Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Mozilla Persona, An Identity System for the Web

mozilla.org

Post reply on HN
Print view View original

91–100 of 131 posts

Re: Introducing Mozilla Persona, An Identity System for the Web

#91

Post by Flimm »

Mozilla Persona (AKA BrowserID) is exciting stuff. However, it doesn't seem to have changed much since the last time it hit Hacker News [0].

There are websites that have chosen Persona as an authentication method. We now need to see the following two pieces implemented:

- It needs to be implemented in the browser's GUI, like in this old screenshot [1]. People will be able to see the usability and security benefits of having a standardised way to log in that's built-in into the browser. Could we at least have a Firefox extension or a nightly build of Firefox that does this?

- At least one email provider needs to be a Persona "ID provider", which would eliminate the need to create a Persona password and to click on a link in an email. My guess is that getting Gmail to support this would be slow work, why not try persuading smaller email providers like Fastmail to be the first to openly support Persona?

Fortunately, Persona does work even without these two pieces, using fall-back servers and a shim. But most of the benefits of Persona are only valid once the browser and the email provider deliberately support it.

[0] - https://news.ycombinator.com/item?id=2764824

[1] - http://i50.tinypic.com/2ptyv80.jpg

Re: Introducing Mozilla Persona, An Identity System for the Web

#92

Post by dabeeeenster »

stickfigure wrote: post #80

My company is one of the early adopters of Persona/BrowserID. You can see our dual-auth (with Facebook) system here: https://www.voo.st/ We've been live for several months now in the Real World - our userbase (amateur athletes) is primarily nontechnical. About half of our users choose Persona/BrowserID and half choose Facebook. We were initially concerned about the BID login flow (in particular, the immediate email r…

OK so I tried to sign up to your site with BID and am pretty confused:

I'm using Chrome. Don't know if that affects things. Anyway.

Hit Browser ID, asks me for my email address. OK fine, add that in. It then says (quickly, and temporarily as it's an AJAX load), that it's looking up my email provider (Google Apps). It then asks me for my password.

So now I'm totally confused. I've not signed up with your site or BID before, so I dont know if it wants my GAPPS password or a new password. I don't feel like I want to put in my GApps password, as there is no Google branding anywhere and the URL is not Google.

So I try putting in my GAPPS password, because I use 2 factor, and it doesn't work. Most likely because I use 2 factor, and I can't authenticate with just my standard GAPPS password.

So it failed. I guess I'm an edge case as most people don't enable 2-factor on their Google account, but I was still really confused when it asked for my email password.

EDIT:

Same thing happened with Firefox version whatever the latest one is.

I'd say it's completely confusing, all in all.

Re: Introducing Mozilla Persona, An Identity System for the Web

#93

Post by jstalin »

dabeeeenster wrote: post #92
stickfigure wrote: post #80

My company is one of the early adopters of Persona/BrowserID. You can see our dual-auth (with Facebook) system here: https://www.voo.st/ We've been live for several months now in the Real World - our userbase (amateur athletes) is primarily nontechnical. About half of our users choose Persona/BrowserID and half choose Facebook. We were initially concerned about the BID login flow (in particular, the immediate email r…

OK so I tried to sign up to your site with BID and am pretty confused: I'm using Chrome. Don't know if that affects things. Anyway. Hit Browser ID, asks me for my email address. OK fine, add that in. It then says (quickly, and temporarily as it's an AJAX load), that it's looking up my email provider (Google Apps). It then asks me for my password. So now I'm totally confused. I've not signed up with your site or BID b…

I just tried it and once I entered my email address, it then asked: "Next, choose a new password you'll use when you sign in with Persona."

Not sure why you're confused.

Re: Introducing Mozilla Persona, An Identity System for the Web

#94

Post by nodata »

dabeeeenster wrote: post #92
stickfigure wrote: post #80

My company is one of the early adopters of Persona/BrowserID. You can see our dual-auth (with Facebook) system here: https://www.voo.st/ We've been live for several months now in the Real World - our userbase (amateur athletes) is primarily nontechnical. About half of our users choose Persona/BrowserID and half choose Facebook. We were initially concerned about the BID login flow (in particular, the immediate email r…

OK so I tried to sign up to your site with BID and am pretty confused: I'm using Chrome. Don't know if that affects things. Anyway. Hit Browser ID, asks me for my email address. OK fine, add that in. It then says (quickly, and temporarily as it's an AJAX load), that it's looking up my email provider (Google Apps). It then asks me for my password. So now I'm totally confused. I've not signed up with your site or BID b…

> It then asks me for my password.

It asks you to create a password. (admittedly it could be a clearer what you are creating a password for, i.e. persona.org)

Re: Introducing Mozilla Persona, An Identity System for the Web

#95

Post by st3fan »

znq wrote: post #90
znq wrote: post #89

What about native mobile apps? Is it possible to easily use Browser ID for native iOS and Android apps? Or is it just too much of a hassle getting the information out of the web view?

I just found this https://github.com/mozilla/browserid-ios however haven't tried it out, yet.

Let me know if you need help with that code or if I can answer any questions in general about Persona integration on iOS.

You can contact me through Github or through the project's issue tracker.

