Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Mozilla: Bring Back Persona

stavros.io

Post reply on HN
Print view View original

231–240 of 243 posts

Re: Open Letter to Mozilla: Bring Back Persona

#231

Post by Flimm »

odbol wrote: post #174

Persona is a neat idea, but there's a better one: get rid of password logins altogether. I should just be able to enter my email on ANY site, and they'll send me an email with a login button. I click the login button in the email, and am automatically logged into the site for as long as necessary. It's exactly as secure as the "Forgot my password" reset nonsense, but streamlined to be way easier on the user. Then you…

If you have an identity server, a website and a browser that all support Persona, (and you've already been through the process once), Persona would work much better than that. You don't have to memorise a new password and you don't have to click on a verification email. You just land on a new site, click log in with Persona, choose your email address, and TADA! you're in. And the beauty of it is that your email provider doesn't even know which sites you're logging in to.

Re: Open Letter to Mozilla: Bring Back Persona

#232

Post by Flimm »

sgarrity wrote: post #54

The best way to get Persona adopted would be to have someone significant other than Mozilla to adopt it. If IE, Safari, or Chrome had adopted, it would have had a great chance at success.

But even Firefox didn't adopt it! Why expect other browsers to support what desktop Firefox never supported even for a day?

Re: Open Letter to Mozilla: Bring Back Persona

#234

Post by soapdog »

smacktoward wrote: post #91
soapdog wrote: post #63

The main problem with Persona was not the tech, Persona is great and works well. The problem is that building federated identity services is hard. Persona is not a centralized login system such as "login with Facebook". With Persona, once you decide to login with your email account, first Persona looks for an IdP with your domain/provider, the if not found it goes back to the persona catchall service. For a while gma…

> With Persona, once you decide to login with your email account, first Persona looks for an IdP with your domain/provider, the if not found it goes back to the persona catchall service. This implies a classic chicken/egg dilemma: email providers won't implement Persona support unless that would be useful for lots of people; Persona wouldn't be useful for lots of people until their email provider supported it.

It worked even if their email provider didn't supported it because in such cases there was a fallback Mozilla IdP. You can try it right now on MDN or MozillaWiki.

Re: Open Letter to Mozilla: Bring Back Persona

#235

Post by dTal »

pekk wrote: post #190
cpeterso wrote: post #181

Earlier quoted context omitted.

Use Mailinator for your throwaway email address needs: https://mailinator.com/

Almost everybody blacklists mailinator addresses these days...

It's my go-to and I can't remember ever having a problem.

Re: Open Letter to Mozilla: Bring Back Persona

#236

Post by gnufx »

l1n wrote: post #89
scrollaway wrote: post #6

> I don’t know if something like a Kickstarter campaign to raise some money to pay for engineer time would help sway Mozilla at all, but I’m perfectly happy pledging a few hundred dollars and running the campaign, if necessary. I just really want to see Persona succeed. I mentioned this by email, but I'll repeat it here: I believe in the design behind Persona. I believe a well structured, free authentication provider…

I am! Federated authentication would be a beautiful thing. I'll lend my dev/sysadmin experience to a project like this.

They may not be directly comparable with Persona, but such things are widely deployed in academic/research communities: https://shibboleth.net/ (web-specific), https://www.eduroam.org/ (roaming wifi-specific in practice?), and "e-science certificates" in the UK (specifically horrible -- definitely not a beautiful thing) which I think come under https://www.igtf.net/.

The recent generalized effort is Moonshot/ABFAB (https://jisc.ac.uk/assent), which I think has made disappointingly slow progress.

Re: Open Letter to Mozilla: Bring Back Persona

#237

Post by Sir_Substance »

SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Holy shit, are you me?

>Now, here's the sad thing, for me: I didn't even know Persona existed until its demise was being discussed on HN and reddit. Persona is exactly what I want for my users and my sites; and for my own use of the web.

That's the biggest standout for me as well. I've been /looking/ for a technology like this. Not looking very hard, it must be said. Ok, maybe it's more accurate to say I've been saying for years someone should make this without ever googling to see if someone had.

But how is it that in 3-4 /years/ of me discussing this with other developers every time we bring up account systems, no one has said "oh yeah, persona does that!". Did Mozilla not advertise this at all? The lack of mindshare is staggering.

Re: Open Letter to Mozilla: Bring Back Persona

#238

Post by tripzilch »

manigandham wrote: post #10
SwellJoe wrote: post #5

I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience. Now, here's the sad thing, for me: I didn't even know Persona existed…

Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.

Visiting my parents for Christmas, I helped my mom set up her new win10 laptop. (and she's real good with computers for someone her age whose job wasn't in IT)

Lesson here for anyone wanting to use emails for usernames:

Make it really clear that you're asking for the email as an ID, as the username. Otherwise this will incline people to enter the same password as their email because they think they're asked to log in. Even if they know it's important not to re-use passwords over different logins.

To make this anecdata N>1, I teach computer stuff to kids (ages 8-12, generally) and they tend to make the same mistake.

(working on semi-public computers, I am glad I get to teach them about Private Windows: "if it's not your computer, only enter your password on a window that shows the little mask/sunglasses-guy")

Re: Open Letter to Mozilla: Bring Back Persona

#239

Post by stickfigure »

something2324 wrote: post #216
stickfigure wrote: post #142

Earlier quoted context omitted.

Facebook Anonymous Login is a menace to the open internet. As a website operator, these are no longer your users, they're Facebook's users, and Facebook can take them away from you at any time. As a user, these are no longer your website accounts, they're Facebook's website accounts, and Facebook can take them away from you at any time. Putting Facebook in complete control of identity is not healthy for anyone. At le…

"and Facebook can take them away from you at any time" Have they actually done that to any website? That would undermine their whole system. They'd do that once and everyone would leave their service. That's like saying "Well Google could publish all your emails! So you definitely shouldn't trust your emails to Google"

Have they actually done that to any website? Absolutely. Facebook freezes application ids all the time, mostly for what you or I would consider "good reasons" (spam, fraud, abuse, etc). Has it ever happened for less noble reasons, or grey zones? Do you want to bet that this will never be the case? How long is your time horizon?

Facebook frequently freezes user accounts for all sorts of reasons. Maybe their name doesn't exactly match what's on their state issued ID. Maybe the art nude selfie they posted pissed off the censors. Maybe they expressed an unpopular political opinion. Maybe their name matches somebody on a sex offender list. Maybe they just got tripped up by an over-exuberant fraud bot.

I remember when Microsoft was the good guy and IBM was the bad guy. Things change.

Post reply on HN