I thought [1] Mozilla Personas were themes? [1] http://www.getpersonas.com/en-US/ Evidently I need to pay more attention.
Announcing the First Beta Release of Persona
21–30 of 207 posts
Re: Announcing the First Beta Release of Persona
#22I’m not in love with Persona because it puts everyone’s eggs in one basket. I like OpenID because it works like email — choose whichever provider you fancy. If one goes sour or a nicer one pops up, websites don’t have to add support it before you can use it. And, websites can choose to expose nice “sign in with X” buttons instead of making you type in your OpenID address to sign in. On the other hand, I realize that…
> I like OpenID because it works like email — choose whichever provider you fancy.
Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know. :) (To be fair, OpenID Connect is working on fixing that problem)
> I just hope those advances turn into an open protocol someday.
You're in luck! :) The protocol is open and completely decentralized: https://github.com/mozilla/id-specs/blob/prod/browserid/inde...
Mozilla operates a few centralized services to solve the chicken-and-egg problem while bootstrapping, but they're completely optional, and they automatically fall away when a browser or email provider have native support for the BrowserID protocol.
Re: Announcing the First Beta Release of Persona
#23One reason this looks good to me is that I trust Mozilla more than most organizations.
Why? Genuine question, do you think their security will be better?
The low level protocol - BrowserID - is a federated system, so the "they" in your question can be someone you trust (and Mozilla isn't hardcoded)
You can use any browser and if it has native support, it will do the client side crypto. It will store your public/private keys in the client.
You can use any Identity provider (email provider probably) and if they have native support, they will store you password and do 2 factor auth or whatever.
This removes websites (relaying parties) from the password storage business. All they get is an email address and a way to cryptographically check to see that you owned it.
The crypto that powers the BrowserID protocol is an open standard, so you can vet it. It's been designed by crypto experts in an open forum.
Re: Announcing the First Beta Release of Persona
#24the "check the documentation" link goes to https://developer.mozilla.org/it/Persona which 404s for me. Maybe not redirecting based on user location by default is a good idea.
Odd it worked for me and redirected to https://developer.mozilla.org/en-US/docs/Persona
Re: Announcing the First Beta Release of Persona
#25I’m not in love with Persona because it puts everyone’s eggs in one basket. I like OpenID because it works like email — choose whichever provider you fancy. If one goes sour or a nicer one pops up, websites don’t have to add support it before you can use it. And, websites can choose to expose nice “sign in with X” buttons instead of making you type in your OpenID address to sign in. On the other hand, I realize that…
What? You didn't even watch the video?
It's decentralized. It's an open protocol based on an older open protocol.
Re: Announcing the First Beta Release of Persona
#26I’m not in love with Persona because it puts everyone’s eggs in one basket. I like OpenID because it works like email — choose whichever provider you fancy. If one goes sour or a nicer one pops up, websites don’t have to add support it before you can use it. And, websites can choose to expose nice “sign in with X” buttons instead of making you type in your OpenID address to sign in. On the other hand, I realize that…
[deleted]
Re: Announcing the First Beta Release of Persona
#27Earlier quoted context omitted.
The system is designed to allow your email provider or another Identity Provider that you trust, to store your password instead of Mozilla. Your identity provider just has to implement the BrowserID protocol https://developer.mozilla.org/en-US/docs/Persona/Identity_Pr...
So what happens if my email account gets hacked? Won't this compromise all my accounts then?
This problem exists today. I can do "forgot my password" on many sites and owning your email account can change the passwords and log in to them.
Persona doesn't attempt to solve this existing problem.
Re: Announcing the First Beta Release of Persona
#28I can see why they're calling it a beta release. The UX during creating a profile on developer.mozilla.org has several rough edges. For example:
1. Clicked "Sign In" and successfully create a Persona account.
2. Created a profile on MDN, with the wrong user name (oops).
3. Cancelled my Persona account in a separate tab.
Also, LastPass doesn't seem to play well with Persona, but I'm hopeful it will in the future.
Re: Announcing the First Beta Release of Persona
#29Earlier quoted context omitted.
The system is designed to allow your email provider or another Identity Provider that you trust, to store your password instead of Mozilla. Your identity provider just has to implement the BrowserID protocol https://developer.mozilla.org/en-US/docs/Persona/Identity_Pr...
So what happens if my email account gets hacked? Won't this compromise all my accounts then?
[deleted]
Re: Announcing the First Beta Release of Persona
#30I think the general idea of building better auth into browsers is a wonderful and highly necessary development. However, this implementation will completely fail if the user has JavaScript blocked and there is no fallback. And yes, this is a real issue. (Though I will probably get a lot of replies that try to dismiss it in various ways.)
That's a great point. Persona doesn't work well in non-JS, non-browser contexts, yet. The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system.
So long as you can associate email addresses with accounts on your backend, you can use Persona with the same database you have right now.