecure for all the same reasons.

No, it's essentially the same thing as having a password-reset email sent to one, which is already the case for just about any account anyway.

> You're putting the responsibility of security on the email provider, which you can't control.

Your email provider is already capable of visiting a site, claiming to be you & claiming to have forgotten your password, then intercepting the password-reset email and resetting your password (about the only sites which require more than this are banks).

You can extend any flow which is secure against an evil email provider resetting a password to be equally secure against an evil email provider logging in. Obviously you could add an SMS code, which would then require subverting your mobile provider as well as your email; ditto a landline call.

Re: Open Letter to Mozilla: Bring Back Persona

#162

Post by wtbob »

sz4kerto wrote: post #126
wtbob wrote: post #115

Earlier quoted context omitted.

> I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Why not just 'log in with email address'? The user provides his email address; you send him an email with a URL of the form http://www.invalid/path/to/resource?access_token=aSBkb25lIGF... (where aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw is a cryptographicall…

However, this method can't really be used everywhere -- not all emails are encrypted up to the point where the recipient reads them.

> However, this method can't really be used everywhere — not all emails are encrypted up to the point where the recipient reads them.

Neither are password-reset emails…

This is no more or less secure than sending password-reset emails; any additional security intended to protect in the case of password resets can be applied to login as well (e.g. SMS or landline contact, knowledge of shared secrets of varying security).

Re: Open Letter to Mozilla: Bring Back Persona

#163

Post by programminggeek »

Not sure if anyone realizes this, but Mozilla is not really an open source thing. It's a company that happens to be a nonprofit. It deploys resources and runs itself like a Silicon Valley company.

It's not just a bunch of dudes in their basements writing code. They have like $330 million in annual revenue. They are sitting on like $90 million in cash.

Mozilla isn't about software for its own sake or just for the sake of the web. They are about self preservation and Persona wasn't going to keep them alive, so they killed it.

Mozilla is a company. That is what companies do.

Re: Open Letter to Mozilla: Bring Back Persona

#164

Post by charlieok »

As I understand it, the main point of Persona was improving the situation around authentication and passwords.

Now, I'm seeing indications that Mozilla is working on implementing FIDO U2F support (“Mozilla’s commitment to add FIDO U2F support to the Firefox browser”).

https://www.yubico.com/2015/12/2015-was-a-yubico-rocket-ride...

That seems like a much better approach to improving the situation around authentication and passwords than Persona was.

Re: Open Letter to Mozilla: Bring Back Persona

#165

Post by nly »

nickbauman wrote: post #150
quadrangle wrote: post #93

Earlier quoted context omitted.

The entire point of "Persona" is that it was actually something in the backend called "BrowserID" that was supposed to integrate with the browser instead of running some random JS widget in a page. Well, Mozilla never even finished implementing the first version of that before they declared "no traction"! What nonsense!

Having native code handle something in the browser instead of a thin, easily verifiable javascript widget seems the opposite of a more secure solution.

No, because javascript puts the server in control of the code being run on the client. It renders the whole thing vulnerable to nasty attacks like spoofing and MITM.

Re: Open Letter to Mozilla: Bring Back Persona

#166

Post by interdrift »

Osmose wrote: post #82

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor many sites. This is all just my own personal opinion. I was very bullish on Persona early on, but the fact of the matter is, we failed . And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product. We failed for a thousan…

Many things are wrong in many projects. In my yard , if something breaks I fix it, I don't buy a new yard.

Re: Open Letter to Mozilla: Bring Back Persona

#167

Post by deno »

nickbauman wrote: post #150
quadrangle wrote: post #93

Earlier quoted context omitted.

The entire point of "Persona" is that it was actually something in the backend called "BrowserID" that was supposed to integrate with the browser instead of running some random JS widget in a page. Well, Mozilla never even finished implementing the first version of that before they declared "no traction"! What nonsense!

Having native code handle something in the browser instead of a thin, easily verifiable javascript widget seems the opposite of a more secure solution.

You’re missing the point. Emphasis on “in the browser” not “native.”

http://www.extremetech.com/wp-content/uploads/2011/07/firefo...

Re: Open Letter to Mozilla: Bring Back Persona

#168

Post by buro9 »

KajMagnus wrote: post #148
buro9 wrote: post #36

Anyone who wants to see a demo of it, just sign-in here (top right): https://login.persona.org/ Anyone who wants to see how easy it is to deploy (JS on your page, a button, and callback verifier on your server): https://developer.mozilla.org/en-US/Persona/Quick_Setup Anyone who wants to see it in action: https://www.lfgss.com/ I love everything about Persona except for the fact that Mozilla are no longer supporting a…

I just tested the sign-in demo, on persona.org & lfgss.com. Persona feels like the on shared 1st place best login experience I've seen. Actually marginally better than Gmail, for me, because with Persona, I understood which address I signed in with, at lfgss.com. Gmail, however, doens't let me know which account I sign in with, if I'm logged in with just one of my Gmail account. Then Gmail silently assumes that's the…

It does get better, if you have more than one email address associated to your Persona ( via https://login.persona.org/ ) then during sign-in you are asked which you'd prefer to use. Then it's really clear which is used.

Re: Open Letter to Mozilla: Bring Back Persona

#170

Post by ZenoArrow »

programminggeek wrote: post #163

Not sure if anyone realizes this, but Mozilla is not really an open source thing. It's a company that happens to be a nonprofit. It deploys resources and runs itself like a Silicon Valley company. It's not just a bunch of dudes in their basements writing code. They have like $330 million in annual revenue. They are sitting on like $90 million in cash. Mozilla isn't about software for its own sake or just for the sake…

From what I understand, there are two arms to Mozilla... Mozilla the company (sometimes referred to as MoCo) and the Mozilla Foundation (sometimes referred to as MoFo). Again, from what I understand, MoCo is the not-for-profit company supporting the work of the Mozilla Foundation. The Foundation has an ethical mission to improve and protect the web.

EDIT: Here's a quote from the Mozilla Foundation homepage (https://www.mozilla.org/en-US/foundation/):

"Many of Mozilla’s products are developed by the Mozilla Corporation, a wholly-owned subsidiary of the Mozilla Foundation. The Mozilla Corporation functions as a self-sustaining social enterprise — money earned through its products is reinvested into the organization."

Post reply on HN