Announcing the First Beta Release of Persona • Hacker News Board

Re: Announcing the First Beta Release of Persona

#121

Post by Osiris » Thu, Sep 27, 2012, 7:24 PM UTC

notatoad wrote: post #86

Osiris wrote: post #60

I just tried it on the Times Crossword page. The workflow is really simple and elegant. I put in my email address. It took a second to determine there was no Persona account, then asked for me to create a password. After that, I clicked on an authorization link in my email account and as soon as I did that it immediately logged me in. I clicked Log out and back in again and it immediately recognized me and logged me…

It does seem a pretty elegant way to log in, the only concern i have is that it's kind of unclear what password i needed to use to login. I had already created a browserID password at some point in the past, so when i went to the times crossword and clicked sign in, i was prompted for a password. my first thought was maybe i had already signed up for the times crossword, so i tried the password i probably would have…

They've already stated that you'll be able to put your site logo and name into the login box [1].

As far as the password, I thought it was pretty clear that the password they are asking for is your Persona password, but maybe that's because I had just signed up.

The point is that you'll only ever need one password, so it'll be great to be able to have one strong password rather than tens of weaker ones.

[1] http://identity.mozilla.com/post/32395255498/announcing-the-...

Re: Announcing the First Beta Release of Persona

#122

Post by [deleted] » Thu, Sep 27, 2012, 7:24 PM UTC

BryanB55 wrote: post #94

This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email passwo…

[deleted]

Re: Announcing the First Beta Release of Persona

#123

Post by kumar303 » Thu, Sep 27, 2012, 7:24 PM UTC

donrhummy wrote: post #113

Can someone explain how this is distributed and not using a central "authority"? I know it caches things locally, but it still requires Mozilla's Persona.org servers, correct? And you need a password that Mozilla stores, so aren't their servers still vulnerable? And couldn't (dumb) people still choose "123456" as their persona password? I understand that this makes the sites with crappy security implementations bette…

It's fully distributed because the identity provider is your email domain. When joe@gmail.com logs in, gmail.com could be the only server that the system interacts with! This is described here: https://developer.mozilla.org/en-US/docs/Persona/.well-known... Gmail may or may not choose to become an identity provider. That's ok too. In that case, a secure Mozilla server (with a sane privacy policy) will broker the email verification instead and thus can vouch for the user's identity.

Re: Announcing the First Beta Release of Persona

#124

Post by callahad » Thu, Sep 27, 2012, 7:24 PM UTC

spoletto wrote: post #93

If I understand correctly, the browser stores a certificate that proves you own your email address. These certificates are only valid for a certain amount of time, even if you check that you own this computer. So what happens when your cert expires? Do you have to go back to your email and re-click the link that gives you a new cert to be stored in your browser? Also, if I'm using a public computer, is there a way fo…

This is the part that gets kind of confusing because there isn't a clear delineation between Persona the UI and Persona the fallback identity provider (IdP).

When your cert expires, you need to get a new one from your IdP. If you already have an active session with your IdP (either by logging into your webmail, or clicking the "this is my computer" button for Mozilla's fallback), then your browser can get a new cert completely invisibly.

If your session and your cert have expired, then you get prompted to authenticate again. For the Persona fallback, this means you'll be prompted for your Persona password (instead of sending you back to your email, because that's super annoying and users end up not logging into your site). If your email provider has native support for Persona, then you'll get prompted by them however they normally do login.

> I'm using a public computer, is there a way for me to manually revoke a cert when I'm done using the machine?

Go to login.persona.org and click "sign out." We're working on universal signout (at least for users of the fallback), but I'm not sure if that's landed in production yet.

Re: Announcing the First Beta Release of Persona

#125

Post by bwood » Thu, Sep 27, 2012, 7:25 PM UTC

spoletto wrote: post #93

If I understand correctly, the browser stores a certificate that proves you own your email address. These certificates are only valid for a certain amount of time, even if you check that you own this computer. So what happens when your cert expires? Do you have to go back to your email and re-click the link that gives you a new cert to be stored in your browser? Also, if I'm using a public computer, is there a way fo…

I get the impression that verifying your email address only needs to be done once when you first sign up with Persona and create a password. When you use Persona to log in to a site for the first time in that browser, it prompts you for your Persona password and issues a certificate on success. If that certificate expires, I presume you would have to use your password again with Persona to get a new certificate.

I haven't found anything about manually revoking a cert, but I haven't looked either.

Re: Announcing the First Beta Release of Persona

#126

Post by bwood » Thu, Sep 27, 2012, 7:27 PM UTC

callahad wrote: post #124

spoletto wrote: post #93

If I understand correctly, the browser stores a certificate that proves you own your email address. These certificates are only valid for a certain amount of time, even if you check that you own this computer. So what happens when your cert expires? Do you have to go back to your email and re-click the link that gives you a new cert to be stored in your browser? Also, if I'm using a public computer, is there a way fo…

This is the part that gets kind of confusing because there isn't a clear delineation between Persona the UI and Persona the fallback identity provider (IdP). When your cert expires, you need to get a new one from your IdP. If you already have an active session with your IdP (either by logging into your webmail, or clicking the "this is my computer" button for Mozilla's fallback), then your browser can get a new cert…

Thanks for the detail, I really like what I see with Persona so far.

Re: Announcing the First Beta Release of Persona

#127

Post by zerostar07 » Thu, Sep 27, 2012, 7:28 PM UTC

betterth wrote: post #108

I dislike that a Google search for "Mozilla Persona" returns Firefox Personas first, meaning that Mozilla now has 'Persona' and 'Personas' projects that are totally and completely unrelated to one another. Something has to give because if it confuses a Hacker News reader, it's going to go completely over the head of the average computer user.

Supposedly, end users will only face the "login with browserid" buttons. But yeah, i find the name change from browserid to Persona, as first time users will be confused.

Re: Announcing the First Beta Release of Persona

#128

Post by fmarier » Thu, Sep 27, 2012, 7:28 PM UTC

spoletto wrote: post #93

If I understand correctly, the browser stores a certificate that proves you own your email address. These certificates are only valid for a certain amount of time, even if you check that you own this computer. So what happens when your cert expires? Do you have to go back to your email and re-click the link that gives you a new cert to be stored in your browser? Also, if I'm using a public computer, is there a way fo…

In the case of the Javascript shim, the certificates are stored in the browser's local storage. In Firefox (and I believe in most other browsers), this gets deleted when you clear cookies.

So you can do that before you leave that public computer, or you can use private browsing / incognito mode so that cookies and local storage stay in RAM and disappear when you exit.

Re: Announcing the First Beta Release of Persona

#129

Post by callahad » Thu, Sep 27, 2012, 7:30 PM UTC

qikquestion wrote: post #98

Let me add my understanding. Please correct me if it is wrong. Actual user case if everything is in place: 1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/ ) 2.hit the login link. Give your email address (superuser123@gmail.com or superuser123@yahoo.com) 3.it prompts for your password - gmail password or yahoo password 4.post authentication it takes you to the website wit…

That's completely spot on. Right now, if your email provider doesn't have native support, we ask you to create a persona.org account so that Mozilla can vouch for you. In the future, this goes away.

Similarly, the UI is all displayed in response to navigator.id.* functions. If a browser implements those natively, the Persona UI at login.persona.org completely goes away.

The more successful Persona is, the less Mozilla is involved in the login process. :)

Re: Announcing the First Beta Release of Persona

#130

Post by zerostar07 » Thu, Sep 27, 2012, 7:30 PM UTC

BryanB55 wrote: post #94

This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email passwo…

Then you would not use your primary "super secure" email as your browserId, but a secondary mail account.