Live data from Hacker News

Payment Request API

w3.org

91–100 of 128 posts

Re: Payment Request API

#91
post #85

So there's now a protocol for the browser to transparently share payment data with websites but we still can't get something to let the browser transparently log us in to websites?

That's what Mozilla Persona (not the theming system) was meant to be, but apparently people didn't care enough for it for websites to implement it. [1] https://en.wikipedia.org/wiki/Mozilla_Persona

People did care and use Persona. Unfortunately, large organizations, such as Mozilla, expect that anything they launch will be mass-adopted within a short period of time, and kill promising projects that fail to quickly reach such adoption.

Re: Payment Request API

#93

So there's now a protocol for the browser to transparently share payment data with websites but we still can't get something to let the browser transparently log us in to websites?

This became a thing lately: https://developers.google.com/web/updates/2016/04/credential...

chrome only

Re: Payment Request API

#94
post #85

Earlier quoted context omitted.

That's what Mozilla Persona (not the theming system) was meant to be, but apparently people didn't care enough for it for websites to implement it. [1] https://en.wikipedia.org/wiki/Mozilla_Persona

Mozilla Persona suffered from the problem that its developers abandoned it shortly after releasing it, rather than making any attempt to get it into browsers. The pop-up dialog wasn't how it was supposed to work, that was a fallback (and apparently a slightly confusing one) - there was supposed to be a little login widget in your address bar that you'd interact with, and it'd be fully integrated into your browser's U…

Hmmm.. How would that work beyond Firefox if it wasnt a standard?

Persona was a good nobel idea, but like many Mozilla endeavors without a commercial goal it was doomed to failure, a few devs and devops costs money (a lot in the US, let's say 3 devs - 2 devops, office space, benefits etc.. easily 1m). Slightly OT beyond Firefox has Mozilla done anything commercially successful? Mobile software failure (cant imagine Android FF pays for itsself), device failure, SSO failure. How much revenue % is accounted for beyond the Google search integration?

Update: Just thought they made Rust and Servo that's pretty cool and my post sounds a little shitty, Rust seems awesome, but commercial avenue (back to reality) seems extremely limited here..

Re: Payment Request API

#95

Earlier quoted context omitted.

Interesting that the post says the term BIN (vs. IIN) isn't commonly used anymore, but it's practically the only thing I've heard them called in the last 10+ years of ecomm dev.

I've seen both. When I wrote the post all the docs from the gateways I had access to called then iin with a historical note on bin. I done have access to those docs anymore though.

I don't doubt you, but as an example, the recent notification of BIN/IIN prefix additions for Mastercard uses BIN 19 times and IIN 2 times.

https://www.mastercard.us/en-us/issuers/get-support/2-series...

Re: Payment Request API

#96

Earlier quoted context omitted.

Mozilla Persona suffered from the problem that its developers abandoned it shortly after releasing it, rather than making any attempt to get it into browsers. The pop-up dialog wasn't how it was supposed to work, that was a fallback (and apparently a slightly confusing one) - there was supposed to be a little login widget in your address bar that you'd interact with, and it'd be fully integrated into your browser's U…

Hmmm.. How would that work beyond Firefox if it wasnt a standard? Persona was a good nobel idea, but like many Mozilla endeavors without a commercial goal it was doomed to failure, a few devs and devops costs money (a lot in the US, let's say 3 devs - 2 devops, office space, benefits etc.. easily 1m). Slightly OT beyond Firefox has Mozilla done anything commercially successful? Mobile software failure (cant imagine A…

> How would that work beyond Firefox if it wasn't a standard?

Done properly, it hopefully would've been. (There was even some branding around the vague hope that it would eventually be a standard - "BrowserID"). As it stands... the Persona devs never even tried to create an extension for Firefox to show what they were trying to do (there's some early mockups that explain some of it), nor did they attempt to standardise it. The project was mismanaged to failure.

> has Mozilla done anything commercially successful?

Mozilla is primarily a non-profit organisation, "commercially successful" is not the goal. Mozilla Corp, the wholly owned tax-paying subsidiary, is simply a legal tool to make it less difficult to sell things like search integration, not to be a commercial success.

The question is whether much of their work successfully furthers their goals as outlined in their mission statement and manifesto.[0]

[0] https://www.mozilla.org/en-GB/mission/

Re: Payment Request API

#97
post #85

Earlier quoted context omitted.

That's what Mozilla Persona (not the theming system) was meant to be, but apparently people didn't care enough for it for websites to implement it. [1] https://en.wikipedia.org/wiki/Mozilla_Persona

Mozilla Persona suffered from the problem that its developers abandoned it shortly after releasing it, rather than making any attempt to get it into browsers. The pop-up dialog wasn't how it was supposed to work, that was a fallback (and apparently a slightly confusing one) - there was supposed to be a little login widget in your address bar that you'd interact with, and it'd be fully integrated into your browser's U…

I'd highly recommend taking a look at the talk "Designing for Failure" by Dan Callahan, a former Mozilla developer on Persona: https://www.youtube.com/watch?v=3dDGkLHOldw

In it, he made a very compelling case on exactly why developers within Mozilla considered Persona's design to be fundamentally flawed beyond a point where it was worth expending the effort and resources to promote and pursue further:

Persona had a "intractable point of centralization" designed into the protocol in the form of the fallback relay that defaulted to login.persona.org. Eventually, the browser was supposed to integrate this functionality and act as this relay, and in a perfect world where Persona is standardized and available in every browser, the fallback relay could, in theory, no longer need to exist.

