Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

Post reply on HN
Print view View original

191–200 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#191

Post by tim333 »

odbol wrote: post #174

Persona is a neat idea, but there's a better one: get rid of password logins altogether. I should just be able to enter my email on ANY site, and they'll send me an email with a login button. I click the login button in the email, and am automatically logged into the site for as long as necessary. It's exactly as secure as the "Forgot my password" reset nonsense, but streamlined to be way easier on the user. Then you…

Yeah but if you do that what happens if you want to use the site again the following week? Do you have to do the check your email thing every time which could get annoying or leave them logged in for ever with cookies which could be a security issue. Not saying it's necessarily a bad idea but I wonder how well it would work in practice compared with the normal stuff.

Re: Open Letter to Mozilla: Bring Back Persona

#192

Post by djsumdog »

iheartmemcache wrote: post #145
SwellJoe wrote: post #132

Earlier quoted context omitted.

Cool. I'll give it a shot. There is a Drupal module for it (I run Drupal on my current primary site, for now), though it only has 38 active installs, which is somewhat worrying.

From what I read (very very briefly), the spec is similar to what OpenID was, in that anyone who runs a web server can become an authentication provider. Ideally there'd be a distributed-hash-table type web-of-trust so its semi-centralized (i.e. somewhat like PGP or BGP routing tables where you peer with people you trust). Now that 1st party browser certificates are available so you get that Trusty-Green-Lock(tm) on…

I still run my own open id, but very few people support open id anymore. Slashdot removed support, shirt.woot removed support after the Amazon buyout ... The only thing I use that still supports it is stack overflow.

Re: Open Letter to Mozilla: Bring Back Persona

#193

Post by tim333 »

ygjb wrote: post #35
romaniv wrote: post #17

> Anyone with access to your email account can simply reset any password on any site. The right solution is to make your email account very, very secure. No, the right solution is to stop using email as sole identification for password resets. Yes, there are other solutions you can implement right now without waiting for some big company to save you. The most obvious one it to create a second factor of authentication…

SMS is an awful point of failure to inject into a protocol. It is plain-text, monitored in many countries, and can be unreliable and expensive in emerging markets, and just no. "But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. Really? Can you cite anything here that indicates this is the case? Users treat email access differently, seeing as how it's bound to user identity, usu…

SMS though provides a higher level of security. Some hacker anywhere on the planet could have accessed my email and passwords but they can't get a code sent to my phone unless they are nearby and have got hold of the phone. I'm not sure it being plain text and monitored matters much as all that's bring sent is a random number usually. I'll admit it could cost more and so may not be the thing for sites with lots of free users. If you can't get sms some sites will phone you with a recorded message.

Re: Open Letter to Mozilla: Bring Back Persona

#194

Post by manigandham »

kbenson wrote: post #66
manigandham wrote: post #19

Earlier quoted context omitted.

I don't see a problem, it just means you can login with multiple emails then. They're still unique to you. LinkedIn and Facebook and other services already do this. A username/real name can still be used as the "name" if this is an online community or something similar.

LinkedIn and Facebook can do this because your email is not your username. There likely isn't really a username in those systems, just a user id. Almost all systems have a user id, but the distinction here is slightly different. Instead of a user record which has an id, username and possibly full name, Facebook likely has a user record with an id, a (display) username, and then there is a separate set of auth records…

Yea maybe I should've been more specific but I was just talking about the user's perspective: usernames aren't necessary for most sites and just means one more thing they have to create and remember.

Re: implementation - I don't see the big distinction. These are all just related properties of a master user id number. Those properties can be anything and any of them (in any combination) can be used to login.

Re: Open Letter to Mozilla: Bring Back Persona

#195

Post by manigandham »

quadrangle wrote: post #96
Osmose wrote: post #82

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor many sites. This is all just my own personal opinion. I was very bullish on Persona early on, but the fact of the matter is, we failed . And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product. We failed for a thousan…

Well, yeah, but Persona/BrowserID didn't fail, YOU (Mozilla) failed. BrowerID was the right concept, and it was insanely stupid to create a different frontend branding, to not build the browser integration, to not explain anything well, and then to describe the project as a failure when it hadn't even been implemented at all on your side.

> Well, yeah, but Persona/BrowserID didn't fail, YOU (Mozilla) failed.

Did you read the post? This is exactly what the OP said:

> I was very bullish on Persona early on, but the fact of the matter is, we failed.

Re: Open Letter to Mozilla: Bring Back Persona

#196

Post by wcummings »

Osmose wrote: post #82

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor many sites. This is all just my own personal opinion. I was very bullish on Persona early on, but the fact of the matter is, we failed . And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product. We failed for a thousan…

>it had a major privacy issue of leaking your identity provider and relying party to Mozilla via a centralized iframe we host. A mailing list thread among the Persona devs and community failed to find a solution to this.

Can you elaborate on this?

Re: Open Letter to Mozilla: Bring Back Persona

#197

Post by IgorPartola »

mgbmtl wrote: post #177
IgorPartola wrote: post #173

While I think Persona is way better than password-based auth, I can't help but feel that it's also a sideways step. No, authentication should be provided by the user-agent, not by some third party identity provider (even if you control it by running your own). We have this for ssh: you have your private ssh key and it's up to you to manage having it in the right places (work desktop, laptop, phone, etc.) It's clunky,…

To some extent, this is similar to SSL/TLS certificates that can be used to authenticate the user (not just the server). If I recall correctly, http://startssl.com/ does that. It's not a very intuitive mode of authentication, but if the UI was improved, and combined with a sync service (& encrypted with a passphrase), I guess it could be usable? (also, presumably it requires the site to use https, but that's also muc…

Yeah, basically this. I have used it before and client side TLS certs are anything but intuitive. They are also not widely supported.

Re: Open Letter to Mozilla: Bring Back Persona

#198

Post by fuck_google »

dorfsmay wrote: post #109
nalck wrote: post #42

Earlier quoted context omitted.

While I too would love to see continued development of Persona and Thunderbird by Mozilla, it's important to remember that as open-source projects they're still freely available. I still use both, and see no reason to stop. Development can continue without Mozilla.

Project rot is a thing. This is one thing Mozilla has been good at, keep projects alive and create network effect (well known name backup). Another Thunderbird user...

Yes. Google has demonstrated how trust can be lost quickly by killing or abandoning popular projects. It is the path to the dark side. Hopefully Mozilla can resist taking that path.

Re: Open Letter to Mozilla: Bring Back Persona

#199

Post by fiatjaf »

iheartmemcache wrote: post #145
SwellJoe wrote: post #132

Earlier quoted context omitted.

Cool. I'll give it a shot. There is a Drupal module for it (I run Drupal on my current primary site, for now), though it only has 38 active installs, which is somewhat worrying.

From what I read (very very briefly), the spec is similar to what OpenID was, in that anyone who runs a web server can become an authentication provider. Ideally there'd be a distributed-hash-table type web-of-trust so its semi-centralized (i.e. somewhat like PGP or BGP routing tables where you peer with people you trust). Now that 1st party browser certificates are available so you get that Trusty-Green-Lock(tm) on…

So I can have an authentication provider that is not an email provider and people can have accounts in my provider just to use them in Persona logins?

Re: Open Letter to Mozilla: Bring Back Persona

#200

Post by cwyers »

sp332 wrote: post #134
sghodas wrote: post #69

Earlier quoted context omitted.

You'd rather share your phone number or home address than your email address?

Instead of hiding my identity from the site, maybe I'd rather hide my use of the site from my email provider.

They have access to every e-mail you send and receive, if you don't trust your e-mail provider to that extent you should probably change them.
Post reply on HN