Announcing the First Beta Release of Persona • Hacker News Board

Re: Announcing the First Beta Release of Persona

#201

Post by loumf » Fri, Sep 28, 2012, 2:51 PM UTC

JakeSc wrote: post #162

loumf wrote: post #138

Earlier quoted context omitted.

The most valuable thing about your email account is that it's your password recovery mechanism. What ever email account you use for password recovery or logging into things becomes the "super secure" email account. There is no message in my email that I care more about than the one that might give you access to my bank accounts.

> There is no message in my email that I care more about than the one that might give you access to my bank accounts. This is very well phrased. Email sort of serves two purposes these days, each with very different security models: text-based communication, and external service authentication. Do you have any ideas for separating these two functions, or at least improving their security?

Not really. The main thing that has been happening over time is that more and more low-security messages are being drawn away from email (Twitter, FaceBook, SMS). I used to get email forwards from friends/family -- now they post to FB. I never get a pic emailed to me any more. So, the trend to separate out low-security messages has been happening -- perhaps trending towards leaving email as only a password recovery mechanism.

Or maybe not even that -- I use 2-factor for Google and FB -- where SMS is in the mix -- SMS could even be the recovery mechanism, moving even those messages out.

Re: Announcing the First Beta Release of Persona

#202

Post by johnkchow » Fri, Sep 28, 2012, 3:49 PM UTC

callahad wrote: post #166

johnkchow wrote: post #158

As a user I definitely appreciate the emphasis of privacy first as well as its clear responsibility for identification. However, from how I see it on the surface, it currently doesn't have the market reach as, say, FB Connect or Google, and I don't want to "flood" my users with too many options for authentication. What's the practical arguments of rolling out my own authentication (Rails + Devise) vs using Personas?

It's available to any user with an email address -- you don't have to limit yourself to users that have, and are willing to use, a Facebook or Google account. Versus rolling your own, you don't have the friction of account creation / password management for new user signups if the user has ever used Persona before, and we'll be dramatically improving first-contact before the end of the year. You can completely forget…

Ah so true, email verifications and forgotten passwords can become a hassle. Thanks for the insight callahad.

Re: Announcing the First Beta Release of Persona

#203

Post by salvadors » Sat, Sep 29, 2012, 9:02 AM UTC

nfg wrote: post #196

kumar303 wrote: post #115

Earlier quoted context omitted.

in 5 years many people using the web will have no idea what you're talking about when you say "browser" :)

I think the majority of people have no idea what a browser is and never have.

http://www.youtube.com/watch?v=o4MwTvtyrUQ

Re: Announcing the First Beta Release of Persona

#204

Post by Evbn » Sat, Sep 29, 2012, 6:13 PM UTC

beefsack wrote: post #9

Too wrote: post #5

After reading the text twice and watching both videos i still have no clue what it actually does and how it solves the problem. I'm a few pages of skimming into the documentation now but there's no overview of what it actually does in the background. Just a load of buzzwords and awesomeness!1 of how this will revolutionize my account management and how easy the API is. Is it a password manager, a biometric system or…

It's quite clever, essentially it's a system where your email address is your unique identifier, and you authenticate by clicking on a link sent to your email account. The developer reference has much more information: https://developer.mozilla.org/en-US/docs/persona

Isn't this basically the same as OpenID?

Re: Announcing the First Beta Release of Persona

#205

Post by path411 » Mon, Oct 01, 2012, 9:14 PM UTC

gambler wrote: post #178

graue wrote: post #65

Earlier quoted context omitted.

You could say the same about any traditional username/password signup that sends a confirmation email and allows you to reply to an email to reset your password. Ultimately, that's just relying on the security of your email, too. So while you are correct that Persona doesn't solve that problem, it doesn't make that problem any worse compared to the default option of an email-confirmed username and password.

Considering that it's a new protocol, why not try to solve that old problem? At the very least, they could allow you to disable email-based password reset in favor of printed code. That would be a smart thing to do. You would get a random code or several codes you print out and put into a safe place. If you ever forgot your password, you would dig it our and supply to the website to trigger a reset (which could inclu…

Google's 2 factor auth does this already.

Re: Announcing the First Beta Release of Persona

#206

Post by olivier1664 » Tue, Oct 02, 2012, 6:05 AM UTC

As far as I understand http://lloyd.io/how-browserid-works , the browser will hold a "certificate of ownership of the email". Since browser do not yet implement Persona, it is done in javascript with https://login.persona.org/include.js .

I do not yet understand what prevent me to steal these 'certificate of ownership of the email' by creating a web site with my own version of 'include.js'. In this malicious version, the "Assertion Generation" also send the private key to the server. After that, the server can uses the user login as he wants. It seems there is a timeout, but it allow the malicious server to log so long the time out is not ellapsed. Where I'am wrong?

Re: Announcing the First Beta Release of Persona

#207

Post by sabret00the » Thu, Oct 04, 2012, 4:11 PM UTC

sabret00the wrote: post #79

Have the fixed the fact that it doesn't support autofilling passwords? That alone makes it more annoying than any captcha that I've ever had to fill out.

Find it hilarious that this got marked down and yet it's something Mozilla have spent the last week moving towards getting this fixed.