Note:
both 2 digits passwords and webcam based retina scans are terribly weak. Always upsets me when sarcasm like this is used, and the author is horribly wrong;-)
Persona is distributed. Today.
91–100 of 154 posts
Re: Persona is distributed. Today.
#92How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…
Firefox supports Persona and they're not going to support OpenID.
It's worth pointing out that, a couple of years ago, we tried to make OpenID easier through Firefox integration. There was no good way to do it. The OpenID protocol doesn't lend itself to browser mediation. (In addition to the other usability and privacy problems mentioned above.)
Re: Persona is distributed. Today.
#93Outstanding work, Mozilla. Parallel to when they broke the I-E monopoly, Mozilla is truly impressive lately. Best way to support the new creativity surge by Mozilla - re-adopt Firefox as your MAIN browser. With each search worth $1 (approximately), every time you search using Firfox, Mozilla receives $1. (payment by Google, for using their search engine) Mozilla currently receives $300 million/year via search. Increa…
Thanks!
Another good way to help Mozilla make the Web better for all is to implement Persona on web sites you build. It's easy and respects your users. Here's how you can do it in an hour or less:
Re: Persona is distributed. Today.
#94Earlier quoted context omitted.
What's wrong with being polite? It doesn't cost any extra and there are a lot of people who appreciate it.
Not anything wrong with being polite. Plenty wrong with requiring people to be polite.
You're not required to be polite, but you may be downvoted.
Re: Persona is distributed. Today.
#95I've just read through the Persona protocol specification document at https://github.com/mozilla/id-specs/blob/prod/browserid/inde... and was quite disappointed to find RFC5785 in use, in which HTTP is abused as an infrastructure discovery protocol. This gives a lie to the identity being an "email address". It isn't. Ok, it's structured as a LHS@RHS form but the domain in the RHS isn't an email domain, it's an overlo…
>This creates a significant barrier to adoption. No, not really. Because Mozilla is running the Fallback server in the meantime.
On the contrary, it means that companies (already deterred by the technical issues) don't even have to bother. It's actually another barrier to entry, only more subtle. It's an incentive not to bother deploying an IdP, which is the adoption I'm talking about and that is necessary to call it "federated". One might liken it to government subsidies for the incumbents in an industry.
There's no "meantime" here - unless a Very Large Social Network adopts this protocol, I suspect the Fallback server will be the IdP most people use.
Re: Persona is distributed. Today.
#96Earlier quoted context omitted.
He was just making a point that authentication protocol is a domain choice (from 2-digit passwords to retinal scan). It's up to the users to trust the domain he is going to use as identity. Just like many people trust Facebook Connect.
But facebook at least has standards (or is believed to, i have no knowledge). Why should, for example, google, ever trust, say, fred's discount web hosting, enough to let them login to gmail? Not in the sense of "these guys could compromise gmail" (which is a worry in certain elevated privileges contexts), but more in the sense that "people are still going to say 'my gmail got hacked'" if their gmail gets hacked beca…
I think the criticism that we haven't made a strong enough point of why this makes the Web more secure is legitimate. We haven't made this point as well as I'd like.
I'll take that as inspiration for a future blog post. Thanks for pushing us, please continue to do so. We listen.
Re: Persona is distributed. Today.
#97I tried to boot the example app eyedee.me and it's unable to find this tarball from the package.json: https://github.com/benadida/node-client-sessions/tarball/92f...
Sorry, that's my bad. It's fixed now if you pull the latest eyedee.me.
Re: Persona is distributed. Today.
#98Earlier quoted context omitted.
Can you elaborate on that? OpenID was designed to be browser-independent. Persona is essentially a distributed openID with some extra browser integration. Sure Mozilla doesn't support openID, but I'm unsure what you would want them to do...
Without browser support, you have to type your ID into every site. (I'm ignoring Nascar login because that's not distributed.) With browser support you just click to login and maybe click again to confirm.
Here is a Firefox add-ons to add the missing "browser support":
https://addons.mozilla.org/en-US/firefox/addon/openid-for-fi...
(I have not actually tested this add-on myself.)
Re: Persona is distributed. Today.
#99I don't understand how this is an advantage over just using email address as username with a password, like many sites do already. Can someone please explain the benefit? [Edit: message to user Anonymous09, who replied to me below - you appear to have been hellbanned since the past three weeks. Thought you ought to know.]
Every time you create an account at a new site, you're opening up a way to get hacked. Because, like most humans, you probably reuse passwords, or at least have password similarities. And many web sites tend not to have the resources to properly secure their user database.
So, accounts on every new site you visit is both inconvenient and slowly degrades your security.
You could switch to centralized identity silos, logging in with Facebook or Google everywhere you go. Now you've got the problem that these big companies are tracking your every move, enforcing "real-name" policies forcing you to unify all of your web activity into one account, etc.
Persona is the best of both worlds: convenience and reduced security exposure, plus your choice of identity wherever you go with much better privacy.
Re: Persona is distributed. Today.
#100Earlier quoted context omitted.
How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)
The service you log into knows the identity provider's public key and a cert for the user (the user's public key signed by the identity provider). The service can verify the user's cert against the identity provider's public key with this information. The service initially contacts the identity provider to get the provider's public key, so the identity provider can infer that someone is attempting to log into the ser…
This is an incomplete definition of privacy. If the service and server collude, you are hosed. There are cryptographic constructions(anonymous credentials) that have been around for over a decade that prevent this. IBM and Microsoft both have (unfortunately incompatible) libraries that do this. If we really are trying to build the id scheme of the future, why not use these?