Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona is distributed. Today.

identity.mozilla.com

Post reply on HN
Print view View original

131–140 of 154 posts

Re: Persona is distributed. Today.

#131

Post by StavrosK »

lubujackson wrote: post #130
StavrosK wrote: post #51

Earlier quoted context omitted.

> Does that give them access to my other Persona accounts? No, it gives them access to whatever site you registered with your Yahoo! account. (EDIT: If you use the temporary bridge they implement, they could get access to your other accounts if they got access to the bridge. This won't happen if your email provider supports Persona natively). > Would I (or anyone else) be able to know if the account is compromised? Y…

Ah, thanks for those answers.

You are very welcome!

Re: Persona is distributed. Today.

#132

Post by daemon13 »

e12e wrote: post #102

Persona is nice, because it is simple. It is still important to note that it is an alternative mostly to: "Trust that a user being able to read an email address is proof authenticating said user" -- in other words sites using it have no expectation that the user need any form of authentication before being issued a persona (Similar to eg: shared mail accounts -- where having access to the email does not identify you…

FYI, latest stable Firefox says this:

You have asked Firefox to connect securely to cacert.org, but we can't confirm that your connection is secure. Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

Re: Persona is distributed. Today.

#133

Post by 18pfsmt »

Helianthus wrote: post #101
cpeterso wrote: post #94

Earlier quoted context omitted.

You're not required to be polite, but you may be downvoted.

shrug yep. I'm saying more that there can be an atmosphere of required politeness. I mean, look; the OP asked a really good, terse question and got downvoted presumably because it was 'rude.' That's just silly.

I'm curious how the GP's question can be construed as "good" when there exists a blog post that explicitly addresses it. This indicates the GP didn't do even cursory research to determine the answer for themselves. In other words, the GP was lazy, expecting to be hand-fed, and was down-voted as a result.

Re: Persona is distributed. Today.

#134

Post by callahad »

iSnow wrote: post #114
callahad wrote: post #28

Earlier quoted context omitted.

In brief, Persona offers a dramatically better privacy model, developer experience, and user experience. The protocol is decentralized and designed from the ground up to be built into the browser natively. Re: Downvotes: It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating. I imagine a lot of folks here are just tired of the repetition.

>It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating It would be nice if you created a example Persona-enabled web application (some lines of gulp PHP or heck even a VirtualBox image), push it to bitbucket/github/whatever and link to the repo from http://www.mozilla.org/en-US/persona/ . Does not need any functionality, just a login screen using Person…

That sounds like a great idea. We could probably build something similar on NudgePad.com (YC, WebFWD) so interested folks could quickly have a forkable, runnable Persona sandbox.

Look for it soon. :)

Re: Persona is distributed. Today.

#135

Post by Flimm »

DannyBee wrote: post #85
shardling wrote: post #78

Earlier quoted context omitted.

For most people, they already use an email account to authenticate. Pretty much every single login I have, someone with access to my primary email account could co-opt with the snap of their fingers. If your email provider is vulnerable, you're already fucked , except for those accounts which use two-factor auth. And persona isn't intended for your bank/etc.

But your argument is essentially "we're just as fucked as we are now". Okay, so then, uh, what problem have we solved? Now we are fucked, after we're just as fucked but not using facebook as the identity provider? I guess i don't see this as much of an improvement? Honestly, i'm not trying to be snarky. I'm just trying to understand why this seems to be presented as leaps and bounds above what we have now when it see…

It means users don't have to create and remember a new password for every site they register to, which has security problems.

Re: Persona is distributed. Today.

#136

Post by lifeisstillgood »

anologwintermut wrote: post #100
csense wrote: post #48

Earlier quoted context omitted.

