Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

81–90 of 207 posts

Re: Announcing the First Beta Release of Persona

#81

Post by ozten »

Johngibb wrote: post #77
callahad wrote: post #30

Earlier quoted context omitted.

That's a great point. Persona doesn't work well in non-JS, non-browser contexts, yet. The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system. So long as you can associate email addresses with accounts on your backend, you can use Persona with the same database you have right now.

Is there any way to use it for say an iPhone app interacting with web services authenticated as a user?

There have been iPhone (pancake) and Android (soup the AMO marketplace) apps and you can find the source in github.

We're working on an iOS SDK, to make this polished and easy.

Patches welcome, get involved!

* mozilla.dev.identity mailing list * #identity on irc.mozilla.org

Re: Announcing the First Beta Release of Persona

#84

Post by juhanima »

ozten wrote: post #23
j_col wrote: post #8

Earlier quoted context omitted.

Why? Genuine question, do you think their security will be better?

The low level protocol - BrowserID - is a federated system, so the "they" in your question can be someone you trust (and Mozilla isn't hardcoded) You can use any browser and if it has native support, it will do the client side crypto. It will store your public/private keys in the client. You can use any Identity provider (email provider probably) and if they have native support, they will store you password and do 2…

One more correction. The identity/e-mail provider does not store your password, it merely signs your key for which it can use whatever authentication it wishes. Most probably the same user-id/password combo you use to read your mail, but the BrowserID does not dictate that, it is up to the provider to decide.

After that the identity provider just gets requests from services that do not know its public key yet, but typically it is asked only once per service as the key is stored in a local cache. And even when the key is asked, the provider cannot know for which email verification address it is needed.

All in all I think this is a great system. It puts a lot of trust in the e-mail provider, but I think that's all right as the provider already has full control of your personal e-mail anyway and hence is trusted by default.

Re: Announcing the First Beta Release of Persona

#85

Post by JoshTriplett »

DASD wrote: post #63
callahad wrote: post #54

Earlier quoted context omitted.

> Are there any websites with implementations that don't prompt directly for Mozilla's site That's the OpenID model. BrowserID works somewhat differently. Your ID is an email address, so your provider is that email's domain. Because few domains support it directly yet, Mozilla operates an optional, centralized authority that can issue credentials to other users. But you don't have to use that if you add support on yo…

Are there any browsers that currently implement BrowserID? I just fired up Firefox 15 and still get the pop-up for login.persona. Or links to near future impementations? Thanks for you and otzen for shedding light on all of this.

Mozilla has a prototype addon that implements it.

Re: Announcing the First Beta Release of Persona

#86

Post by notatoad »

Osiris wrote: post #60

I just tried it on the Times Crossword page. The workflow is really simple and elegant. I put in my email address. It took a second to determine there was no Persona account, then asked for me to create a password. After that, I clicked on an authorization link in my email account and as soon as I did that it immediately logged me in. I clicked Log out and back in again and it immediately recognized me and logged me…

It does seem a pretty elegant way to log in, the only concern i have is that it's kind of unclear what password i needed to use to login. I had already created a browserID password at some point in the past, so when i went to the times crossword and clicked sign in, i was prompted for a password. my first thought was maybe i had already signed up for the times crossword, so i tried the password i probably would have used to sign up for a site like that. nope, but it said "authenticating with your email provider". So then i tried my email password, thinking maybe it was integrating with my google account. nope. Third try was the password i had used to sign up for persona.

Maybe in the future, if this sees wide adoption, they can get away with just putting some mozilla branding in the corner, but for now there should really be some explanatory text on the login window telling you that you need to enter the password you created for mozilla persona, or this is just going to confuse users.

Re: Announcing the First Beta Release of Persona

#87

Post by JoshTriplett »

DASD wrote: post #43
binarymax wrote: post #32

Have been messing around with BrowserID since it first went public last year (with a node.js backend) and I love it. Its so much more straightforward to implement than oauth and openid, and the fact that it's tied to your email address is perfect. I'm definitely going to be using it as my primary auth system going forward. Great job Mozilla!

Do you have examples of sites that don't use Persona as the BrowserID implementation? I'd like to see how sites are handling the user prompt when there are going to be alternative providers to Mozilla's Persona service.

Doesn't work that way; Mozilla's Persona service just serves as a shim for browsers without native support for BrowserID. On browsers with native support, Mozilla's server won't get involved at all.

Re: Announcing the First Beta Release of Persona

#88

Post by JoshTriplett »

latchkey wrote: post #71
Ygg2 wrote: post #68

This is just great. I do hope this replaces Facebook connect as authentication provider, though I doubt it since getting all that user info is priceless for most sites using Facebook connect. It looks very lovely.

I don't think it'll replace Facebook, it'll just be an alternative to it. We've integrated both Persona and Facebook into our site and it works great. For my business, we need more personal details about each person that we get by default with Facebook (name/age/sex). So, that integration will always be cleaner than Persona because it is just a few clicks. We've been working with BID/Persona for a while now (we're li…

I've seen some preliminary discussions of linking personal information to a Persona and optionally supplying it to the site at login time. If you have a need for that, you should chat with the Persona/BrowserID developers.

Re: Announcing the First Beta Release of Persona

#89

Post by kuida0r3 »

petepete wrote: post #16

I thought [1] Mozilla Personas were themes? [1] http://www.getpersonas.com/en-US/ Evidently I need to pay more attention.

Speaking of themes, how easy is it to customize the look&feel of the login prompt? It may be odd for the user to see an entirely different site when they try to sign-in to a site.
Post reply on HN