101–110 of 131 posts
Now I'm wondering whether to use Persona or build it myself from scratch.
Earlier quoted context omitted.
Wait, it relies on email address? ( quickly reads up on it. ) ... and it doesn't have user identifiers other than the email address? That is not reasonable: normal people (as in, people who don't know much about what they are doing with computers) tend to have piles and piles of email addresses, none of which hold any canonical weight to them: they have email addresses from ISPs, from schools, from work, and they oft…
Here's what would be great for users, being able to sign in with _any_ of their email addresses and passwords. If you could register all of your email addresses and passwords then login would become as easy as entering the first set of details you think of.
Would you tell the user to "just enter all email addresses you ever registered" and then send confirmation emails to all of them? I'd imagine this ending with one or two confirmed email addresses and maybe 3 additional unconfirmed ones.
When the user then tries to use one of the unconfirmed addresses to sign in — what do you do? Refuse log in because the address is not confirmed? Send another confirmation email to that account and ask the user to confirm it? List those confirmed addresses in the account and ask the user if he wants to sign in with one of them?
Earlier quoted context omitted.
we had dozens of search engines when google came out. someone just hasn't got it right yet.
And yet some would argue that Google has begun to get search wrong. What happens when the "right" identity solution does the same?
Earlier quoted context omitted.
I really, really need to post something like this on our blog soon. Watch http://identity.mozilla.com/ for something more polished next week or so. I'd also strongly urge you to just try implementing it on a site. It'll literally take less than 30 lines each of javascript on the frontend and python on the backend, and it'll really demystify the flow between the site and the user. As an analogy, we work really similar…
So in your example, eyedee.me is your email provider, right? I made a Persona account just now. All I saw happening was that I clicked on a link in a confirmation email. Was there also communication between mozilla and my email provider? (I am with a small ISP who is serving my emails - I have my own domain, so my email address is sthg like me@myname.com). What went on behind the curtains, if anything, and why did it…
That's the great thing about Persona: it works even when email providers don't support it. However, it works best when they do.
Mozilla Persona (AKA BrowserID) is exciting stuff. However, it doesn't seem to have changed much since the last time it hit Hacker News [0]. There are websites that have chosen Persona as an authentication method. We now need to see the following two pieces implemented: - It needs to be implemented in the browser's GUI, like in this old screenshot [1]. People will be able to see the usability and security benefits of…
For most people, it goes like this: click on the Facebook login button, done. OR, click on personaID, have a new window open, enter email, enter password, go through setup, get back to site. This will be hard for most web users to adopt.
However, I'm not arguing against that a lot of people probably _are_ already logged into Facebook.
Earlier quoted context omitted.
Not to mention that email is really unsecure. A password reset link will be sent as plaintext. Is there at least a way to change the email addredd associated with an account? I can't see anything about that.
What password reset link? :) If you're using an email provider with native support for Persona, the only password you have is with your email provider.
Honest question: As an app builder, why would you use this instead of facebook? Many more users are going to have Facebook logins already, and it provides social information that may be useful to your app. (Hoping to hear answers other than the dev-centric 'I don't like facebook')
I don't think "I don't like Facebook" is limited to dev-centric populations. I know people who have nothing to do with software development who refuse to get Facebook accounts. And then there are the folks who use Facebook but refuse the install any apps (about half of my Facebook friends fall into this category). You need to offer something other than Facebook auth if you care about having the broadest reach possibl…
Often the comments we want to write on websites have absolutely no business being concurrently posted back to FB. People like contributing without disclosing or offering their FB identities or sharing every micro-activity. And fair enough.
Not everyone is comfortable with fronting up to an unfamiliar website and saying "hi, I'm John Smith. Here's my comment about religious persecution in South Asia. And don't forget to Like me on Facebook. Sign up now to connect and share with the people in you life"...
In other words, the less clunky FB social plugin mess on websites the better. I hope Persona goes well.
For most people, it goes like this: click on the Facebook login button, done. OR, click on personaID, have a new window open, enter email, enter password, go through setup, get back to site. This will be hard for most web users to adopt.