Re: Introducing Mozilla Persona, An Identity System for the Web

#96

Post by mathijs »

stickfigure wrote: post #80

My company is one of the early adopters of Persona/BrowserID. You can see our dual-auth (with Facebook) system here: https://www.voo.st/ We've been live for several months now in the Real World - our userbase (amateur athletes) is primarily nontechnical. About half of our users choose Persona/BrowserID and half choose Facebook. We were initially concerned about the BID login flow (in particular, the immediate email r…

Coincidentally I've asked a question about login system just two days ago (http://news.ycombinator.com/item?id=4225270) where I mentioned BrowserID as one of the options. Apparently I hadn't properly checked out BrowserID/Persona because I thought of it as an OpenID replacement, not an email+password login replacement.

I'm positively surprised to see that you found a 50-50 balance between BrowserID and Facebook; I expected a lower pickup rate on BrowserID. So, I guess I've decided what login system to use for my project(s).

Thanks for the information.

Re: Introducing Mozilla Persona, An Identity System for the Web

#97

Post by rfk »

Flimm wrote: post #87
codinghorror wrote: post #81

Earlier quoted context omitted.

I'm not a fan of the way this requires me to set a password for Persona. I'd rather just have one password, my email (gmail) password, and use that.

That's the plan. Mozilla are just waiting on Gmail to cooperate and implement Persona on their side. In an ideal situation, both your browser (eg: Firefox) and your email provider (eg: Gmail) would support Persona. In that case, you don't have to click on any links to prove your email address, you don't have to create a new password, you don't have to trust Mozilla's servers to store a hashed version of your password…

In the case of gmail, they're note even waiting. There is active development on a gmail-to-persona proxy so that you can authenticate with just your gmail password:

    https://github.com/mozilla/browserid-bigtent

Re: Introducing Mozilla Persona, An Identity System for the Web

#98

Post by jackalope »

As an email provider for multiple domains, I have a hard time seeing what this actually has to do with current email infrastructure. It seems the only time the email address is used is to support a fallback notification, in which case many of the claimed benefits of BrowserID are lost (as you've fallen back to a single centralized identity provider).

Correct me if I'm wrong, but BrowserID/Persona assumes that for a user@example.org identifier there is a corresponding https://example.org. That's not true for most of the domains I support. In many cases, example.org doesn't even resolve to to an IP address and web servers are only run on subdomains (and not all subdomains have HTTP servers). Does BrowserID/Persona support a DNS mechanism to discover the location of the required HTTPS web server, similar to an MX record?

The opposite problem is where a user has a single email account with multiple valid addresses at multiple domains, such as user@example.org, user@foo.example.org, user@bar.example.org, etc. I work for an organization approaching a million users where this is the case and isn't going to change anytime soon. Once again, you can't assume there is an identity provider running on a web server at all of these domains. Is there a DNS-based method of discovery to solve this problem?

Does BrowserID/Persona allow users to authenticate against the same system they use when accessing email? If so, why does the OpenPhoto example ask for a password? I thought the whole point was that users avoid sharing credentials with sites. That implementation is very confusing and looks like a scary phishing attack.

Finally, it's not very clear what I should expect in the way of connections from other computers, whether I'm running an identity provider or not. This is crucial information to avoid tripping an intrusion detection system (IDS) during unexpected connections, especially from my own users.

Re: Introducing Mozilla Persona, An Identity System for the Web

#99

Post by jackalope »

jstalin wrote: post #93
dabeeeenster wrote: post #92

Earlier quoted context omitted.

OK so I tried to sign up to your site with BID and am pretty confused: I'm using Chrome. Don't know if that affects things. Anyway. Hit Browser ID, asks me for my email address. OK fine, add that in. It then says (quickly, and temporarily as it's an AJAX load), that it's looking up my email provider (Google Apps). It then asks me for my password. So now I'm totally confused. I've not signed up with your site or BID b…

I just tried it and once I entered my email address, it then asked: "Next, choose a new password you'll use when you sign in with Persona." Not sure why you're confused.

From https://developer.mozilla.org/en/BrowserID/

"Website operators still get a verified email address for their users, and users only have to remember a single password. BrowserID is also intuitive, since email addresses are commonly understood to be associated with identities."

Mozilla is really stressing the "email address/single password" concept. If they really mean "email address/separate dedicated Persona password" then they should make this clear.

Re: Introducing Mozilla Persona, An Identity System for the Web

#100

Post by jackalope »

callahad wrote: post #73
carlesfe wrote: post #69

Okay, I have read the specs, the FAQ, the diagrams, and tried some examples, but I can't really understand how it works. Could somebody do a quick summary for me? I would appreciate it very much.

I really, really need to post something like this on our blog soon. Watch http://identity.mozilla.com/ for something more polished next week or so. I'd also strongly urge you to just try implementing it on a site. It'll literally take less than 30 lines each of javascript on the frontend and python on the backend, and it'll really demystify the flow between the site and the user. As an analogy, we work really similar…

I appreciate that you've set up real domains for demonstration purposes, but wouldn't it be better to transfer ownership to Mozilla so they show up in the whois record? I don't mean to nitpick, but details matter when trying to promote such a sensitive protocol. There's no way I'm going to try out an authentication demo at a random privately owned domain.
Post reply on HN