The service you log into knows the identity provider's public key and a cert for the user (the user's public key signed by the identity provider). The service can verify the user's cert against the identity provider's public key with this information. The service initially contacts the identity provider to get the provider's public key, so the identity provider can infer that someone is attempting to log into the ser…

This is an incomplete definition of privacy. If the service and server collude, you are hosed. There are cryptographic constructions(anonymous credentials) that have been around for over a decade that prevent this. IBM and Microsoft both have (unfortunately incompatible) libraries that do this. If we really are trying to build the id scheme of the future, why not use these?

Can you provide links?

Re: Persona is distributed. Today.

#137

Post by anologwintermut »

lifeisstillgood wrote: post #136
anologwintermut wrote: post #100

Earlier quoted context omitted.

This is an incomplete definition of privacy. If the service and server collude, you are hosed. There are cryptographic constructions(anonymous credentials) that have been around for over a decade that prevent this. IBM and Microsoft both have (unfortunately incompatible) libraries that do this. If we really are trying to build the id scheme of the future, why not use these?

Can you provide links?

Sure, though unfortunately I know of none that provide a decent balance between high level explanations and cryptographic depth.

The main actual deployed usage of the technique is in TPM's for direct anonymous attestation. http://en.wikipedia.org/wiki/Direct_Anonymous_Attestation

IBM explains their project here http://www.zurich.ibm.com/idemix/details.html

The original academic work its based on is this http://cs.brown.edu/~anna/papers/cl01a.pdf

A different(and older) technique which, by my understanding, is mainly useful for smart cards, is deployed in a prototype system from microsoft : http://research.microsoft.com/en-us/projects/u-prove/

Re: Persona is distributed. Today.

#138

Post by drdaeman »

csense wrote: post #12

How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…

Persona allows you to keep your network activity private from providers. It's the same in a couple of important aspects, though:

1. You still have to remember which email you had used to login. This was heavily criticized with OpenID ("did I login with Google or MyOpenID?" kind of situation). With emails it just got worse, as you will have problem, especially if you're trying to fight spam using service-specific emails (hackernews@foo.example.org).

2. You still can't "migrate" from one email address to another. Shall your email provider go down or you lose your domain - you lose your identity.

3. You still don't own your own identity. The identity is just leased to you by your email provider (or your domain registrar).

Re: Persona is distributed. Today.

#139

Post by iSnow »

callahad wrote: post #134
iSnow wrote: post #114

Earlier quoted context omitted.

>It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating It would be nice if you created a example Persona-enabled web application (some lines of gulp PHP or heck even a VirtualBox image), push it to bitbucket/github/whatever and link to the repo from http://www.mozilla.org/en-US/persona/ . Does not need any functionality, just a login screen using Person…

That sounds like a great idea. We could probably build something similar on NudgePad.com (YC, WebFWD) so interested folks could quickly have a forkable, runnable Persona sandbox. Look for it soon. :)

Great, thanks :)

Re: Persona is distributed. Today.

#140

Post by drdaeman »

saljam wrote: post #123
inopinatus wrote: post #55

I've just read through the Persona protocol specification document at https://github.com/mozilla/id-specs/blob/prod/browserid/inde... and was quite disappointed to find RFC5785 in use, in which HTTP is abused as an infrastructure discovery protocol. This gives a lie to the identity being an "email address". It isn't. Ok, it's structured as a LHS@RHS form but the domain in the RHS isn't an email domain, it's an overlo…

I agree. To me, Webfinger+OpenID seems like a more sensible solution. At least in principle. The only downside is that OpenID lacks BrowserID's privacy bits. http://code.google.com/p/webfinger/

I believe http://gpgauth.org/ is better (except that it lacks strong community and PR from browser vendors).

No need for per-site passwords (the only passwords are master password and, possibly, secret for key escrow). No need for any discovery and third parties, as you're identified by your own key, which contains a name (or nickname or whatever) — the most natural approach to identities (which has minor problem with nickname collisions, but that's about it). And, privacy-wise — no need to reveal email address if you don't want it, too.

Edit/Add: WebID looks even more nice http://webid.info/, as it's actively developed by W3C WebID Community Group, while gpgAuth development is stalled and project seems dead.

Post reply on HN