Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Mozilla Persona, An Identity System for the Web

mozilla.org

Post reply on HN
Print view View original

121–130 of 131 posts

Re: Introducing Mozilla Persona, An Identity System for the Web

#121

Post by jackalope »

callahad wrote: post #120
uvtc wrote: post #118

Earlier quoted context omitted.

Simply always refer to the Persona password as "Persona password". > In a world where every email provider supports Persona natively, Persona truly is a "no new passwords" authentication system, since it delegates to your provider. I don't know what this means. I won't give Persona my gmail/yahoo-mail email password.

Yeah, it's confusing. If your email provider is supported, your browser talks directly to your email provider, without Mozilla in the middle. We don't want your passwords, honest! :) You can try out the supported email provider workflow by signing up for a dummy account at eyedee.me, and then using that account to sign in at, say, 123done.org.

Wait, if this system works with a dummy account, then a valid email address isn't necessary at all. Any domain can set up an identity provider to support user@domain. Why drag email providers into the discussion, then? It confuses everyone.

Re: Introducing Mozilla Persona, An Identity System for the Web

#122

Post by icebraining »

richardw wrote: post #49
alberich wrote: post #40

Earlier quoted context omitted.

More power to the user is good. Current IdM solutions leak too much data to the service providers/relying parties. What really sucks about all solutions is that once the data has leaked, you gotta trust the service providers not to sell or give your data away.

I've wondered about "data-renting" setups before. For example, rather than giving a company my postal address, give them a token they can send to, and a post fulfilment company delivers to the actual address. If the address moves, the token follows. If I decided to revoke the token, they can't send me mail. Can't do that with all digital data, but you could with e.g. email addresses, cc's, addresses, maybe phone numb…

That's been possible with email addresses for decades. "Free email forwarding" returns plenty of services which give you an address that forwards to your own, and which you can revoke at any time. Personally, I just use a catch-all on my domain, but that requires you to have one.

Same with credit cards: my bank offers a free service where I can set up as many virtual CCs as I want. Until recently they were single payment only, but now you can choose if it's single or multiple.

Forwarding (physical) address exist too, 'though they seem to be mainly targeted at people outside the US who want a address there, and they cost you an extra shipping fee, of course.

Re: Introducing Mozilla Persona, An Identity System for the Web

#123

Post by SCdF »

StavrosK wrote: post #78
callahad wrote: post #52

Earlier quoted context omitted.

One of the biggest wins for sites is that we reduce account creation / sign in friction for your users, so you get an awesome, easy flow through your funnel without having to give up ownership of your user data. We also let you reach many, many more people, since you're not forcing users into joining an anointed social network. Everyone has an email address, and people understand what it means to reveal it. Also, the…

I've been using BrowserID/Persona on my sites and I love it. For an example, go to http://www.yourpane.com and click "BrowserID" (never mind the other fields). It always takes me 5 minutes to integrate, doesn't require me to write any sort of "forgot password" functionality, doesn't require me to worry about storing passwords, and it's generally very easy to work with. One problem is that users don't know if they're…

I have to say (and this is Persona in general, not your site) the password dialogue freaks me out. I click BrowserID on your site, it opens a popup and it asks me to enter my email address, I enter one of them, and then it suddenly expects me to enter a password. Which password? My email password? On a site that isn't my email provider? Or another password? Or an existing password? Or... huh?

I think Persona really needs to sort that out, it's completely non obvious.

Re: Introducing Mozilla Persona, An Identity System for the Web

#124

Post by SCdF »

dabeeeenster wrote: post #92
stickfigure wrote: post #80

My company is one of the early adopters of Persona/BrowserID. You can see our dual-auth (with Facebook) system here: https://www.voo.st/ We've been live for several months now in the Real World - our userbase (amateur athletes) is primarily nontechnical. About half of our users choose Persona/BrowserID and half choose Facebook. We were initially concerned about the BID login flow (in particular, the immediate email r…

OK so I tried to sign up to your site with BID and am pretty confused: I'm using Chrome. Don't know if that affects things. Anyway. Hit Browser ID, asks me for my email address. OK fine, add that in. It then says (quickly, and temporarily as it's an AJAX load), that it's looking up my email provider (Google Apps). It then asks me for my password. So now I'm totally confused. I've not signed up with your site or BID b…

I got confused by this as well. What's happening is that the email address he used already has a Persona account.

If your email address isn't known to Persona it will ask you to create a password, which is cool. Otherwise, it will just bring up a password box with your email address just above it.

I must have used BrowserID once when it was launched, because what the OP got happened to me and I was just as confused. It might not be a problem in the future when it's more well known, but it would be nice for it to have an indication that they want your Persona password, and not your email password.

