Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona is distributed. Today.

identity.mozilla.com

Post reply on HN
Print view View original

71–80 of 154 posts

Re: Persona is distributed. Today.

#71

Post by Helianthus »

csense wrote: post #12

How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…

One way it'll be different is (presumably) users won't be confronted with a wall of possible OpenID providers.

You asked a good question. HN's not very good at self-regulating. Negativity is regarded negatively in some bizarre self-perpetuation cycle.

Re: Persona is distributed. Today.

#72

Post by Helianthus »

yellowseed wrote: post #67
freshhawk wrote: post #57

Earlier quoted context omitted.

Understand where you are coming from but this is an overreaction. An HN where you have to wrap a plain, absolutely neutral question like this in a bunch of false praise or meaningless filler words is a much much worse place than the HN that might be overly critical/negative by default (and this perception is partly false, reinforced by the cultural belief that questions are attacks).

On the other hand, paraphrasing what you've said to make a counter-argument: an HN where a peaceful, respectful atmosphere is sustained by thoughtfully worded comments is a much much worse place than an HN where dry, hastily worded comments take some heat.

Honestly, I'm not sure if your counter argument is intended to be ironic.

I'm used to an Internet where you're not required to be so goddamned polite. Seems to me it becomes the spidery veneer of Silicon Valley networking; insincere, self-interested, and a corruption of what it means to be 'nice.'

Re: Persona is distributed. Today.

#73

Post by mindcrime »

Helianthus wrote: post #72
yellowseed wrote: post #67

Earlier quoted context omitted.

On the other hand, paraphrasing what you've said to make a counter-argument: an HN where a peaceful, respectful atmosphere is sustained by thoughtfully worded comments is a much much worse place than an HN where dry, hastily worded comments take some heat.

Honestly, I'm not sure if your counter argument is intended to be ironic. I'm used to an Internet where you're not required to be so goddamned polite. Seems to me it becomes the spidery veneer of Silicon Valley networking; insincere, self-interested, and a corruption of what it means to be 'nice.'

What's wrong with being polite? It doesn't cost any extra and there are a lot of people who appreciate it.

Re: Persona is distributed. Today.

#74

Post by graue »

JoshTriplett wrote: post #38
tadfisher wrote: post #36

Earlier quoted context omitted.

What is your preferred server environment? This would be a fun project to whip up quickly.

Static files. :) Hence the idea of just pre-generating the key pair and sharing the key with my browsers via Firefox Sync. The provisioning and signin pages could point to static pages that just say "If you're seeing this, you're trying to authenticate as me and you aren't me; go away."

This sounds awesome. I hope you do it and write a blog post about it!

Re: Persona is distributed. Today.

#75

Post by graue »

cromwellian wrote: post #27

I haven't look at the specs deeply, but it would be nice to have a system that did not need any kind of server at all, but the browser itself could be the Persona identity provider. The actual local data needed to pull it off could be replicated (encrypted) to cloud storage so it would work across all your devices and browsers, but the actual profile data itself would never be readable by the servers. I started looki…

Isn't this the ultimate goal of Persona - native browser support?

Re: Persona is distributed. Today.

#76

Post by bradleyjg »

JoshTriplett wrote: post #14

Currently wondering the most sensible approach to make a single-user website support this protocol, so that I can make my email address (the only valid email address at my domain) support Persona natively. I don't really want to have to set up a username/password system with a single user. I'd almost prefer to manually hand my identity's private key to each browser I want to use. I wonder how much work it would take…

Check out this comment from a prior article on the subject: https://news.ycombinator.com/item?id=5410576

He's using mobile authenticator as a password mechanism, but it should be modifiable to just trust the local browser.

Re: Persona is distributed. Today.

#77

Post by teawithcarl »

Outstanding work, Mozilla. Parallel to when they broke the I-E monopoly, Mozilla is truly impressive lately.

Best way to support the new creativity surge by Mozilla - re-adopt Firefox as your MAIN browser.

With each search worth $1 (approximately), every time you search using Firfox, Mozilla receives $1. (payment by Google, for using their search engine)

Mozilla currently receives $300 million/year via search. Increasing search $ income ... rewards Mozilla as the most open platform and amongst the most innovative organizations on Earth.

Re: Persona is distributed. Today.

#78

Post by shardling »

DannyBee wrote: post #70
marcioaguiar wrote: post #58

Earlier quoted context omitted.

He was just making a point that authentication protocol is a domain choice (from 2-digit passwords to retinal scan). It's up to the users to trust the domain he is going to use as identity. Just like many people trust Facebook Connect.

But facebook at least has standards (or is believed to, i have no knowledge). Why should, for example, google, ever trust, say, fred's discount web hosting, enough to let them login to gmail? Not in the sense of "these guys could compromise gmail" (which is a worry in certain elevated privileges contexts), but more in the sense that "people are still going to say 'my gmail got hacked'" if their gmail gets hacked beca…

For most people, they already use an email account to authenticate. Pretty much every single login I have, someone with access to my primary email account could co-opt with the snap of their fingers.

If your email provider is vulnerable, you're already fucked, except for those accounts which use two-factor auth. And persona isn't intended for your bank/etc.

Re: Persona is distributed. Today.

#79

Post by inopinatus »

wmf wrote: post #66
inopinatus wrote: post #55

I've just read through the Persona protocol specification document at https://github.com/mozilla/id-specs/blob/prod/browserid/inde... and was quite disappointed to find RFC5785 in use, in which HTTP is abused as an infrastructure discovery protocol. This gives a lie to the identity being an "email address". It isn't. Ok, it's structured as a LHS@RHS form but the domain in the RHS isn't an email domain, it's an overlo…

Can JavaScript look up a SRV record?

Javascript can (ISTR there is a pure JS DNS library for node) but perhaps not in the browser without specific browser support. You can say the same about trustworthy crypto, incidentally.

SRV is definitely the ideal record. In this case I can see why a pure HTTP approach was chosen (it avoids browser dependancies) and it irks me that developers of web-based tools tend to develop inside the HTTP bubble rather than using the broad and highly capable infrastructure of the Internet, because this kind of constraining outcome is the result.

SRV would be an excellent choice for HTTP/2.0 as well, rescuing us all from apex quasi-CNAME hacks and the like.

However in my initial remark you can substitute in the use of "a well-known subdomain"[1] for "SRV record" and still achieve a better separation of concerns than simply using the RHS of the identity string.

[1] c.f. DKIM's slightly hackish but effective use of an intermediate underscore to denote infrastructure DNS entries. Won't work for A records though IIRC.

Post reply on HN