Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Mozilla Persona, An Identity System for the Web

mozilla.org

Post reply on HN
Print view View original

61–70 of 131 posts

Re: Introducing Mozilla Persona, An Identity System for the Web

#61

Post by gamzer »

shalmanese wrote: post #37
mcpherrinm wrote: post #5

Earlier quoted context omitted.

The other personas (aka "lightweight themes") are supposedly being re-branded (thought I don't remember what they're calling them). It apparently hasn't happened yet, which will surely lead to some trouble.

Why don't they call them lightweight themes?

This comment sounds so innocent but it really started me thinking. When should one call things simply by their name and when should one create a new name?

Would Twitter be the same if it was for short text messages? Or are Tweets so different that they deserve their own name?

Re: Introducing Mozilla Persona, An Identity System for the Web

#62

Post by callahad »

qznc wrote: post #55

I tried the OpenPhoto example. One thing that introduces friction compared to username-password: The first time, I have to create a Persona account. Unfortunatelly, I'm not logged in afterwards. Most sites nowadays log you in right after account creation and just wait for email-verification later. Is that even possible with Persona?

Yeah, that totally sucks, and we're working on it.

OpenPhoto is still using our old API, which can't handle post-verification redirects. Our new API does this automatically. Grab a mailinator account and try signing in to http://123done.org.

As for creating a Persona account, we're trying to fix that, too. Next month we'll be turning on a feature (codenamed "bigtent") that verifies Gmail, Hotmail, and Yahoo users by sending them through their respective provider's OpenID or Oauth endpoints. No more new account creation. No more email verification loop. Just three clicks and you're done.

Re: Introducing Mozilla Persona, An Identity System for the Web

#63

Post by callahad »

alberich wrote: post #46
drivebyacct2 wrote: post #25

I really, really like Persona. It's federated and it gives the identity provider a vast amount of control over the security protecting accounts. Want to use SSH keys for auth? Okay. You can do that.

Do you have any links to specifications on it? I'm very interested on identity federation. But the post doesn't give away much info on persona's capabilities.

https://github.com/mozilla/id-specs/

Pull requests and new issues welcome :)

Re: Introducing Mozilla Persona, An Identity System for the Web

#65

Post by etherealG »

saurik wrote: post #54
callahad wrote: post #52

Earlier quoted context omitted.

One of the biggest wins for sites is that we reduce account creation / sign in friction for your users, so you get an awesome, easy flow through your funnel without having to give up ownership of your user data. We also let you reach many, many more people, since you're not forcing users into joining an anointed social network. Everyone has an email address, and people understand what it means to reveal it. Also, the…

Wait, it relies on email address? ( quickly reads up on it. ) ... and it doesn't have user identifiers other than the email address? That is not reasonable: normal people (as in, people who don't know much about what they are doing with computers) tend to have piles and piles of email addresses, none of which hold any canonical weight to them: they have email addresses from ISPs, from schools, from work, and they oft…

without trying to add more complexity into the system, it would be nice if multiple accounts per email were possible. why not just link them together so any will work in place of another? not sure how you'd help someone find their account if they don't remember the email though.

Re: Introducing Mozilla Persona, An Identity System for the Web

#66

Post by ollysb »

saurik wrote: post #54
callahad wrote: post #52

Earlier quoted context omitted.

One of the biggest wins for sites is that we reduce account creation / sign in friction for your users, so you get an awesome, easy flow through your funnel without having to give up ownership of your user data. We also let you reach many, many more people, since you're not forcing users into joining an anointed social network. Everyone has an email address, and people understand what it means to reveal it. Also, the…

Wait, it relies on email address? ( quickly reads up on it. ) ... and it doesn't have user identifiers other than the email address? That is not reasonable: normal people (as in, people who don't know much about what they are doing with computers) tend to have piles and piles of email addresses, none of which hold any canonical weight to them: they have email addresses from ISPs, from schools, from work, and they oft…

Here's what would be great for users, being able to sign in with _any_ of their email addresses and passwords. If you could register all of your email addresses and passwords then login would become as easy as entering the first set of details you think of.

Re: Introducing Mozilla Persona, An Identity System for the Web

#67

Post by callahad »

zaroth wrote: post #57
callahad wrote: post #51

Earlier quoted context omitted.

> I didn't join gmail with the idea of giving them the keys to my life. Nor did I, but as you acknowledged, that sort of control has entered the status quo. Anyone who can break into your email account can trivially reset your password on many sites, at which point, per-site passwords just become another liability. We get rid of those, and empower you to independently decide who to trust with your identity. > Does th…

Thanks for taking the time to respond. At least in the case of password resets, it's the site deciding they want "email" to be the weakest link, and many sites will require at least a little bit more (like secret questions) after a reset. In this scheme, email is by definition the weakest link. The secondaries can never go away, unless sites are willing to straight up refuse customers based on their email address. Th…

Oh, sorry, there absolutely are prominent ways to log out / flush the keypair manually. It's after 02:00 local, so I need to get some sleep :).

As to XSS, the assertion that's transmitted to a site is scoped to that specific site, and is only valid for, iirc, 2 minutes. So replay attacks are severely constrained. Plus, the only meaningful data they contain is the user's email address, so phishing doesn't get you much of value or put the user at risk.

Re: Introducing Mozilla Persona, An Identity System for the Web

#68

Post by callahad »

Of_Prometheus wrote: post #44

Is there a list of all the sites, besides Open Photo, that have already enabled BrowserID?

Mozilla has tons of stuff in production running Persona, so we're totally dogfooding with Bugzilla, Mozpad, MDN, Add-ons Builder, Firefox Affiliates, Firefox Flicks, Mozilla Marketplace, and Mozillians.

Voo.st, OpenPhoto.me, Crossword.TheTimes.co.uk, 5apps.com, Haskellers.com, etc. We're also working to get Persona working with some larger sites, but most of those are waiting to go live until after we formally announce API stability next month.

Re: Introducing Mozilla Persona, An Identity System for the Web

#70

Post by callahad »

moxie wrote: post #12
hinting wrote: post #6

Honest question: As an app builder, why would you use this instead of facebook? Many more users are going to have Facebook logins already, and it provides social information that may be useful to your app. (Hoping to hear answers other than the dev-centric 'I don't like facebook')

Exactly, and I think it's possible that Mozilla just doesn't understand this. Webapps aren't attracted to identity providers because they want to avoid managing a user table in their database, but because existing identity providers like Facebook provide a set of "social" APIs that can support the webapp. I can't see why a site would be drawn to BrowserID instead.

> I can't see why a site would be drawn to BrowserID instead.

There's more to Persona than liberating you from your password column.

Nevertheless, there are still huge classes of applications that don't benefit from social features, but do want the improved experience that Persona can offer. Think banks, universities, corporations, and governments.

So even in the absolute worst case versus Facebook Connect, we still have enormous potential for alleviating the pain of per-site passwords and containing the damage from security breaches in day to day life.

Post reply on HN