Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

Post reply on HN
Print view View original

211–220 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#211

Post by Osmose »

wcummings wrote: post #196
Osmose wrote: post #82

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor many sites. This is all just my own personal opinion. I was very bullish on Persona early on, but the fact of the matter is, we failed . And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product. We failed for a thousan…

>it had a major privacy issue of leaking your identity provider and relying party to Mozilla via a centralized iframe we host. A mailing list thread among the Persona devs and community failed to find a solution to this. Can you elaborate on this?

Here's the thread: https://groups.google.com/forum/#!searchin/mozilla.dev.ident...

Basically, Persona by design needs to transmit a keypair and a signed certificate between the identity provider and the relying party. Without in-browser integration, the way this was done was using localStorage on the login.persona.org domain, making Mozilla a trusted third party. This was deemed okay as a temporary measure until in-browser support for BrowserID became commonplace, replacing the trusted third party with the user-agent.

Reading the thread again, my memory was a little off: possible solutions were proposed, but the conversation fell off before consensus could be reached, and no one had the time to drive any attempt to implement the change.

Re: Open Letter to Mozilla: Bring Back Persona

#212

Post by EGreg »

MarkMc wrote: post #208
EGreg wrote: post #155

Earlier quoted context omitted.

How do they prevent Sybil attacks and DOS?

Perhaps by limiting the rate at which password-free accounts can be created. If this limit is exceeded then the system switches back to creating user accounts in the normal way.

And what if they want a lot of users? How do they know which are legitimate?

Re: Open Letter to Mozilla: Bring Back Persona

#213

Post by deno »

IgorPartola wrote: post #173

While I think Persona is way better than password-based auth, I can't help but feel that it's also a sideways step. No, authentication should be provided by the user-agent, not by some third party identity provider (even if you control it by running your own). We have this for ssh: you have your private ssh key and it's up to you to manage having it in the right places (work desktop, laptop, phone, etc.) It's clunky,…

BrowserID works by default with email but it has absolutely to dependency on email. It uses it for namespacing and bootstrapping, but nothing else.

So foo@bar.com may or may not have any MX records, all that is required is that bar.com can provide an assertion that you control foo@bar.com.

The way bar.com determines that is entirely up to bar.com, it can be a password, smart crypto card, local kerberos or Windows auth, 3-way auth involving your cat Rufus, etc...

https://developer.mozilla.org/en-US/Persona/Protocol_Overvie...

Re: Open Letter to Mozilla: Bring Back Persona

#214

Post by deno »

jaybosamiya wrote: post #38

> As security people like to say, “put all your eggs in one basket and stick the basket in Fort Knox” I'm not so sure I want to do that. The point is, even that single Fort Knox can be breached at some point, and if it is, then everything is lost. I agree that nowadays, email is almost unanimously the way to verify a password reset, and hence all your eggs are already in one basket, but shouldn't there be further pro…

It doesn’t have to be an email acc. Persona doesn’t actually have any dependency on email. Addresses that look like email (user@domain.tld) are just used for namespacing. The only requirement is that domain.tld can assert that you control user@domain.tld.

https://developer.mozilla.org/en-US/Persona/Protocol_Overvie...

Re: Open Letter to Mozilla: Bring Back Persona

#215

Post by deno »

21echoes wrote: post #119
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

> And, I didn't even know it was an option until it stopped being an option. Not to take away from your overall point, but you can still very much use persona: https://developer.mozilla.org/en-US/Persona (linked from https://login.persona.org/ )

> Defintely something to note for future UX designs... but Persona, the service hosted by mozilla, is being decommissioned in late 2016.

https://groups.google.com/forum/#!topic/mozilla.dev.identity...

Re: Open Letter to Mozilla: Bring Back Persona

#216

Post by something2324 »

stickfigure wrote: post #142
doctorpangloss wrote: post #74

Earlier quoted context omitted.

Facebook Anonymous Login is definitely a step in the right direction to address those concerns. And yet it's hardly adopted anywhere. I think you're underestimating the importance of Facebook information towards making viable free content. The basic, accurate information you receive from the FB SDK really helps salespeople identify qualified leads for trial-to-paid conversions; the info also can be used to tell you w…

Facebook Anonymous Login is a menace to the open internet. As a website operator, these are no longer your users, they're Facebook's users, and Facebook can take them away from you at any time. As a user, these are no longer your website accounts, they're Facebook's website accounts, and Facebook can take them away from you at any time. Putting Facebook in complete control of identity is not healthy for anyone. At le…

"and Facebook can take them away from you at any time"

Have they actually done that to any website? That would undermine their whole system. They'd do that once and everyone would leave their service. That's like saying "Well Google could publish all your emails! So you definitely shouldn't trust your emails to Google"

Re: Open Letter to Mozilla: Bring Back Persona

#217

Post by lukeh »

I really liked Persona and put a bunch of work into extending it (adding support for things like selective attribute disclosure). One real design limitation was that it didn't support delegation (the original use case for OAuth).

Re: Open Letter to Mozilla: Bring Back Persona

#218

Post by lukeh »

slasaus wrote: post #45
tajen wrote: post #16

- Can Mozilla set up a kickstarter for this project? - Is it technically possible to create a Bash/SSH integration? The Linux world pretty much has SSO now, it would be an awesome argument to have this and Persona extend each other.

The client that wants to login always needs to execute a browser (or at least a render and JavaScript engine). See this (stalled) proposal to make it more compatible with non-browser/simpler agents: https://groups.google.com/d/msg/mozilla.dev.identity/L2ETKkd...

Well, we had Persona working as both as GSS-API mechanism on Unix and a SSP on Windows. You could use it to sign-in to Exchange with Outlook - that was pretty cool. Links here:

* https://hacks.mozilla.org/2013/04/mozilla-persona-for-the-no...

* https://github.com/PADL/libbrowserid

* https://tools.ietf.org/html/draft-howard-gss-browserid-07

Re: Open Letter to Mozilla: Bring Back Persona

#219

Post by grandalf »

SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

I found Persona to have some pretty bad UX. I do not want to have to log in again when I close a browser window.

Re: Open Letter to Mozilla: Bring Back Persona

#220

Post by StavrosK »

fiatjaf wrote: post #199
iheartmemcache wrote: post #145

Earlier quoted context omitted.

From what I read (very very briefly), the spec is similar to what OpenID was, in that anyone who runs a web server can become an authentication provider. Ideally there'd be a distributed-hash-table type web-of-trust so its semi-centralized (i.e. somewhat like PGP or BGP routing tables where you peer with people you trust). Now that 1st party browser certificates are available so you get that Trusty-Green-Lock(tm) on…

So I can have an authentication provider that is not an email provider and people can have accounts in my provider just to use them in Persona logins?

Yes, see https://persowna.net/. Setup is as easy as copying a file to your web server.
Post reply on HN