Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona is distributed. Today.

identity.mozilla.com

Post reply on HN
Print view View original

51–60 of 154 posts

Re: Persona is distributed. Today.

#51

Post by StavrosK »

lubujackson wrote: post #50

I still have a funny feeling about the robustness of Persona. For instance - let's say one of my emails gets hacked, my crappy Yahoo email. Does that give them access to my other Persona accounts? Would I (or anyone else) be able to know if the account is compromised? Normally you change your password and that's the end of it, but I'm not sure what happens with Persona. What if my kid brother uses my computer - would…

> Does that give them access to my other Persona accounts?

No, it gives them access to whatever site you registered with your Yahoo! account. (EDIT: If you use the temporary bridge they implement, they could get access to your other accounts if they got access to the bridge. This won't happen if your email provider supports Persona natively).

> Would I (or anyone else) be able to know if the account is compromised?

Yahoo! probably would, and could tell you.

> Normally you change your password and that's the end of it, but I'm not sure what happens with Persona.

You change your password and that's the end of it.

> What if my kid brother uses my computer - wouldn't he have access to any site that allows Persona logins? How do you lock it down?

Just log out of your email provider.

Really, Persona is just a way to make your email provider your authenticator. It's "Facebook Connect" for your email provider.

Security-wise, if your email gets hacked, what happens is what would happen anyway, since almost every site can request a password reset by emailing you. The attacker has access to that anyway. Persona removes the hassle of remembering one password per account by letting the site ask your email provider if they know you.

Re: Persona is distributed. Today.

#52

Post by tadfisher »

JoshTriplett wrote: post #38
tadfisher wrote: post #36

Earlier quoted context omitted.

What is your preferred server environment? This would be a fun project to whip up quickly.

Static files. :) Hence the idea of just pre-generating the key pair and sharing the key with my browsers via Firefox Sync. The provisioning and signin pages could point to static pages that just say "If you're seeing this, you're trying to authenticate as me and you aren't me; go away."

OK, so I can see this working with a browser extension. Throw a pregenerated cert into localStorage and sync across browsers. Where I'm still fuzzy is if the site performs local verification, or login.persona.org does it, it might contact your server to grab its pubkey over SSL, requiring you to host something on your email domain.

Re: Persona is distributed. Today.

#53

Post by sergiosgc »

charlieok wrote: post #42
mcpherrinm wrote: post #24

Earlier quoted context omitted.

Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-di... In short, three big differences: 1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them. 2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal…

How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)

https://developer.mozilla.org/en-US/docs/Persona/Protocol_Ov...

In short, your browser asks the identity provider to sign a certificate proving that you are someone@example.com. The browser will then use that certificate to authenticate you on the site. The site can check this certificate by getting the pubkey from the identity provider. You are never associated with the site you are authenticating against (except on very low traffic identity providers)

Re: Persona is distributed. Today.

#54

Post by StavrosK »

csense wrote: post #48
charlieok wrote: post #42

Earlier quoted context omitted.

How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)

The service you log into knows the identity provider's public key and a cert for the user (the user's public key signed by the identity provider). The service can verify the user's cert against the identity provider's public key with this information. The service initially contacts the identity provider to get the provider's public key, so the identity provider can infer that someone is attempting to log into the ser…

Does this mean that your browser can cache the signed cert and log in to websites automatically without needing to even contact the provider again?

I'm guessing there's some sort of timestamp there, to prevent someone from just stealing the cert and logging in to whatever they want as that user.

Re: Persona is distributed. Today.

#55

Post by inopinatus »

I've just read through the Persona protocol specification document at https://github.com/mozilla/id-specs/blob/prod/browserid/inde... and was quite disappointed to find RFC5785 in use, in which HTTP is abused as an infrastructure discovery protocol.

This gives a lie to the identity being an "email address". It isn't. Ok, it's structured as a LHS@RHS form but the domain in the RHS isn't an email domain, it's an overloaded website with some problematic assumptions ladled in.

