Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona is distributed. Today.

identity.mozilla.com

Post reply on HN
Print view View original

111–120 of 154 posts

Re: Persona is distributed. Today.

#111

Post by sliverstorm »

freshhawk wrote: post #57
martinced wrote: post #37

Earlier quoted context omitted.

I didn't downvote it but I think I know why: there's a huge wave of negativity on HN and your question sounds like criticism. There are ways to formulate the same question which would be much nicer and less negative, for example: "It's great to see other solutions providing things similar to OpenID. Can anyone explain what are the differences with OpenID?" Simply writing: "How is this different from XXX?" just sounds…

Understand where you are coming from but this is an overreaction. An HN where you have to wrap a plain, absolutely neutral question like this in a bunch of false praise or meaningless filler words is a much much worse place than the HN that might be overly critical/negative by default (and this perception is partly false, reinforced by the cultural belief that questions are attacks).

For better or worse, the former is what HN usually seems to be. I remember when I started using the site, I spent several weeks learning to write in the fashion of the former to avoid all the negative reactions.

Re: Persona is distributed. Today.

#113

Post by vdm »

rfk wrote: post #83
JoshTriplett wrote: post #14

Currently wondering the most sensible approach to make a single-user website support this protocol, so that I can make my email address (the only valid email address at my domain) support Persona natively. I don't really want to have to set up a username/password system with a single user. I'd almost prefer to manually hand my identity's private key to each browser I want to use. I wonder how much work it would take…

I recently set up my personal domain as an identity provider, using static HTML/javascript files and a bit of crypto: https://www.rfk.id.au/blog/entry/persona-identity-provider/ There are some things to be mindful of w.r.t. security in this approach, but it seems to work very nicely for me.

Clickable: https://www.rfk.id.au/blog/entry/persona-identity-provider/

Re: Persona is distributed. Today.

#114

Post by iSnow »

callahad wrote: post #28
csense wrote: post #12

How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…

In brief, Persona offers a dramatically better privacy model, developer experience, and user experience. The protocol is decentralized and designed from the ground up to be built into the browser natively. Re: Downvotes: It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating. I imagine a lot of folks here are just tired of the repetition.

>It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating

It would be nice if you created a example Persona-enabled web application (some lines of gulp PHP or heck even a VirtualBox image), push it to bitbucket/github/whatever and link to the repo from http://www.mozilla.org/en-US/persona/. Does not need any functionality, just a login screen using Persona and a "it works" page you reach after logging in. And maybe sample ID provider code too. Extra cookie points if the "it works" page explains the structure of this Proof of Concept application and how the Persona protocol was used.

This way, a curious developer could pull the source, have a Persona-enabled template app and his own ID provider up and running in minutes and could play around with it, evangelize it in his organization etc. If it "feels" right, said developer would read the docs afterwards to move beyond the Proof of Concept.

Re: Persona is distributed. Today.

#117

Post by AndrewDucker »

supervillain wrote: post #115

Is Persona reviving the old Microsoft Passport? Microsoft first implemented this in early 2000s, I remember Microsoft Passport marketing the single sign-on feature, it did not catch up. http://www.nytimes.com/2001/09/20/technology/20SOFT.html

Except that Passport meant using a single authority (Microsoft), whereas Persona is entirely federated (once individual domains opt-in).

Re: Persona is distributed. Today.

#118

Post by jackalope »

badida wrote: post #86
inopinatus wrote: post #55

I've just read through the Persona protocol specification document at https://github.com/mozilla/id-specs/blob/prod/browserid/inde... and was quite disappointed to find RFC5785 in use, in which HTTP is abused as an infrastructure discovery protocol. This gives a lie to the identity being an "email address". It isn't. Ok, it's structured as a LHS@RHS form but the domain in the RHS isn't an email domain, it's an overlo…

We're discussing the addition of a DNS discovery option. Not clear yet that this is something that can be secured as well as HTTPS discovery (which I don't consider abusive, given the number of systems that do it already.) But it's on our radar: https://github.com/mozilla/browserid/issues/1523

But requesting a resource without knowing it exists is abusive, and the fact that more and more developers think it's an appropriate means of discovery is becoming a serious problem. It saps resources, fills logs with noise, and can trigger intrusion detection systems.

I don't think the Persona project recognizes what a barrier to entry the lack of a reasonable discovery method really is. There are a host of potential issues:

1. For the alice@example.com identifier, it assumes that example.com has an A record. Many, many organizations choose not to have an A record at the top level, while still publishing an MX record to support email addresses.

2. If there is an A record, it assumes that there is a web server listening on port 443. If there isn't, /.well-known/browserid can't be retrieved. What is the fallback mechanism, and how does it affect our users if we adopt Persona in the future? What if this probe is flagged by an IDS, blacklisting the source IP?

3. If there is a web server listening on port 443, it assumes that it will serve resources for example.com. What if it doesn't and gets the /.well-known/browserid from the default host, which is an entirely different domain? What if this probe for an unsupported host is flagged by an IDS, blacklisting the source IP? What if example.com isn't the CN or a SubjectAltName in the SSL certificate? Is the certificate validated? Do I now have to purchase a commercial certificate for a domain that I never intended to be a web site?

4. When a user first enters an identifier, such as alice@example.com, it assumes this is not only a valid email address, but a valid login. What happens if a user has used an email alias in the fallback that cannot be used to authenticate in our system when we adopt Persona? What if the organization doesn't support Persona, and doesn't want its domain used in the fallback mechanism? Is there an inherent identity theft risk in using a fallback system? Can a rogue web developer create a temporary /.well-known/browserid and backend that will allow them to authenticate as anyone at the organization, then cover their tracks by removing the file?

All of these issues can be neatly solved with DNS discovery. If an organization wants to support Persona, let it publish an SRV record. If one doesn't exist, Persona should tell the user, "Your domain does not support Persona."

Re: Persona is distributed. Today.

#119

Post by jackalope »

inopinatus wrote: post #95
shardling wrote: post #81

Earlier quoted context omitted.

>This creates a significant barrier to adoption. No, not really. Because Mozilla is running the Fallback server in the meantime.

On the contrary, it means that companies (already deterred by the technical issues) don't even have to bother. It's actually another barrier to entry, only more subtle. It's an incentive not to bother deploying an IdP, which is the adoption I'm talking about and that is necessary to call it "federated". One might liken it to government subsidies for the incumbents in an industry. There's no "meantime" here - unless a…

Even worse, Persona promises that "Developers get a verified email address for all of their users," which might be mistakenly construed as some degree of identity assurance, which can't be guaranteed by this system at all, especially when a fallback is involved.

Re: Persona is distributed. Today.

#120

Post by arethuza »

martinced wrote: post #37
csense wrote: post #12

How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…

I didn't downvote it but I think I know why: there's a huge wave of negativity on HN and your question sounds like criticism. There are ways to formulate the same question which would be much nicer and less negative, for example: "It's great to see other solutions providing things similar to OpenID. Can anyone explain what are the differences with OpenID?" Simply writing: "How is this different from XXX?" just sounds…

"How is this different from XXX?"

That just sounds like a direct question to me - not rude or negative.

"It's great to see other solutions providing things similar to OpenID"

I don't see what that adds - everyone reading this already knows it is a solution similar to OpenID so why restate it?

Note that I also apologise if you think this reply is rude - I'm really not meaning to be.

Post reply on HN