Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

51–60 of 207 posts

Re: Announcing the First Beta Release of Persona

#51

Post by ozten »

DASD wrote: post #45
ozten wrote: post #41

Earlier quoted context omitted.

Go to https://eyedee.me and create an DASD account Go to http://crossword.thetimes.co.uk/ - this is a non-Mozilla RP Enter DASD@eyedee.com - This is a Primary Identity provider, source at [1] So you see there is no BrowserID provider choosing screen, it's naturally part of the flow. you enter DASD@eyedee.com and the system checks for support and delegates to eyedee.com. [1] https://github.com/mozilla/eyedee.me

Thanks for posting the process flow. So ( https://login.persona.org/sign_in ) will always be shown? If so, then how is this truly decentralized with my privacy concerns mentioned above?

If you had a browser, say Opera, with native support for the BrowserID protocol, then you would not see login.persona.org. No requests would be made to a Mozilla server.

login.persona.org is two things:

1) A JavaScript shim for cross platform support (Opera + BrowserID support would avoid this)

2) A Fallback Identity provider (eyedee.me avoids this)

Re: Announcing the First Beta Release of Persona

#52

Post by waffle_ss »

callahad wrote: post #22
Sidnicious wrote: post #19

I’m not in love with Persona because it puts everyone’s eggs in one basket. I like OpenID because it works like email — choose whichever provider you fancy. If one goes sour or a nicer one pops up, websites don’t have to add support it before you can use it. And, websites can choose to expose nice “sign in with X” buttons instead of making you type in your OpenID address to sign in. On the other hand, I realize that…

> I like OpenID because it works like email — choose whichever provider you fancy. Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know. :) (To be fair, OpenID Connect is working on fixing that problem) > I just hope tho…

> Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know.

OpenID URLs need not be opaque - I use my regular .com URL as my OpenID, and have a stub in the HTML of /index.html that points to the provider that I want to use when I authenticate (which I can change any time I please). It's called delegation. I think using DNS as an identifier is better than email (as that's kind of what it was built for), but not a viable option for the masses. Mozilla did a good job with Persona.

Re: Announcing the First Beta Release of Persona

#53

Post by ww520 »

Sidnicious wrote: post #19

I’m not in love with Persona because it puts everyone’s eggs in one basket. I like OpenID because it works like email — choose whichever provider you fancy. If one goes sour or a nicer one pops up, websites don’t have to add support it before you can use it. And, websites can choose to expose nice “sign in with X” buttons instead of making you type in your OpenID address to sign in. On the other hand, I realize that…

I believe different providers other than Mozilla can host it, and you can use one of them instead of Mozilla. That works just like email hosting. Persona is an API-level protocol. Whoever implements it can host it. It just means the end users need to maintain a separate password entry with the other hosting provider.

Re: Announcing the First Beta Release of Persona

#54

Post by callahad »

DASD wrote: post #37

Are there any websites with implementations that don't prompt directly for Mozilla's site(i.e. asking for your preferred BrowserID provider)? I'd like to see how clunky the interface becomes when there are more providers(such as if I want to become my own provider) than just Mozilla. Is the user then confused by asking for a provider..ala OpenID? Am I correct in presuming Persona is an implementation of BrowserID? I'…

> Are there any websites with implementations that don't prompt directly for Mozilla's site

That's the OpenID model. BrowserID works somewhat differently. Your ID is an email address, so your provider is that email's domain. Because few domains support it directly yet, Mozilla operates an optional, centralized authority that can issue credentials to other users. But you don't have to use that if you add support on your own domain.

After that, the UI is also provided by Mozilla's cross-browser JS shim, but it's just a polyfill for `navigator.id.`. If your browser has native support for those methods (Firefox will, soon), then Mozilla's UI is completely uninvolved.

Basically, we're starting with a single, optional point of centralization: login.persona.org. As native support comes online from various domains and browsers, our central fallback will automatically drop out of the picture.

> Am I correct in presuming Persona is an implementation of BrowserID?*

Yep! BrowserID is the protocol, Persona is Mozilla's cross-browser UI and optional centralized services. It's kind of like how Google Login is really OpenID/OAuth under the hood, but more meta.

> "As part of the normal operation of the Persona service, Mozilla will retain a log of which sites you have disclosed your email to."

Yeah, that line sounds super bad. IIRC, it's a relic of a previous design of the cross-browser shim that needs to be removed. I'll follow up with Mozilla's legal folks.

Re: Announcing the First Beta Release of Persona

#55

Post by seanmonstar »

waffle_ss wrote: post #52
callahad wrote: post #22

Earlier quoted context omitted.

> I like OpenID because it works like email — choose whichever provider you fancy. Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know. :) (To be fair, OpenID Connect is working on fixing that problem) > I just hope tho…

> Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know. OpenID URLs need not be opaque - I use my regular .com URL as my OpenID, and have a stub in the HTML of /index.html that points to the provider that I want to use w…

Not everyone supports that though. I do the same thing for OpenID, and sites that "support" open-id like The Verge cannot figure out mine in that way.

Re: Announcing the First Beta Release of Persona

#56

Post by ozten »

sandGorgon wrote: post #48

What is the self-hosted equivalent of this ? I have been struggling with this problem quite a bit. I have a bunch of web apps which are quite a bit different - off the shelf forum software, wordpress, custom code, etc. - and I want to tie them all together using a single signon. What should I be using ? I distrust myself enough to know that I would prefer not rolling my own security protocol. I know that there are so…

Which pieces do you care about being self-hosted?

If you use Persona on all your sites, it feels very much like SSO.

I use the browserid plugin (http://wordpress.org/extend/plugins/browserid/) on my personal Wordpress site.

We actually had an SSO project based on CAS v2, which we killed because Persona was a better solution.

Re: Announcing the First Beta Release of Persona

#58

Post by forgotusername »

I really want to believe in something like this, however you'd getting much better traction by explaining a few key details:

* What the hell does the JS assertion object look like?

* How do I run an independent service?

* In a single page, walk me through the steps to integrate?

Videos, dodgy music, overenthusiastic PFYs appeal to me much less than good documentation

Re: Announcing the First Beta Release of Persona

#59

Post by DASD »

ozten wrote: post #51
DASD wrote: post #45

Earlier quoted context omitted.

Thanks for posting the process flow. So ( https://login.persona.org/sign_in ) will always be shown? If so, then how is this truly decentralized with my privacy concerns mentioned above?

If you had a browser, say Opera, with native support for the BrowserID protocol, then you would not see login.persona.org. No requests would be made to a Mozilla server. login.persona.org is two things: 1) A JavaScript shim for cross platform support (Opera + BrowserID support would avoid this) 2) A Fallback Identity provider (eyedee.me avoids this)

And with your explanation, all becomes clear. Thanks for that and now I can understand how slick this should become.

Re: Announcing the First Beta Release of Persona

#60

Post by Osiris »

I just tried it on the Times Crossword page. The workflow is really simple and elegant. I put in my email address. It took a second to determine there was no Persona account, then asked for me to create a password. After that, I clicked on an authorization link in my email account and as soon as I did that it immediately logged me in. I clicked Log out and back in again and it immediately recognized me and logged me in.

This is really what I was hoping to see with OpenID when it came out, but the process to set up an account and get started is much more cumbersome.

I look forward to seeing native support for Persona in browsers.

Post reply on HN