Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Mozilla Persona, An Identity System for the Web

mozilla.org

Post reply on HN
Print view View original

71–80 of 131 posts

Re: Introducing Mozilla Persona, An Identity System for the Web

#71

Post by callahad »

geon wrote: post #59
saurik wrote: post #54

Earlier quoted context omitted.

Wait, it relies on email address? ( quickly reads up on it. ) ... and it doesn't have user identifiers other than the email address? That is not reasonable: normal people (as in, people who don't know much about what they are doing with computers) tend to have piles and piles of email addresses, none of which hold any canonical weight to them: they have email addresses from ISPs, from schools, from work, and they oft…

Not to mention that email is really unsecure. A password reset link will be sent as plaintext. Is there at least a way to change the email addredd associated with an account? I can't see anything about that.

What password reset link? :)

If you're using an email provider with native support for Persona, the only password you have is with your email provider.

Re: Introducing Mozilla Persona, An Identity System for the Web

#72

Post by _urga »

callahad wrote: post #52
nostromo wrote: post #35

One of the reasons FB and Twitter OAuth became so popular is because they solved a problem for the user (remembering passwords) and also gave the site owner a big carrot (social growth mechanics, more user data). This seems much more one sided -- it's good for the user that doesn't use FB or Twitter but 'meh' for the website. I'm not sure we'll see fast adoption like we have for OAuth.

One of the biggest wins for sites is that we reduce account creation / sign in friction for your users, so you get an awesome, easy flow through your funnel without having to give up ownership of your user data. We also let you reach many, many more people, since you're not forcing users into joining an anointed social network. Everyone has an email address, and people understand what it means to reveal it. Also, the…

"we're really, really easy to implement" "I want to see us become the de facto auth solution" "We also let you reach many, many more people" "but we're also a really nice option to put alongside your social login"

Assuming by "we" and "us" you mean Mozilla? Or do you also mean the other major browsers?

Why did you write it like that? Why not just say "Persona" instead of "we" and "us"? Surely Persona is much bigger than Mozilla or do you not think so?

Firstly, that kind of language does not inspire trust. It sounds very much "us" vs "them", instead of addressing the real problem, which is helping users by creating and managing more secure passwords.

Secondly, your marketing to users includes:

"Many sign-in systems carry your profile data with them; some even share that info with other sites and social networks. We believe you should control how your personal information is shared."

You seem to want to attract publishers and yet you show your distrust of them to users.

Also, from experience in Public Web Apps, and the fact that it's still not possible for a user to give raw and pure TCP, UDP or POSIX power to Web Apps (and WebSockets and IndexedDB are not at all the same), I don't think the issue is so much that the user has power, as it is that the browser should have power. As it is today, the user is given very little power at all by the browser. Very little trust. Most spec discussions seem to constantly worry about users shooting themselves in the foot, and are prepared to stop at that, rather than finding ways to empower users to give power to web apps.

Re: Introducing Mozilla Persona, An Identity System for the Web

#73

Post by callahad »

carlesfe wrote: post #69

Okay, I have read the specs, the FAQ, the diagrams, and tried some examples, but I can't really understand how it works. Could somebody do a quick summary for me? I would appreciate it very much.

I really, really need to post something like this on our blog soon. Watch http://identity.mozilla.com/ for something more polished next week or so. I'd also strongly urge you to just try implementing it on a site. It'll literally take less than 30 lines each of javascript on the frontend and python on the backend, and it'll really demystify the flow between the site and the user.

As an analogy, we work really similarlu to showing a bouncer your ID. The ID has identifying information on it, and it has features that allow you to know that it's authentic and hasn't been tampered with. The bouncer can learn how to validate IDs issued by many different authorities, and can remember this when he sees other IDs from that same authority.

Our IDs are personal public/private keypairs, signed by the email provider.

So, quick and dirty, here's how we work:

I want to log in to 123done.org as foobar@eyedee.me, but to do that, I need an ID with eyedee.me's digital signature on it. So in a popup, my browser sends me over to eyedee.me to ask for that signature.