However, the harsh realities of the web platform unfortunately means that day may never come, even if Persona were to become reasonably successful. There will always be a significant portion of users who remain on older browsers that won't necessarily support the newest features, either by ignorance or by necessity, and very few serious web products are going to risk closing themselves off to such a significant potential source of visitors/revenue just to make use of a shiny new browser feature. This is why most web developers' adoption of ES2015+ are limited to those features where transpilers and polyfills are available (see the abyssmal adoption rate of ES6 Proxies, despite longstanding support in latest versions of major browsers, as an example: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...).

This means that Persona would need to have the login.persona.org fallback available and supported indefinitely in order to have any chance of widespread adoption by developers, which brings us back to the point on intractable centralization: Nobody asides from Mozilla can meaningfully host a fallback relay for Persona without having to also fork the Persona community, because Persona was not designed to allow for any possibility of fallback-relay negotiation between the client (the app the user is trying to authenticate with) and server (the server providing the Persona identity) directly, mainly out of the very noble intention to prevent any loss of user privacy that might result from allowing the client to exchange user info with the server directly (the browser or fallback relay was meant to serve also as an additional layer of security and a gatekeeper to confidential user info).

Ultimately, Mozilla had no choice but to become a single point of failure on a critical piece of authentication infrastructure for the internet if Persona were ever to gain widespread adoption, and this certainly didn't fit with Mozilla's vision for an open and decentralized internet. The team eventually realized this, and ended up winding down development and support for the Persona platform at least in a large part because of it, in hopes that other projects would learn from its mistakes and flourish. Unfortunately that hasn't happened yet, and I think it has a bit to do with the fact that the team's learnings got drowned out in a perfect storm of negative publicity in response to their dropping support for Persona. Apparently the concept itself was quite well loved among developers, despite issues in this particular actual implementation, which is really the silver lining here, and is what makes me really optimistic about the future of authentication on the web.

Dan lamented in the video that "if we hadn't been within Mozilla, we wouldn't have been so audacious as to have predicated the design, predicated the decentralization of the system, on the browser natively implementing our protocol... I honestly think this is something that could have been solved in a different way if we weren't a browser vendor. We were blinded by our context."

It's a really poignant point, in my opinion, and I completely agree that the right way to approach a problem like this is to first develop a solution that can stand on its own merits with or without browser support, then proving itself to be decentralized and open enough to support a rich ecosystem of competing service providers and implementations, and compelling enough to gain widespread adoption. While browser support could and should be obviously beneficial in terms of providing a more streamlined UX, predicating on it opens up the possibility for very severe failures of the imagination, as the Persona team has learned. And if a solution exhibits all the properties I just mentioned, then it becomes a very natural candidate to base a browser standard proposal on, because these are the very same properties that are often deemed most desirable in real web standards to begin with.

I personally can't wait to see what comes out of the current project Dan's working on, Portier, which is positioned to be a spiritual successor to Persona: https://portier.github.io/

Re: Payment Request API

#98
post #81

Earlier quoted context omitted.

True micropayments integrated in browser would be amazing. Imagine instead of ads or subscriptions, you could pay a few pennies for an article. It would revolutionize online content, in a good way. Nobody would be willing to pay for clickbait type stuff, but I think people would be willing to pay for quality content and journalism.

I want to pay a fixed amount per month, and distribute that money over the websites I visited, weighted by the time I spent there.

Sounds like https://flattr.com/

Re: Payment Request API

#99

Odd that none of the editors are, you know, actually from companies that do meaningful e-commerce. I'd be a lot more interested if it was obvious that folks like Amazon, Stripe, Paypal, Braintree, Ebay, etc. were working on this. I'm also wary of an API that tries to be all things to all people--as evidenced by the shoehorning in of shipping and delivery options. EDIT: Also, we see stuff like so: > The PaymentRequest…

Big players such as Amazon doesn't want this, because it diminishes the value of their existing database of stored credit cards and evens the playing field for new merchants. Most people buy from Amazon because they already have an account there. Even if you find a product somewhere else, you go to Amazon to order it.

Re: Payment Request API

#100
post #46

Earlier quoted context omitted.

> The w3c seems to be run by people who make money on the web, not people who use the web. Not really. Anyone can join the W3C, and anyone can participate in a working group / contribute to a standard. However, most people would agree that the balance of power effectively lies with the browser vendors. You can propose a standard all you like, but if you can't get a browser to adopt it then it's not going to get any t…

> Anyone can join the W3C, and anyone can participate in a working group / contribute to a standard. Starting at ~10 000 USD per year, sure

It's worth noting that while it costs money to join the W3C, W3C membership isn't a requirement to participate in most (maybe even all now?) WGs where you can simply join the mailing list or subscribe to the GitHub repo and contribute.
Post reply on HN