Live data from Hacker News

Persona is distributed. Today.

identity.mozilla.com

141–150 of 154 posts

Re: Persona is distributed. Today.

#141

Earlier quoted context omitted.

shrug yep. I'm saying more that there can be an atmosphere of required politeness. I mean, look; the OP asked a really good, terse question and got downvoted presumably because it was 'rude.' That's just silly.

I'm curious how the GP's question can be construed as "good" when there exists a blog post that explicitly addresses it. This indicates the GP didn't do even cursory research to determine the answer for themselves. In other words, the GP was lazy, expecting to be hand-fed, and was down-voted as a result.

Ah! If he was downvoted for asking an easily google-able question then that's reasonable and end of discussion.

The discussion here started because of the statement that he was probably downvoted because "how is this different from X?" is interpreted as "This is stupid, we already have X."

Re: Persona is distributed. Today.

#142

Earlier quoted context omitted.

Understand where you are coming from but this is an overreaction. An HN where you have to wrap a plain, absolutely neutral question like this in a bunch of false praise or meaningless filler words is a much much worse place than the HN that might be overly critical/negative by default (and this perception is partly false, reinforced by the cultural belief that questions are attacks).

On the other hand, paraphrasing what you've said to make a counter-argument: an HN where a peaceful, respectful atmosphere is sustained by thoughtfully worded comments is a much much worse place than an HN where dry, hastily worded comments take some heat.

> thoughtfully worded comments

That's what makes me disagree. I want honest comments and thoughtful reading.

To break that down further:

We have a comment "How is this different from X?" which can be interpreted literally, as an honest question, or with the assumption that what he actually meant is "This is stupid because we already have X".

One solution is to encourage people to write "No offense to the project, It looks interesting but I honestly don't know what differentiates it from X, and if you could explain it in contrast to X I will understand it better since I already understand X"

That's ... ok, but the writer will never anticipate every possible misinterpretation so you will have verbose comments full of fluffy meaningless language and still have the same problem.

The alternative is encouraging people to think about the phrase "benefit of the doubt", what it means and why it's a well known phrase in the first place.

If someone asks "How is this different from X" then you take it to mean what it says, you don't try to guess at what possible negative thing he might have meant. So the replies would all take that comment seriously.

What's the downside? Someones snarky comment would be read as honest and there would be an answer. Who's going to reply with "I actually meant that sarcastically"? Some people might, but they'll just look foolish.

If the choice is between:

1. encouraging a culture where questions are taken as honest questions or 2. one where every question is scrutinized for the slightest possible clue of hidden negative meaning and you have to fill your comment with false praise and legal and marketing language to avoid any possibility of the suggestion of offense

Then the answer is obvious to me.

Re: Persona is distributed. Today.

#143

I still have a funny feeling about the robustness of Persona. For instance - let's say one of my emails gets hacked, my crappy Yahoo email. Does that give them access to my other Persona accounts? Would I (or anyone else) be able to know if the account is compromised? Normally you change your password and that's the end of it, but I'm not sure what happens with Persona. What if my kid brother uses my computer - would…

> Does that give them access to my other Persona accounts? No, it gives them access to whatever site you registered with your Yahoo! account. (EDIT: If you use the temporary bridge they implement, they could get access to your other accounts if they got access to the bridge. This won't happen if your email provider supports Persona natively). > Would I (or anyone else) be able to know if the account is compromised? Y…

Just log out of your email provider.

Really? Is this enough? Elsewhere in this discussion, mention is made of delegating to a different Persona provider. How will your browser (which, near as I can tell, is directing traffic for this protocol, either natively or through an extension) know that clicking "log out" on an email app should make it stop using certs associated with a different Persona app? Even if it were the same provider, perhaps under a different subdomain, this link between email app and everything else seems pretty tenuous. I think there should be an obvious switch to throw in the browser.

Perhaps I'm really misunderstanding things; please advise.

Re: Persona is distributed. Today.

#144
post #102

Persona is nice, because it is simple. It is still important to note that it is an alternative mostly to: "Trust that a user being able to read an email address is proof authenticating said user" -- in other words sites using it have no expectation that the user need any form of authentication before being issued a persona (Similar to eg: shared mail accounts -- where having access to the email does not identify you…

FYI, latest stable Firefox says this: You have asked Firefox to connect securely to cacert.org, but we can't confirm that your connection is secure. Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

FYI, latest stable Firefox says...