Before eyedee.me will sign a public key with my name on it, I have to prove that I really am who I say I am. It's just between the two of us, so I can prove my identity however eyedee.me wants. It could be a password, an RSA keyfob, or entering a code from a text message. Whatever it is, eyedee.me is happy that I am who I say I am, and they sign my key and hand it back.

I want to show this to 123done.org, but it's not enough for it to be valid, since we have to prevent malicious websites or phishers from copying it and masquerading as other people. For my ID to be a valid login token, I have to add two more things: what site I'm logging in to, and a timestamp so it expires soon after I hand it over. I then sign that with my private key.

I then take that whole bundle and hand it off to 123done.org.

123done verifies it by asking for eyedee.me's public key (which can be cached), and seeing if that matches the first signature on the ID. If it does, then 123done pulls out the validly signed public key, and checks if it matches the second signature on the ID. If that matches, then the whole package is valid, and 123done knows that I really am foobar@eyedee.me.

Does that make sense? It really just revolves around a document with two signatures: An email provider's which says "This key is associated with this account," and a user's which says "I am associated with that key."

Re: Introducing Mozilla Persona, An Identity System for the Web

#74

Post by callahad »

_urga wrote: post #72
callahad wrote: post #52

Earlier quoted context omitted.

One of the biggest wins for sites is that we reduce account creation / sign in friction for your users, so you get an awesome, easy flow through your funnel without having to give up ownership of your user data. We also let you reach many, many more people, since you're not forcing users into joining an anointed social network. Everyone has an email address, and people understand what it means to reveal it. Also, the…

"we're really, really easy to implement" "I want to see us become the de facto auth solution" "We also let you reach many, many more people" "but we're also a really nice option to put alongside your social login" Assuming by "we" and "us" you mean Mozilla? Or do you also mean the other major browsers? Why did you write it like that? Why not just say "Persona" instead of "we" and "us"? Surely Persona is much bigger t…

I work for Mozilla on the Persona team, so it feels natural to say "we" to refer to us and the specific implementation we've built, but I see your point as to the feel of that language. Thanks for calling me out. Persona certainly has a scope beyond Mozilla, and its current state owes much to open collaboration.

Re: Introducing Mozilla Persona, An Identity System for the Web

#76

Post by _urga »

callahad wrote: post #74
_urga wrote: post #72

Earlier quoted context omitted.

"we're really, really easy to implement" "I want to see us become the de facto auth solution" "We also let you reach many, many more people" "but we're also a really nice option to put alongside your social login" Assuming by "we" and "us" you mean Mozilla? Or do you also mean the other major browsers? Why did you write it like that? Why not just say "Persona" instead of "we" and "us"? Surely Persona is much bigger t…

I work for Mozilla on the Persona team, so it feels natural to say "we" to refer to us and the specific implementation we've built, but I see your point as to the feel of that language. Thanks for calling me out. Persona certainly has a scope beyond Mozilla, and its current state owes much to open collaboration.

Well done on your efforts and may Mozilla continue to develop into a force for good.

At the moment, however, and Persona is a good example of this, the browser approach to innovation is very much top-down with high-level APIs like UndoManager, WebRTC, IndexedDB rather than bottom-up with low-level APIs like UDP, TCP and POSIX which would trust the developer community to do the rest. Browsers are just not very programmable when compared to platforms like mobile and native.

For example, if the user would be allowed by the browser to empower a web app with raw POSIX, then that would unleash an explosion of databases running in the browser, orders of magnitude better and faster than IndexedDB.

Sadly, this kind of innovation is currently locked up tight inside the various spec committees. For sure, developers can contribute to the mailing lists, but innovation should not be made to go through that kind of process at all in the first place. Innovation on the web needs to be decentralized not centralized. Ideally, Mozilla needs to start making that possible, by providing just the right OS-level APIs and a simple way for users to grant these to Web Apps.

It must be 1984 that one can use a browser, but not be allowed to give raw TCP or UDP or POSIX annointing to web apps that one trusts.

See Tim Berners-Lee on the subject: http://lists.w3.org/Archives/Public/public-webapps/2012JanMa...

Re: Introducing Mozilla Persona, An Identity System for the Web

#77

Post by huragok »

dendory wrote: post #75

For most people, it goes like this: click on the Facebook login button, done. OR, click on personaID, have a new window open, enter email, enter password, go through setup, get back to site. This will be hard for most web users to adopt.