This creates a significant barrier to adoption. Many entities just won't bother: not only does it ask an apex A record to serve actual content (usually a mistake) but it requires the primary web host of a registerable domain, usually a trademark or brand identity, to carry technical material, definitely a clash of concerns.

(Why? In many companies of reasonable size, the website is managed by a completely different group of people - often a marketing team - to the internal identity service. Then, even if one team convinces to the other to install the browserid file, there is a possibility of it being deleted it by mistake during the next site refresh.)

I had hoped to find an intermediate step where a DNS SRV lookup was used to first locate the host delivering the browserid file. This follows the federated structure of email rather more closely and allows the identity service to be independent of the corporate brochureware. Even better - if the SRV lookup could be signed with DNSSEC, the transfer itself can be protected with DANE. The whole thing becomes manageable as a simple, separate unit of technology. It is thus rather more likely to gain the support of system administrators.

Re: Persona is distributed. Today.

#56

Post by snowwrestler »

> Of course, in the long term, Persona is meant to be distributed: alice@example.com should be verified and certified by the administrators of example.com. If example.com wants to use 2-digit passwords, they can. If they want to use retinal scans powered by your webcam, they can. It’s up to them. With each domain able to customize its authentication protocol with its users, the Web becomes more secure.

How would a 2-digit password make the web more secure?

Let's say I allow users to authenticate into my website with Persona, and I accept alice@example.com--whose 2 digit password is brute-forced the next day. Now whoever got into Alice's account has elevated permissions in my web app too. Great. If I had just stuck with my own authentication scheme at least I could have enforced some minimum complexity.

Re: Persona is distributed. Today.

#57

Post by freshhawk »

martinced wrote: post #37
csense wrote: post #12

How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…

I didn't downvote it but I think I know why: there's a huge wave of negativity on HN and your question sounds like criticism. There are ways to formulate the same question which would be much nicer and less negative, for example: "It's great to see other solutions providing things similar to OpenID. Can anyone explain what are the differences with OpenID?" Simply writing: "How is this different from XXX?" just sounds…

Understand where you are coming from but this is an overreaction. An HN where you have to wrap a plain, absolutely neutral question like this in a bunch of false praise or meaningless filler words is a much much worse place than the HN that might be overly critical/negative by default (and this perception is partly false, reinforced by the cultural belief that questions are attacks).

Re: Persona is distributed. Today.

#58

Post by marcioaguiar »

snowwrestler wrote: post #56

> Of course, in the long term, Persona is meant to be distributed: alice@example.com should be verified and certified by the administrators of example.com. If example.com wants to use 2-digit passwords, they can. If they want to use retinal scans powered by your webcam, they can. It’s up to them. With each domain able to customize its authentication protocol with its users, the Web becomes more secure. How would a 2-…

He was just making a point that authentication protocol is a domain choice (from 2-digit passwords to retinal scan).

It's up to the users to trust the domain he is going to use as identity. Just like many people trust Facebook Connect.

Re: Persona is distributed. Today.

#59

Post by marcioaguiar »

StavrosK wrote: post #54
csense wrote: post #48

Earlier quoted context omitted.

The service you log into knows the identity provider's public key and a cert for the user (the user's public key signed by the identity provider). The service can verify the user's cert against the identity provider's public key with this information. The service initially contacts the identity provider to get the provider's public key, so the identity provider can infer that someone is attempting to log into the ser…

Does this mean that your browser can cache the signed cert and log in to websites automatically without needing to even contact the provider again? I'm guessing there's some sort of timestamp there, to prevent someone from just stealing the cert and logging in to whatever they want as that user.

not different from someone stealing your cookies.

Re: Persona is distributed. Today.

#60

Post by jayfuerstenberg »

csense wrote: post #12

How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…

Nobody should be downvoted for simply asking a question so I upvoted you.

Hope it helps a bit.

EDIT: And somebody downvoted this comment. Oh no, I lost 1 HN point! What . will . I . ever . do?

Post reply on HN