Re: Introducing Mozilla Persona, An Identity System for the Web

#126

Post by nnethercote »

stickfigure wrote: post #80

My company is one of the early adopters of Persona/BrowserID. You can see our dual-auth (with Facebook) system here: https://www.voo.st/ We've been live for several months now in the Real World - our userbase (amateur athletes) is primarily nontechnical. About half of our users choose Persona/BrowserID and half choose Facebook. We were initially concerned about the BID login flow (in particular, the immediate email r…

Thanks for the detailed description! Nice to see actual experiences rather than speculation.

"a significant percentage of the world (possibly > 25%) either Hates Facebook or wants to keep their Facebook account isolated."

And some people don't even have a Facebook account. Around 6 billion people, last time I heard :)

Re: Introducing Mozilla Persona, An Identity System for the Web

#127

Post by stickfigure »

jackalope wrote: post #121
callahad wrote: post #120

Earlier quoted context omitted.

Yeah, it's confusing. If your email provider is supported, your browser talks directly to your email provider, without Mozilla in the middle. We don't want your passwords, honest! :) You can try out the supported email provider workflow by signing up for a dummy account at eyedee.me, and then using that account to sign in at, say, 123done.org.

Wait, if this system works with a dummy account, then a valid email address isn't necessary at all. Any domain can set up an identity provider to support user@domain. Why drag email providers into the discussion, then? It confuses everyone.

It confuses you because you are a technologist. For 99.99% of the world, user@domain == email address.

"Sign in with your email address" gets the point across. "Sign in with your user identity at a controlling DNS authority" may be more accurate, but will actually confuse everyone.

Re: Introducing Mozilla Persona, An Identity System for the Web

#128

Post by nileshtrivedi »

ciex wrote: post #102
ollysb wrote: post #66

Earlier quoted context omitted.

Here's what would be great for users, being able to sign in with _any_ of their email addresses and passwords. If you could register all of your email addresses and passwords then login would become as easy as entering the first set of details you think of.

That's an interesting idea. How would you go about collecting all these emails first though? Would you tell the user to "just enter all email addresses you ever registered" and then send confirmation emails to all of them? I'd imagine this ending with one or two confirmed email addresses and maybe 3 additional unconfirmed ones. When the user then tries to use one of the unconfirmed addresses to sign in — what do you…

No need to send confirmation emails. Let him login with any email address. If the authentication is successful, you let him in. At this stage, it is a new account so give him an option to link this new account with his existing account with your service. If he had already provided all his email addresses with the first account, there is no need to authenticate one more time. Otherwise, simply authenticate once more with the original email and link the accounts if successful.

Re: Introducing Mozilla Persona, An Identity System for the Web

#129

Post by StavrosK »

SCdF wrote: post #123
StavrosK wrote: post #78

Earlier quoted context omitted.

I've been using BrowserID/Persona on my sites and I love it. For an example, go to http://www.yourpane.com and click "BrowserID" (never mind the other fields). It always takes me 5 minutes to integrate, doesn't require me to write any sort of "forgot password" functionality, doesn't require me to worry about storing passwords, and it's generally very easy to work with. One problem is that users don't know if they're…

I have to say (and this is Persona in general, not your site) the password dialogue freaks me out. I click BrowserID on your site, it opens a popup and it asks me to enter my email address, I enter one of them, and then it suddenly expects me to enter a password. Which password? My email password? On a site that isn't my email provider? Or another password? Or an existing password? Or... huh? I think Persona really n…

I agree with that, the copy needs a bit of an overhaul to make it more straightforward.

Re: Introducing Mozilla Persona, An Identity System for the Web

#130

Post by Flimm »

callahad wrote: post #62
qznc wrote: post #55

I tried the OpenPhoto example. One thing that introduces friction compared to username-password: The first time, I have to create a Persona account. Unfortunatelly, I'm not logged in afterwards. Most sites nowadays log you in right after account creation and just wait for email-verification later. Is that even possible with Persona?

Yeah, that totally sucks, and we're working on it. OpenPhoto is still using our old API, which can't handle post-verification redirects. Our new API does this automatically. Grab a mailinator account and try signing in to http://123done.org . As for creating a Persona account, we're trying to fix that, too. Next month we'll be turning on a feature (codenamed "bigtent") that verifies Gmail, Hotmail, and Yahoo users by…

The webpage should suggest a website other than OpenPhoto, then. First impressions count. (I say this as someone who's really excited by Persona and who wants it to spread as quickly as possible.)
Post reply on HN