Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Mozilla Persona, An Identity System for the Web

mozilla.org

Post reply on HN
Print view View original

21–30 of 131 posts

Re: Introducing Mozilla Persona, An Identity System for the Web

#21

Post by patja »

tg3 wrote: post #18
immad wrote: post #14

Earlier quoted context omitted.

If you ask for the permission Facebook will give you the users email address. You can additionally just ask for the users email address. Any one building a serious business using facebook auth does one of the above.

IIRC email is one of the few pieces of information about users that you get by default, and cannot be revoked by the user (without revoking the app entirely)

Incorrect. You must request and obtain the extended permission 'email' in order to retrieve the user's email address from Facebook.

Re: Introducing Mozilla Persona, An Identity System for the Web

#22

Post by egs »

glassx wrote: post #20

I believe that a native implementation has been on their plans from the start, but I haven't heard much about it lately. Here's some mockups: http://people.mozilla.com/%7Efaaborg/files/projects/firefoxA... There's also some work on integrating existing e-mail providers, so you can get instant identities: http://identity.mozilla.com/post/17207734786/id-provider-sup... This is probably the web-thing I'm most excited ab…

A website relying on a single service to serve as a sole identity provider seems replete with risks. That sounds remarkably similar to Microsoft's Passport, an idea that was a non-starter for everyone except Microsoft.

Re: Introducing Mozilla Persona, An Identity System for the Web

#23

Post by patja »

hinting wrote: post #6

Honest question: As an app builder, why would you use this instead of facebook? Many more users are going to have Facebook logins already, and it provides social information that may be useful to your app. (Hoping to hear answers other than the dev-centric 'I don't like facebook')

I don't think "I don't like Facebook" is limited to dev-centric populations. I know people who have nothing to do with software development who refuse to get Facebook accounts. And then there are the folks who use Facebook but refuse the install any apps (about half of my Facebook friends fall into this category). You need to offer something other than Facebook auth if you care about having the broadest reach possible. This Mozilla persona thing has a pretty intuitive workflow for signing up with any email address.

Re: Introducing Mozilla Persona, An Identity System for the Web

#24

Post by JBiserkov »

immad wrote: post #14
thristian wrote: post #11

Earlier quoted context omitted.

One good reason: If Facebook goes broke, or decides to stop offering their authentication service, or anything like that, your user database is now filled with useless Facebook user IDs. If Mozilla's Persona system goes broke or gets taken offline, your user database is now filled with perfectly good, validated email addresses, so you can still contact your users and/or match up new registrations with existing accoun…

If you ask for the permission Facebook will give you the users email address. You can additionally just ask for the users email address. Any one building a serious business using facebook auth does one of the above.

>If you ask for the permission Facebook will give you the users email address.

us3r-1D@facebook.com - that's helpful :)

Re: Introducing Mozilla Persona, An Identity System for the Web

#26

Post by drumdance »

moxie wrote: post #12
hinting wrote: post #6

Honest question: As an app builder, why would you use this instead of facebook? Many more users are going to have Facebook logins already, and it provides social information that may be useful to your app. (Hoping to hear answers other than the dev-centric 'I don't like facebook')

Exactly, and I think it's possible that Mozilla just doesn't understand this. Webapps aren't attracted to identity providers because they want to avoid managing a user table in their database, but because existing identity providers like Facebook provide a set of "social" APIs that can support the webapp. I can't see why a site would be drawn to BrowserID instead.

One other benefit is it lowers the friction to signup.

Re: Introducing Mozilla Persona, An Identity System for the Web

#27

Post by glassx »

egs wrote: post #22
glassx wrote: post #20

I believe that a native implementation has been on their plans from the start, but I haven't heard much about it lately. Here's some mockups: http://people.mozilla.com/%7Efaaborg/files/projects/firefoxA... There's also some work on integrating existing e-mail providers, so you can get instant identities: http://identity.mozilla.com/post/17207734786/id-provider-sup... This is probably the web-thing I'm most excited ab…

A website relying on a single service to serve as a sole identity provider seems replete with risks. That sounds remarkably similar to Microsoft's Passport, an idea that was a non-starter for everyone except Microsoft.

It's hard to explain, but it's not much a "service" - the current implementation is just a "shim", since no browser supports it natively. Client-wise, it's just a JavaScript API. In the future, your browser will store your keys, not Mozilla.

But even with the current implementation it is possible to validate the assertion in your server without contacting browserid.org, but AFAIK nobody did it yet.

(I tried to find a reference for that, but they took it down from their Wiki. It used to say "You may choose to validate assertions on your own server": https://github.com/mozilla/browserid/wiki/How-to-Use-Browser... - the verification code is still online, though)

Re: Introducing Mozilla Persona, An Identity System for the Web

#28

Post by nnethercote »

That link is to a very high level, non-technical overview, which is not a good link for HN.

Try these links, which go into much more detail, answering the "why bother" questions.

https://developer.mozilla.org/en/BrowserID/Why_BrowserID

http://identity.mozilla.com/post/7899984443/privacy-and-brow...

http://lloyd.io/how-browserid-works

Note that BrowserID was the old working name for the project.

Re: Introducing Mozilla Persona, An Identity System for the Web

#29

Post by greggman »

I know this probably fits only me but I never use my email address as id.

Every company and every account I sign up for I give a different email address. I'm not about to use a single one for my ID. Especially when they are easy to spoof (any one can send mail as you@there.com) and they are easy to spam and abuse. I had an email address that got 3000 spams a day. That's why I never give use email as ID because I want to be able to disable any email address that's giving me trouble.

So, not interested in BrowserID I think. Or maybe I didn't grok it.

Re: Introducing Mozilla Persona, An Identity System for the Web

#30

Post by mbrubeck »

rubberband wrote: post #3

So we have this, Open ID, Facebook, Twitter, Google, Microsoft Passport/Live ID, and probably like five other major players I'm forgetting. I apologize for being pessimistic, but this just doesn't seem like a solvable problem. I want it to be solvable, but players like Facebook benefit far too much for them to not push their particular version of "universal" login on everyone. Every player seems to think they are the…

BrowserID is designed to be integrated into the browser. There are some huge usability benefits possible when your browser can log in for you. If the browser UI succeeds in reducing friction for signup and login, that could motivate sites to adopt the protocol.
Post reply on HN