Earlier quoted context omitted.
Used to be: http://identity.mozilla.com/post/18038609895/introducing-moz...
I told them that they need to rename it with a 301 several weeks ago. They haven't. sigh
[deleted]
Announcing the First Beta Release of Persona
91–100 of 207 posts
Re: Announcing the First Beta Release of Persona
#92Earlier quoted context omitted.
It's decentralized public-key based authentication, wrapped up in an extremely user- and dev-friendly package. Francois Marier did a good job of explaining it at Kiwi PyCon 2012: https://www.youtube.com/watch?v=iZBTc7iEkQY (Think OpenID, but easier to use, easier to implement, and with better privacy protection.) In brief: instead of a username and password at login, you get a user's email address and cryptographical…
>No more password column in your database... Who has liability when a user of mine says their account got hacked? The email provider? My site? Mozilla? If one of my users has $100 go missing from their account, then they are going to expect me to replace it, not the email provider, not mozilla. I don't like the idea of shifting security to a outside platform, because I still retain all the liability when things go ba…
How can any website protect a user against key loggers, spyware or any other form of a compromised client machine? If the client machine is compromised, any login method is broken.
Re: Announcing the First Beta Release of Persona
#93If I understand correctly, the browser stores a certificate that proves you own your email address. These certificates are only valid for a certain amount of time, even if you check that you own this computer. So what happens when your cert expires? Do you have to go back to your email and re-click the link that gives you a new cert to be stored in your browser?
Also, if I'm using a public computer, is there a way for me to manually revoke a cert when I'm done using the machine? It seems that even a 1hr expiry is too long for this case.
Re: Announcing the First Beta Release of Persona
#94This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email password is usually a 50 character random string that I don't like entering on public computers if I even could.
So if I want to log in to a crossword puzzle I almost feel like I have to compromise my email password which is much more valuable, if say the public computer has a key logger or something.
Maybe I'm over thinking. I could see how this would be useful if I have my desktop mail client running and just click a link to log in though.
Re: Announcing the First Beta Release of Persona
#95My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…
You could say the same about any traditional username/password signup that sends a confirmation email and allows you to reply to an email to reset your password. Ultimately, that's just relying on the security of your email, too. So while you are correct that Persona doesn't solve that problem, it doesn't make that problem any worse compared to the default option of an email-confirmed username and password.
I think that's what the parent post was getting at. Originally email was just used for exchanging messages, now that most sites use it to authenticate a user there is a much higher cost to losing access/having it hacked.
Re: Announcing the First Beta Release of Persona
#96What if I don't want a site to know my email address? I currently create unique email addresses for each site. How do I do that with Persona?
It looks like it'd be pretty easy to continue that practice -- just verify more than one email address, and pick the correct one when signing into each site.
Try it here: http://myfavoritebeer.org/
Also, there are Mailinator-like services: https://mockmyid.com/
Re: Announcing the First Beta Release of Persona
#97Am I entirely missing something, but once a password is selected, is there no way to change it?
Re: Announcing the First Beta Release of Persona
#98Let me add my understanding. Please correct me if it is wrong.
Actual user case if everything is in place:
1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/)
2.hit the login link. Give your email address (superuser123@gmail.com or superuser123@yahoo.com)
3.it prompts for your password - gmail password or yahoo password
4.post authentication it takes you to the website with user session as superuser123@gmail.com/superuser123@yahoo.com - eg crossword.thetimes.co.uk
5.In a nutshell, end user doesn't need to create a new userid & password for using the website, as long as he knows his emailuserd/emailpassword
Present use case - since few things are missing
1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/)
2.hit the login link. since gmail & yahoo as email providers not implemented browserid/persona protocol, you will asked to create an account in persona.org with any of your existing email address.(gmail / yahoo).
persona.org will send you a verification link to check if you really own your email address. Click on the verification link and you are verified to use persona.org account in all the places where browserid is supported
3.in the login page - it prompts for a new password if you are a new user or existing password if you are a returning user - this is the password for the email address used in persona.org registration.
4.post authentication it takes you to the website with user session as superuser123@gmail.com/superuser123@yahoo.com - eg crossword.thetimes.co.uk
5.In a nutshell, two things will change in future - no login window from persona.org & no need to create account in persona.org
Re: Announcing the First Beta Release of Persona
#99I personally feel the pain point of password/identity management across different websites, and I'm using LastPass to help. While LastPass's browser integration is great, its UX is... lacking. Mozilla's strategy to associate Firefox browser with identity is IMO awesome and the first sign that it's pioneering vs reacting to Chrome (before this news, I've always viewed Firefox as Chrome's successful but still little brother in terms of features, polish, performance, support, etc.).
BUT (and this is a big "but" I feel), this is contingent with their execution of browser integration. W/O rock solid browser integration with fluid UX, this would just add noise to identity services and cause more consumer confusion.
Ultimately, I'm rooting them on because a) I'm concerned about my security and b) I have too many passwords and c) I'm hella lazy.
Re: Announcing the First Beta Release of Persona
#100Am I entirely missing something, but once a password is selected, is there no way to change it?
Apparently you can by going to http://persona.org