This looks really great. Only problem I see is the lack of support for IE 6 and 7, and it seems they won't be in the future. Anybody knows why that is?
Announcing the First Beta Release of Persona
101–110 of 207 posts
Re: Announcing the First Beta Release of Persona
#102My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…
Persona, the protocol, doesn't actually rely on your email account's password. It uses the domain from your email account to figure out how to authenticate you; if you want to use some other way than via your email, that's fine.
Re: Announcing the First Beta Release of Persona
#103Earlier quoted context omitted.
I don't think it'll replace Facebook, it'll just be an alternative to it. We've integrated both Persona and Facebook into our site and it works great. For my business, we need more personal details about each person that we get by default with Facebook (name/age/sex). So, that integration will always be cleaner than Persona because it is just a few clicks. We've been working with BID/Persona for a while now (we're li…
I've seen some preliminary discussions of linking personal information to a Persona and optionally supplying it to the site at login time. If you have a need for that, you should chat with the Persona/BrowserID developers.
It wouldn't be ideal because there would only be a limited number of people who ever took advantage of it. The model for Persona is different than Facebook. Facebook requires this data on account creation and so do we... so we just present the user with a lock out until they give it to us.
Re: Announcing the First Beta Release of Persona
#104Are there any websites with implementations that don't prompt directly for Mozilla's site(i.e. asking for your preferred BrowserID provider)? I'd like to see how clunky the interface becomes when there are more providers(such as if I want to become my own provider) than just Mozilla. Is the user then confused by asking for a provider..ala OpenID? Am I correct in presuming Persona is an implementation of BrowserID? I'…
> Are there any websites with implementations that don't prompt directly for Mozilla's site That's the OpenID model. BrowserID works somewhat differently. Your ID is an email address, so your provider is that email's domain. Because few domains support it directly yet, Mozilla operates an optional, centralized authority that can issue credentials to other users. But you don't have to use that if you add support on yo…
Can I cname my own domain to a provider or something similar?
Re: Announcing the First Beta Release of Persona
#105Earlier quoted context omitted.
I've seen some preliminary discussions of linking personal information to a Persona and optionally supplying it to the site at login time. If you have a need for that, you should chat with the Persona/BrowserID developers.
It wouldn't be ideal because there would only be a limited number of people who ever took advantage of it. The model for Persona is different than Facebook. Facebook requires this data on account creation and so do we... so we just present the user with a lock out until they give it to us.
Persona could potentially note at login time that you require that information to create an account, and thus require supplying it before attempting to log in.
That said, looking at what your site does, why do you need that information? I can understand why you want it, but what functionality of your site won't function without it?
Re: Announcing the First Beta Release of Persona
#106This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email passwo…
"my email password is usually a 50 character random string that I don't like entering on public computers if I even could"
"I almost feel like I have to compromise my email password which is much more valuable"
I understand your concern. I suggest using either two-factor authentication (such as Google's) or creating a "throwaway" email account just for this purpose.
Re: Announcing the First Beta Release of Persona
#107This looks really great. Only problem I see is the lack of support for IE 6 and 7, and it seems they won't be in the future. Anybody knows why that is?
[deleted]
Re: Announcing the First Beta Release of Persona
#108I dislike that a Google search for "Mozilla Persona" returns Firefox Personas first, meaning that Mozilla now has 'Persona' and 'Personas' projects that are totally and completely unrelated to one another.
Something has to give because if it confuses a Hacker News reader, it's going to go completely over the head of the average computer user.
Re: Announcing the First Beta Release of Persona
#109My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…
I think the ship has mostly sailed on email -- most sites use email password recovery, so that choice isn't up to you unless you get a different email address for each site.
You should definitely use 2-factor authentication for your email!
Re: Announcing the First Beta Release of Persona
#110Earlier quoted context omitted.
> Are there any websites with implementations that don't prompt directly for Mozilla's site That's the OpenID model. BrowserID works somewhat differently. Your ID is an email address, so your provider is that email's domain. Because few domains support it directly yet, Mozilla operates an optional, centralized authority that can issue credentials to other users. But you don't have to use that if you add support on yo…
Can I cname my own domain to a provider or something similar?
Yep! You can delegate to another Identity Provider (IdP) by adding a JSON file to your domain (we're looking into DNS-based ways of doing the same), but afaik, there aren't any publicly available IdPs that accept delegation yet. Ozten is working on one.
Also, we still haven't completely shored up the IdP-facing API (there are a few rough edges to fix before committing to it), so the specifics are still subject to change. https://mockmyid.com/ and https://eyedee.me/ are both open source, example IdPs that we're using for testing.