Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Mozilla Persona, An Identity System for the Web

mozilla.org

Post reply on HN
Print view View original

31–40 of 131 posts

Re: Introducing Mozilla Persona, An Identity System for the Web

#31

Post by mbrubeck »

greggman wrote: post #29

I know this probably fits only me but I never use my email address as id. Every company and every account I sign up for I give a different email address. I'm not about to use a single one for my ID. Especially when they are easy to spoof (any one can send mail as you@there.com) and they are easy to spam and abuse. I had an email address that got 3000 spams a day. That's why I never give use email as ID because I want…

BrowserID lets you use any number of email addresses and choose which one to use for a given site (though I think the current UI might get a bit cumbersome if you have dozens attached to one Persona account).

Re: Introducing Mozilla Persona, An Identity System for the Web

#32

Post by rfk »

greggman wrote: post #29

I know this probably fits only me but I never use my email address as id. Every company and every account I sign up for I give a different email address. I'm not about to use a single one for my ID. Especially when they are easy to spoof (any one can send mail as you@there.com) and they are easy to spam and abuse. I had an email address that got 3000 spams a day. That's why I never give use email as ID because I want…

There is a lot of scope for one-time emails, pseudonymous emails and other kinds of not-my-primary-email authentication systems within Persona. One simple example of how this might work is MockMyID:

    https://mockmyid.com/
Try logging into a Persona-enabled website with anything@mockmyid.com - you will be able to authenticate without entering any password or giving away any personal information. Of course, so can anyone else, but it might give you an idea of the possibilities in this space.

Re: Introducing Mozilla Persona, An Identity System for the Web

#33

Post by azakai »

hinting wrote: post #6

Honest question: As an app builder, why would you use this instead of facebook? Many more users are going to have Facebook logins already, and it provides social information that may be useful to your app. (Hoping to hear answers other than the dev-centric 'I don't like facebook')

> Honest question: As an app builder, why would you use this instead of facebook?

You should use both, to maximize the convenience of your users.

Some are always signed into Facebook, and like to just use that, others want other methods that offer different models of security and openness, Persona is the best of those I would argue (OpenID is nice too, but the lack of native browser integration is what makes it less impressive than Persona).

Re: Introducing Mozilla Persona, An Identity System for the Web

#34

Post by eps »

rfk wrote: post #32
greggman wrote: post #29

I know this probably fits only me but I never use my email address as id. Every company and every account I sign up for I give a different email address. I'm not about to use a single one for my ID. Especially when they are easy to spoof (any one can send mail as you@there.com) and they are easy to spam and abuse. I had an email address that got 3000 spams a day. That's why I never give use email as ID because I want…

There is a lot of scope for one-time emails, pseudonymous emails and other kinds of not-my-primary-email authentication systems within Persona. One simple example of how this might work is MockMyID: https://mockmyid.com/ Try logging into a Persona-enabled website with anything@mockmyid.com - you will be able to authenticate without entering any password or giving away any personal information. Of course, so can anyon…

But what is being authenticated exactly in this case?

My understanding of Browser ID is that it's a way to provide an email address to a site operator that doesn't need to be confirmed. It's a single-step subscribe/account creation, rather than an authentication per se.

Re: Introducing Mozilla Persona, An Identity System for the Web

#35

Post by nostromo »

One of the reasons FB and Twitter OAuth became so popular is because they solved a problem for the user (remembering passwords) and also gave the site owner a big carrot (social growth mechanics, more user data).

This seems much more one sided -- it's good for the user that doesn't use FB or Twitter but 'meh' for the website. I'm not sure we'll see fast adoption like we have for OAuth.

Re: Introducing Mozilla Persona, An Identity System for the Web

#36

Post by nl »

Alex3917 wrote: post #15
rubberband wrote: post #3

So we have this, Open ID, Facebook, Twitter, Google, Microsoft Passport/Live ID, and probably like five other major players I'm forgetting. I apologize for being pessimistic, but this just doesn't seem like a solvable problem. I want it to be solvable, but players like Facebook benefit far too much for them to not push their particular version of "universal" login on everyone. Every player seems to think they are the…

I think if you look at Kim Cameron's Laws of Identity, it's clear that the research team at MS has had it right for at least a decade, it's just that none of their ideas have made it into production. http://www.identityblog.com/stories/2004/12/09/thelaws.html Ballmer had both the plans and source code for an identity product that would have been 10x more advanced than Facebook, but they decided to axe the project so…

Ballmer had both the plans and source code for an identity product that would have been 10x more advanced than Facebook

ANYONE can make an identity product that is 10x more advanced than Facebook.

The problem is making an identity product that is 10x SIMPLER than Facebook, without relying on a single source of identity verification.

Re: Introducing Mozilla Persona, An Identity System for the Web

#37

Post by shalmanese »

mcpherrinm wrote: post #5
rangibaby wrote: post #4

Random thoughts: • The name "Persona" is odd considering something by the same name already exists in Mozilla-land, a fact they seem to be aware of. • I hope sites use this instead of forcing Facebook login!!

The other personas (aka "lightweight themes") are supposedly being re-branded (thought I don't remember what they're calling them). It apparently hasn't happened yet, which will surely lead to some trouble.

Why don't they call them lightweight themes?

Re: Introducing Mozilla Persona, An Identity System for the Web

#38

Post by rfk »

eps wrote: post #34
rfk wrote: post #32

Earlier quoted context omitted.

There is a lot of scope for one-time emails, pseudonymous emails and other kinds of not-my-primary-email authentication systems within Persona. One simple example of how this might work is MockMyID: https://mockmyid.com/ Try logging into a Persona-enabled website with anything@mockmyid.com - you will be able to authenticate without entering any password or giving away any personal information. Of course, so can anyon…

But what is being authenticated exactly in this case? My understanding of Browser ID is that it's a way to provide an email address to a site operator that doesn't need to be confirmed. It's a single-step subscribe/account creation, rather than an authentication per se.

BrowserID provides a way to say to a site "I own this email address", as well as a protocol for the site to verify such an assertion. What the site chooses to do with the information is up to them. It can be used for account creation or signup, but works equally well for authentication to an existing account.

In the mockmyid case, you are saying "I own the address xyz@mockmyid.com". But the MockMyID server will happily let anyone make such an assertion, so you get a simple kind of mock identity.

Of course, you shouldn't use that as your identity on any sites that you care about. Mail to anything@mockmyid.com doesn't go anywhere, and there's nothing to prevent other people from using the same @mockmyid.com address. But it's a neat example of the sort of thing that is possible.

Re: Introducing Mozilla Persona, An Identity System for the Web

#40

Post by alberich »

nostromo wrote: post #35

One of the reasons FB and Twitter OAuth became so popular is because they solved a problem for the user (remembering passwords) and also gave the site owner a big carrot (social growth mechanics, more user data). This seems much more one sided -- it's good for the user that doesn't use FB or Twitter but 'meh' for the website. I'm not sure we'll see fast adoption like we have for OAuth.

More power to the user is good. Current IdM solutions leak too much data to the service providers/relying parties.

What really sucks about all solutions is that once the data has leaked, you gotta trust the service providers not to sell or give your data away.

Post reply on HN