Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

151–160 of 207 posts

Re: Announcing the First Beta Release of Persona

#151

Post by callahad »

zerostar07 wrote: post #131
callahad wrote: post #129

Earlier quoted context omitted.

That's completely spot on. Right now, if your email provider doesn't have native support, we ask you to create a persona.org account so that Mozilla can vouch for you. In the future, this goes away. Similarly, the UI is all displayed in response to navigator.id.* functions. If a browser implements those natively, the Persona UI at login.persona.org completely goes away. The more successful Persona is, the less Mozill…

So if i signup now with my @gmail account through persona.org, what happens when google starts supporting browserid natively?

Then you'll start seeing an authentication page hosted by Google, instead of the Persona fallback. Native options are always tried first, both for client-side navigator.id functions, and for server-side authentication. If one of those is missing, then login.persona.org fills in for that component.

Re: Announcing the First Beta Release of Persona

#152

Post by notatoad »

Osiris wrote: post #121
notatoad wrote: post #86

Earlier quoted context omitted.

It does seem a pretty elegant way to log in, the only concern i have is that it's kind of unclear what password i needed to use to login. I had already created a browserID password at some point in the past, so when i went to the times crossword and clicked sign in, i was prompted for a password. my first thought was maybe i had already signed up for the times crossword, so i tried the password i probably would have…

They've already stated that you'll be able to put your site logo and name into the login box [1]. As far as the password, I thought it was pretty clear that the password they are asking for is your Persona password, but maybe that's because I had just signed up. The point is that you'll only ever need one password, so it'll be great to be able to have one strong password rather than tens of weaker ones. [1] http://id…

>The point is that you'll only ever need one password

this will never be true. You'll only ever need one password for mozilla persona. The user expectation will still be one password per site, and allowing sites to brand the box will only make things even more confusing. It needs a stronger mozilla branding, not a stronger client branding.

Re: Announcing the First Beta Release of Persona

#153

Post by callahad »

donrhummy wrote: post #144
ozten wrote: post #134

Earlier quoted context omitted.

As a website you can do local verification of the log in assertion. Mozilla hosts a verifier as a convenience, but you don't have to use it.

But the assertion only gets sent if the user logs in to persona first (with their email and persona password)

Ah! Right. There is no Persona password if your email provider supports Persona natively. If your provider has native support, you only authenticate with them, and the site you're logging into sees a credential issued by your provider. Mozilla is completely out of the transaction in that case.

You can try this yourself with a demo identity provider we have at http://eyedee.me/

Re: Announcing the First Beta Release of Persona

#156

Post by ozten »

notatoad wrote: post #152
Osiris wrote: post #121

Earlier quoted context omitted.

They've already stated that you'll be able to put your site logo and name into the login box [1]. As far as the password, I thought it was pretty clear that the password they are asking for is your Persona password, but maybe that's because I had just signed up. The point is that you'll only ever need one password, so it'll be great to be able to have one strong password rather than tens of weaker ones. [1] http://id…

>The point is that you'll only ever need one password this will never be true. You'll only ever need one password for mozilla persona . The user expectation will still be one password per site, and allowing sites to brand the box will only make things even more confusing. It needs a stronger mozilla branding, not a stronger client branding.

> this will never be true

Primary IdPs host the log in page, not Mozilla...

Say Google implements BrowserID for Gmail.

The user will see the same Gmail Auth log in screen they have seen many times before. They only have to remember their gmail password (and any password manager works like it always has on this form).

Most likely if your provider is webmail, then you'll already have an active session... so you won't have to type a password in.

Re: Announcing the First Beta Release of Persona

#157

Post by johnkchow »

jedp wrote: post #148
johnkchow wrote: post #145

Earlier quoted context omitted.

I'm sure Firefox will release a Firefox plugin that will complement the basic service of identification. Imagine a plugin that lists all the websites you can authenticate with Persona. Or what if you had multiple personas, the firefox plugin can help you manage the selection of personas. Eventually, it'd become baked into Firefox, giving users that sense of it fundamentally "safer" than other browsers. Sure, this is…

Hi, John, you have some cool ideas there! Hope to see you hacking on Persona. As a member of the team, I just want to clarify that this is not an effort to make firefox alone more secure; it's an effort to make the web more secure. Any browser vendor can implement the protocol, natively or in a plugin, and we hope other browsers will. Same for identity providers. The spec and code are all open-source: https://github.…

It's great that Mozilla has made Persona open for everyone to develop with. While I still believe that Firefox has a lot to gain with Persona, I also agree with your vision that this is a good step towards a safer web (only time will tell if this takes off). I'll take it a step further and argue that if Firefox lead the charge with Persona tightly integrated, it'll make the web even SAFER for the average user, because it will force other browsers to tackle the issue of security as well, benefiting all users regardless of browser platform.

Re: Announcing the First Beta Release of Persona

#158

Post by johnkchow »

As a user I definitely appreciate the emphasis of privacy first as well as its clear responsibility for identification. However, from how I see it on the surface, it currently doesn't have the market reach as, say, FB Connect or Google, and I don't want to "flood" my users with too many options for authentication. What's the practical arguments of rolling out my own authentication (Rails + Devise) vs using Personas?

Re: Announcing the First Beta Release of Persona

#159

Post by JakeSc »

graue wrote: post #65
JakeSc wrote: post #62

My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…

You could say the same about any traditional username/password signup that sends a confirmation email and allows you to reply to an email to reset your password. Ultimately, that's just relying on the security of your email, too. So while you are correct that Persona doesn't solve that problem, it doesn't make that problem any worse compared to the default option of an email-confirmed username and password.

Yes, most authenticated web services offer a "forgot password" option, and their security is thus tied to your email account. However, each one of these decentralized services on its own is not as valuable as the entire ecosystem of Persona-enabled sites will be.

That is, the Persona "forgot password" is a single point of failure which, if compromised, can provide access to a whole ecosystem of sites. And it will be tied to your email account.

Re: Announcing the First Beta Release of Persona

#160

Post by JakeSc »

dochtman wrote: post #102
JakeSc wrote: post #62

My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…

Persona, the protocol, doesn't actually rely on your email account's password. It uses the domain from your email account to figure out how to authenticate you; if you want to use some other way than via your email, that's fine.

That's correct. However, the security of any Persona-enabled site is tied to your email account's security through Persona "forgot password".

This is my concern; a compromised email account means a compromise of your account on every Persona-enabled site.

Post reply on HN