Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

181–190 of 207 posts

Re: Announcing the First Beta Release of Persona

#181

Post by jordanthoms »

pwman wrote: post #165
johnkchow wrote: post #143

Earlier quoted context omitted.

I was referring to LastPass's Chrome extension specifically, not Persona's UX. Sorry for the confusion.

Can you be more specific as to how you find the LastPass UX lacking? Getting UX right is a priority for LastPass too!

Long time last pass user here too. Last pass is great but there are a few things which really annoy me in the chrome version.

- the ux for the login bar at the top is pretty horrible, its distracting when it pops down and it usually requires me to dismiss it more than once. I'd prefer a less intrusive option, maybe just a highlight on the icon. This is my big issue.

- sometimes I want to login to a site with different details from what my auto login is, I no have no option but to sign out of last pass.

- handling of multiple Google accounts isn't great, granted this is mostly Google's fault but something to auto login me to all my accounts on every computer would be awesome.

Re: Announcing the First Beta Release of Persona

#184

Post by motti »

fmarier wrote: post #135
qikquestion wrote: post #98

Let me add my understanding. Please correct me if it is wrong. Actual user case if everything is in place: 1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/ ) 2.hit the login link. Give your email address (superuser123@gmail.com or superuser123@yahoo.com) 3.it prompts for your password - gmail password or yahoo password 4.post authentication it takes you to the website wit…

> 3.it prompts for your password - gmail password or yahoo password Yes. In this case the "it" that prompts for your password will be an iframe served from gmail/yahoo. Once they support Persona natively, login.persona.org is no longer in the loop and your gmail/yahoo password goes directly to gmail/yahoo.

Having the (say) GMail in an iframe sounds worrying. It's not clear immediately that the embedded page came from GMail, as we cannot see the https scheme in the URL for the iframe - much less any indication that the certificate is trusted etc. This provides an attacker with the possibility to create a fake GMail login page

Why not redirect to GMail (openid-style) with a callback (or failing that, use a pop-up)?

Re: Announcing the First Beta Release of Persona

#185

Post by lifeisstillgood »

Got it spliced into the site i am working on, checked in to github, and my laptop crashes. Karma oh karma.

This looks great, I got an identity service plugged in in hours, into a OSS website and this will kick openids bottom.

Brilliant - Mozilla is hitting some incredible high notes right now

Re: Announcing the First Beta Release of Persona

#186

Post by lifeisstillgood »

notatoad wrote: post #172
ozten wrote: post #156

Earlier quoted context omitted.

> this will never be true Primary IdPs host the log in page, not Mozilla... Say Google implements BrowserID for Gmail. The user will see the same Gmail Auth log in screen they have seen many times before. They only have to remember their gmail password (and any password manager works like it always has on this form). Most likely if your provider is webmail, then you'll already have an active session... so you won't h…

Yes... assuming that every site on the internet implements this system. which will never happen.

Every new site will, every site under active development will. The ones where two input boxes have been the same off grey colour for three years won't change much agreed. It's just a question of whether the sites that ask for username/password now are numerically the majority of login sites in three years or not?

I give stackoverflow three days.

Re: Announcing the First Beta Release of Persona

#187

Post by lifeisstillgood »

callahad wrote: post #17
Too wrote: post #5

After reading the text twice and watching both videos i still have no clue what it actually does and how it solves the problem. I'm a few pages of skimming into the documentation now but there's no overview of what it actually does in the background. Just a load of buzzwords and awesomeness!1 of how this will revolutionize my account management and how easy the API is. Is it a password manager, a biometric system or…

It's decentralized public-key based authentication, wrapped up in an extremely user- and dev-friendly package. Francois Marier did a good job of explaining it at Kiwi PyCon 2012: https://www.youtube.com/watch?v=iZBTc7iEkQY (Think OpenID, but easier to use, easier to implement, and with better privacy protection.) In brief: instead of a username and password at login, you get a user's email address and cryptographical…

Congratulations on this and thank you. The links are useful and I recommend the video-I got a proof of concept onto our staging servers whilst listening to the video - fantastic.

Can I suggest a clearer explanation in the quick start guide of loggedInEmail and it's options and that there is a comparison of the name supplied from the site and name inside the browser - it is a bit confusing to see onlogin get called without a button being pressed. I would suggest walking a dev through what to expect - the code examples are great but the quick start is written by someone who understands what's going on behind the scenes - there is a sentence About currentusr that completely floored me - I could not understand how I was supposed to know bob was logged in if that was the first time he arrived at the site. In the end I gave up and read the docs !

Edit - needed bigger text box on ipad

Re: Announcing the First Beta Release of Persona

#188

Post by ozten »

lifeisstillgood wrote: post #185

Got it spliced into the site i am working on, checked in to github, and my laptop crashes. Karma oh karma. This looks great, I got an identity service plugged in in hours, into a OSS website and this will kick openids bottom. Brilliant - Mozilla is hitting some incredible high notes right now

I'm seriously digging the positive, participation and hacking vibe in these comments!

The web and OSS is so amazing.

Re: Announcing the First Beta Release of Persona

#189

Post by kumar303 »

motti wrote: post #184
fmarier wrote: post #135

Earlier quoted context omitted.

> 3.it prompts for your password - gmail password or yahoo password Yes. In this case the "it" that prompts for your password will be an iframe served from gmail/yahoo. Once they support Persona natively, login.persona.org is no longer in the loop and your gmail/yahoo password goes directly to gmail/yahoo.

Having the (say) GMail in an iframe sounds worrying. It's not clear immediately that the embedded page came from GMail, as we cannot see the https scheme in the URL for the iframe - much less any indication that the certificate is trusted etc. This provides an attacker with the possibility to create a fake GMail login page Why not redirect to GMail (openid-style) with a callback (or failing that, use a pop-up)?

You're talking about a phishing attack and it's actually worse for OpenID http://identity.mozilla.com/post/7669886219/how-browserid-di... Once Persona is integrated into browsers it will offer better security. BTW, the iframe is always in a pop-up for this exact reason. It's never an iframe within the context of the website that initiated the login.

Re: Announcing the First Beta Release of Persona

#190

Post by weaksauce »

jedp wrote: post #147
weaksauce wrote: post #137

Earlier quoted context omitted.

The password that I create when I setup persona is for what exactly? It doesn't seem to be used at all after the creation a persona.

If you log out, that's the password you'll use to log in again. The login session is good for a while so you can continue to login with already-authenticated identities (and you can have as many as you want) on persona-enabled sites.

Thanks for clarifying. I was assuming that was the case but the login/creation page needs to have a graphic or a narrative talking about what it does and how the process works a bit more before it reaches a more public audience. As a software developer I had an idea of how the thing worked but it wasn't spelled out enough. I understand that it's beta but the whole thing is weakly documented from a user's standpoint as to why it should be trusted.
Post reply on HN