Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

111–120 of 207 posts

Re: Announcing the First Beta Release of Persona

#111

Post by latchkey »

JoshTriplett wrote: post #105
latchkey wrote: post #103

Earlier quoted context omitted.

It wouldn't be ideal because there would only be a limited number of people who ever took advantage of it. The model for Persona is different than Facebook. Facebook requires this data on account creation and so do we... so we just present the user with a lock out until they give it to us.

Persona could potentially note at login time that you require that information to create an account, and thus require supplying it before attempting to log in. That said, looking at what your site does, why do you need that information? I can understand why you want it, but what functionality of your site won't function without it?

Yes, we require it. Having the persons name is obvious. For the rest, the site is very specific in its purpose, which is to allow people to register for USA cycling events.

There are some crazy rules around who can enter which race (based on age/sex) and we do our best to help guide people into the right event during registration.

Location is a nice to have so that when we show the list of participants, they can see where each person lives. Future versions of the site will use this information to help people connect with ride sharing to events.

Keeping the UX of asking for this information within our site makes sense when logging in with Persona since it doesn't have the social networking aspects that Facebook has. Most people who are entering bike races won't lie about their age/sex on Facebook (because bike racing is a relatively small community), so generally this information is pretty accurate. Once someone gives us their USA Cycling license number we also validate against the database we have of that information too.

Re: Announcing the First Beta Release of Persona

#112

Post by [deleted] »

JoshTriplett wrote: post #105
latchkey wrote: post #103

Earlier quoted context omitted.

It wouldn't be ideal because there would only be a limited number of people who ever took advantage of it. The model for Persona is different than Facebook. Facebook requires this data on account creation and so do we... so we just present the user with a lock out until they give it to us.

Persona could potentially note at login time that you require that information to create an account, and thus require supplying it before attempting to log in. That said, looking at what your site does, why do you need that information? I can understand why you want it, but what functionality of your site won't function without it?

[deleted]

Re: Announcing the First Beta Release of Persona

#113

Post by donrhummy »

Can someone explain how this is distributed and not using a central "authority"? I know it caches things locally, but it still requires Mozilla's Persona.org servers, correct? And you need a password that Mozilla stores, so aren't their servers still vulnerable? And couldn't (dumb) people still choose "123456" as their persona password? I understand that this makes the sites with crappy security implementations better, but some of the weaknesses are still there, right?

Re: Announcing the First Beta Release of Persona

#114

Post by callahad »

asymmetric wrote: post #101

This looks really great. Only problem I see is the lack of support for IE 6 and 7, and it seems they won't be in the future. Anybody knows why that is?

The Persona cross-browser support shim needs window.postMessage and the HTML5 storage APIs, which IE 7 doesn't have. Working around it didn't seem worth the security and maintainability cost to the codebase, nor the opportunity cost over working on other features.

Re: Announcing the First Beta Release of Persona

#115

Post by kumar303 »

mmahemoff wrote: post #38
Too wrote: post #5

After reading the text twice and watching both videos i still have no clue what it actually does and how it solves the problem. I'm a few pages of skimming into the documentation now but there's no overview of what it actually does in the background. Just a load of buzzwords and awesomeness!1 of how this will revolutionize my account management and how easy the API is. Is it a password manager, a biometric system or…

The original name, "Browser ID", made it clearer. Basically, your browser knows your identity, so it can automatically authenticate you with any supporting website. You never have to set up an account with the website and you never have to enter a password. That's my understanding of it anyway.

in 5 years many people using the web will have no idea what you're talking about when you say "browser" :)

Re: Announcing the First Beta Release of Persona

#116

Post by tofumatt »

donrhummy wrote: post #113

Can someone explain how this is distributed and not using a central "authority"? I know it caches things locally, but it still requires Mozilla's Persona.org servers, correct? And you need a password that Mozilla stores, so aren't their servers still vulnerable? And couldn't (dumb) people still choose "123456" as their persona password? I understand that this makes the sites with crappy security implementations bette…

I believe the aim is to have email providers be able to auth your persona email instead of Mozilla, but Mozilla exists as a sort of polyfill if the provider (eg. hotmail.com, gmail.com, your-custom-domain.net) doesn't do persona yet.

Also, yes: people can still choose crummy passwords. Personally, I don't think the appeal is in better security; it's convenience of single sign-on without it being tied to a. identity or b. Facebook (or twitter or google or whatever other service that harvests my data).

Re: Announcing the First Beta Release of Persona

#118

Post by donrhummy »

tofumatt wrote: post #116
donrhummy wrote: post #113

Can someone explain how this is distributed and not using a central "authority"? I know it caches things locally, but it still requires Mozilla's Persona.org servers, correct? And you need a password that Mozilla stores, so aren't their servers still vulnerable? And couldn't (dumb) people still choose "123456" as their persona password? I understand that this makes the sites with crappy security implementations bette…

I believe the aim is to have email providers be able to auth your persona email instead of Mozilla, but Mozilla exists as a sort of polyfill if the provider (eg. hotmail.com, gmail.com, your-custom-domain.net) doesn't do persona yet. Also, yes: people can still choose crummy passwords. Personally, I don't think the appeal is in better security; it's convenience of single sign-on without it being tied to a. identity o…

Right, but the email providers are only authenticating you to Persona. As far as the websites using Persona are concerned, it's persona.org that authenticates you.

And the appeal that Mozilla is pushing is definitely better security (as well as a distributed security authentication versus one for-profit authority - I definitely trust Mozilla MUCH more than Facebook or twitter, but it's still a central authority). You can especially see this in the talk they gave introducing it: http://www.youtube.com/watch?v=iZBTc7iEkQY

Re: Announcing the First Beta Release of Persona

#119

Post by donrhummy »

johnkchow wrote: post #99

I personally feel the pain point of password/identity management across different websites, and I'm using LastPass to help. While LastPass's browser integration is great, its UX is... lacking. Mozilla's strategy to associate Firefox browser with identity is IMO awesome and the first sign that it's pioneering vs reacting to Chrome (before this news, I've always viewed Firefox as Chrome's successful but still little br…

Persona doesn't require any browser integration. It works in all browsers that implement local storage. So it works via modern Javascript.

Re: Announcing the First Beta Release of Persona

#120

Post by fmarier »

aubergene wrote: post #104
callahad wrote: post #54

Earlier quoted context omitted.

> Are there any websites with implementations that don't prompt directly for Mozilla's site That's the OpenID model. BrowserID works somewhat differently. Your ID is an email address, so your provider is that email's domain. Because few domains support it directly yet, Mozilla operates an optional, centralized authority that can issue credentials to other users. But you don't have to use that if you add support on yo…

Can I cname my own domain to a provider or something similar?

We'll also be looking into DNS-based delegation for the next beta: https://github.com/mozilla/browserid/issues/1523
Post reply on HN