Perhaps making signing in to websites really simple, in a way that verifies the users email address to the site, isn't a good idea. Once it's widely adopted spammers will start using it.
Announcing the First Beta Release of Persona
61–70 of 207 posts
Re: Announcing the First Beta Release of Persona
#62My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account.
Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers.
I've been looking for ways to reduce the risk associated with losing access to my email account, should that ever happen. Yet for all its benefits, Persona still places yet more importance on protecting my single email password.
Re: Announcing the First Beta Release of Persona
#63Are there any websites with implementations that don't prompt directly for Mozilla's site(i.e. asking for your preferred BrowserID provider)? I'd like to see how clunky the interface becomes when there are more providers(such as if I want to become my own provider) than just Mozilla. Is the user then confused by asking for a provider..ala OpenID? Am I correct in presuming Persona is an implementation of BrowserID? I'…
> Are there any websites with implementations that don't prompt directly for Mozilla's site That's the OpenID model. BrowserID works somewhat differently. Your ID is an email address, so your provider is that email's domain. Because few domains support it directly yet, Mozilla operates an optional, centralized authority that can issue credentials to other users. But you don't have to use that if you add support on yo…
Are there any browsers that currently implement BrowserID? I just fired up Firefox 15 and still get the pop-up for login.persona. Or links to near future impementations?
Thanks for you and otzen for shedding light on all of this.
Re: Announcing the First Beta Release of Persona
#64I really want to believe in something like this, however you'd getting much better traction by explaining a few key details: * What the hell does the JS assertion object look like? * How do I run an independent service? * In a single page, walk me through the steps to integrate? Videos, dodgy music, overenthusiastic PFYs appeal to me much less than good documentation
> What the hell does the JS assertion object look like?
Needs to be updated a little bit, but check out the spec: https://github.com/mozilla/id-specs/blob/prod/browserid/inde...
Note: You don't have to implement this yourself! You can POST assertions to https://verifier.login.persona.org/verify instead, and we'll return a JSON blob that lets you know if it was valid or not. Or you could run that same verifier locally (it's a stateless node.js server, code's on github in the mozilla/browserid repo). The exact data formats are still in flux (waiting / hoping for IETF standardization around some crypto things), so we don't recommend doing verification yourself just yet, unless you run our node.js verifier and frequently update it. We'll get that stuff locked down in one of the next Beta releases.
> How do I run an independent service?
https://developer.mozilla.org/en-US/docs/Persona/Implementin...
> In a single page, walk me through the steps to integrate?
https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup
Re: Announcing the First Beta Release of Persona
#65My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…
You could say the same about any traditional username/password signup that sends a confirmation email and allows you to reply to an email to reset your password. Ultimately, that's just relying on the security of your email, too. So while you are correct that Persona doesn't solve that problem, it doesn't make that problem any worse compared to the default option of an email-confirmed username and password.
Re: Announcing the First Beta Release of Persona
#66I wonder if this will be developed into a standard, or whether Mozilla will have to be the only ones operating this service.
BrowserID Protocol Spec
https://github.com/mozilla/id-specs/blob/prod/browserid/inde...
Re: Announcing the First Beta Release of Persona
#67Earlier quoted context omitted.
> Are there any websites with implementations that don't prompt directly for Mozilla's site That's the OpenID model. BrowserID works somewhat differently. Your ID is an email address, so your provider is that email's domain. Because few domains support it directly yet, Mozilla operates an optional, centralized authority that can issue credentials to other users. But you don't have to use that if you add support on yo…
Are there any browsers that currently implement BrowserID? I just fired up Firefox 15 and still get the pop-up for login.persona. Or links to near future impementations? Thanks for you and otzen for shedding light on all of this.
I believe Firefox OS will have the first enabled-by-default, user-visible implementation around Q1 next year. Bits are starting to land in Firefox, but they're super, super experimental and not totally functional yet.
Re: Announcing the First Beta Release of Persona
#68This is just great. I do hope this replaces Facebook connect as authentication provider, though I doubt it since getting all that user info is priceless for most sites using Facebook connect.
It looks very lovely.
Re: Announcing the First Beta Release of Persona
#69Earlier quoted context omitted.
Thanks for posting the process flow. So ( https://login.persona.org/sign_in ) will always be shown? If so, then how is this truly decentralized with my privacy concerns mentioned above?
If you had a browser, say Opera, with native support for the BrowserID protocol, then you would not see login.persona.org. No requests would be made to a Mozilla server. login.persona.org is two things: 1) A JavaScript shim for cross platform support (Opera + BrowserID support would avoid this) 2) A Fallback Identity provider (eyedee.me avoids this)
Realistically though the fallback will need to be kept around for a long time.
Re: Announcing the First Beta Release of Persona
#70Earlier quoted context omitted.
It's decentralized public-key based authentication, wrapped up in an extremely user- and dev-friendly package. Francois Marier did a good job of explaining it at Kiwi PyCon 2012: https://www.youtube.com/watch?v=iZBTc7iEkQY (Think OpenID, but easier to use, easier to implement, and with better privacy protection.) In brief: instead of a username and password at login, you get a user's email address and cryptographical…
>No more password column in your database... Who has liability when a user of mine says their account got hacked? The email provider? My site? Mozilla? If one of my users has $100 go missing from their account, then they are going to expect me to replace it, not the email provider, not mozilla. I don't like the idea of shifting security to a outside platform, because I still retain all the liability when things go ba…
Sites that deal with financial transactions are almost always 5-10 years behind on the adoption curve; of course they will be reluctant to use Persona. And that's not unreasonable.