Yeah but once the registration hurdle is jumped, it's click, password, go. Some of us do prefer passwords and multiple identities in this age of homogenized identity.

Re: Introducing Mozilla Persona, An Identity System for the Web

#78

Post by StavrosK »

callahad wrote: post #52
nostromo wrote: post #35

One of the reasons FB and Twitter OAuth became so popular is because they solved a problem for the user (remembering passwords) and also gave the site owner a big carrot (social growth mechanics, more user data). This seems much more one sided -- it's good for the user that doesn't use FB or Twitter but 'meh' for the website. I'm not sure we'll see fast adoption like we have for OAuth.

One of the biggest wins for sites is that we reduce account creation / sign in friction for your users, so you get an awesome, easy flow through your funnel without having to give up ownership of your user data. We also let you reach many, many more people, since you're not forcing users into joining an anointed social network. Everyone has an email address, and people understand what it means to reveal it. Also, the…

I've been using BrowserID/Persona on my sites and I love it. For an example, go to http://www.yourpane.com and click "BrowserID" (never mind the other fields).

It always takes me 5 minutes to integrate, doesn't require me to write any sort of "forgot password" functionality, doesn't require me to worry about storing passwords, and it's generally very easy to work with.

One problem is that users don't know if they're supposed to sign up or sign in, and that a Persona works for other sites, but I think this can be ameliorated with good copy.

Re: Introducing Mozilla Persona, An Identity System for the Web

#79

Post by [deleted] »

egs wrote: post #22
glassx wrote: post #20

I believe that a native implementation has been on their plans from the start, but I haven't heard much about it lately. Here's some mockups: http://people.mozilla.com/%7Efaaborg/files/projects/firefoxA... There's also some work on integrating existing e-mail providers, so you can get instant identities: http://identity.mozilla.com/post/17207734786/id-provider-sup... This is probably the web-thing I'm most excited ab…

A website relying on a single service to serve as a sole identity provider seems replete with risks. That sounds remarkably similar to Microsoft's Passport, an idea that was a non-starter for everyone except Microsoft.

[deleted]

Re: Introducing Mozilla Persona, An Identity System for the Web

#80

Post by stickfigure »

My company is one of the early adopters of Persona/BrowserID. You can see our dual-auth (with Facebook) system here:

https://www.voo.st/

We've been live for several months now in the Real World - our userbase (amateur athletes) is primarily nontechnical. About half of our users choose Persona/BrowserID and half choose Facebook. We were initially concerned about the BID login flow (in particular, the immediate email roundtrip) but it hasn't been a problem and the UX has been refined quite a lot over the last month or two.

For a mass-consumer audience, the combined FB/Persona solution is excellent:

* Facebook unquestionably has the slickest auth experience, even eliminating the followup name/sex/bday questions. However, a significant percentage of the world (possibly > 25%) either Hates Facebook or wants to keep their Facebook account isolated. This is unlikely to change in the near future and could even get worse depending on what sleeping dogs Zuckerberg decides to kick next week. We don't have the option of alienating the FB haters and we wouldn't want to anyways.

* The Persona UX is good and rapidly getting better. BigTent integration with gmail, yahoo, hotmail will bring one-click login to those users. A native experience is being built into browser chrome. All this is coming without me having to write code. It may not be as slick as Facebook, but I like where this train is headed.

* Integration is simple compared to writing a username/password system. The API is incredibly easy to work with. Dual-auth with Facebook is a little more complicated, but a complete Persona-based auth system is a question of hours, not days.

* The fact that identity is just an email address makes it easier to integrate with existing login systems. In our system, you can log into the same account with both Facebook and Persona as long as the emails match. No, email is not a perfect identifier, but even nontechnical users understand it immediately and really - what other option is there? "What email address did I use?" is a lot better than "What weird combination of letters and numbers did I use as a login name?"

* Support on the Mozilla dev-identity list has been fantastic.

We're pretty happy. Honestly, I don't ever see myself writing another username/password login system ever again. Persona is less work for a better UX.

Post reply on HN