I'm sure e12e knows this. If you don't want to see that message, you need to install the CAcert root certificate in your browser or OS. While you're doing that, take a look at all the root certificates that are already in there: you might decide CAcert is more trustworthy than most of those organizations!

Re: Persona is distributed. Today.

#145
post #126

Earlier quoted context omitted.

But requesting a resource without knowing it exists is abusive, and the fact that more and more developers think it's an appropriate means of discovery is becoming a serious problem. It saps resources, fills logs with noise, and can trigger intrusion detection systems. I don't think the Persona project recognizes what a barrier to entry the lack of a reasonable discovery method really is. There are a host of potentia…

The are all good arguments, and again I want to point out that we are considering them. But there is a big security concern with DNS spoofing (and DNSSEC is not quite easy yet.) So it's not an obvious decision.

The DNS spoofing threat already existed; you have TLS as a partial mitigation. DNSSEC w/DANE is a better mitigation. (Ok, plenty of warts in DNSSEC but it is available today). I'd be more worried about the malicious web developer threat - it's almost trivial to exploit.

Generally - if one is going to throw around the word "federated" but without properly leveraging the DNS, then the wheel is probably being reinvented; along with a host of layering violations that result in the many misbehaviours discussed here.

The absence of SRV lookup capability in Mozilla is open issue (bug #14328) since 1999.

Re: Persona is distributed. Today.

#146

Earlier quoted context omitted.

FYI, latest stable Firefox says this: You have asked Firefox to connect securely to cacert.org, but we can't confirm that your connection is secure. Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

FYI, latest stable Firefox says... I'm sure e12e knows this. If you don't want to see that message, you need to install the CAcert root certificate in your browser or OS. While you're doing that, take a look at all the root certificates that are already in there: you might decide CAcert is more trustworthy than most of those organizations!

Indeed. For some painful background, see eg:

  https://bugzilla.mozilla.org/show_bug.cgi?id=215243
A fundamental problem with x509 and Certificate Authorities as it currently stands wrt https and browsers, is that all users almost randomly trust a few organizations to issue certificates -- and get warned of any other certificates -- but there is no decision on part of the user who they trust -- just some vague delegation to browser vendors on vetting CAs.

For some more background, I suggest reading:

  http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity/
edit: Also, I tend to forget that cacert isn't included, as Debian are among the distributions that include them as a CA:

  http://wiki.cacert.org/InclusionStatus

Re: Persona is distributed. Today.

#147

Earlier quoted context omitted.

> Does that give them access to my other Persona accounts? No, it gives them access to whatever site you registered with your Yahoo! account. (EDIT: If you use the temporary bridge they implement, they could get access to your other accounts if they got access to the bridge. This won't happen if your email provider supports Persona natively). > Would I (or anyone else) be able to know if the account is compromised? Y…

Just log out of your email provider. Really? Is this enough? Elsewhere in this discussion, mention is made of delegating to a different Persona provider. How will your browser (which, near as I can tell, is directing traffic for this protocol, either natively or through an extension) know that clicking "log out" on an email app should make it stop using certs associated with a different Persona app? Even if it were t…

It's the same as Facebook Connect. Logging out of Facebook doesn't log you out of all the connected sites, but it does prevent you from logging in to others, which is what the GP was asking.

Re: Persona is distributed. Today.

#148

Earlier quoted context omitted.

Just log out of your email provider. Really? Is this enough? Elsewhere in this discussion, mention is made of delegating to a different Persona provider. How will your browser (which, near as I can tell, is directing traffic for this protocol, either natively or through an extension) know that clicking "log out" on an email app should make it stop using certs associated with a different Persona app? Even if it were t…

It's the same as Facebook Connect. Logging out of Facebook doesn't log you out of all the connected sites, but it does prevent you from logging in to others, which is what the GP was asking.

That is not my interpretation of the original question, but thanks for clarifying.

This discussion points to a potential for a sort of confusion we've seen before. It used to be a big user education problem to get all users to press the "log out" button when they were done using a site, especially on "public" computers. To some people maybe this is still a problem? (Actually, before that it was a bit of a struggle getting sites to implement "log out" functionality, and we just had session cookies multiplying everywhere.)

If my browser has stored Persona certs associated with various sites but gives me no visual indication of that, it's very possible that I might become confused about where and whether I'm logged in. The various sites to which I'm logged in might have different requirements for auto-logout, etc. It seems that Persona is trying to ignore these issues a bit by saying "this is just for low-value authentication", but fixing the problem seems possible. Incorporating Persona functionality into the browser should allow better security notifications than are possible just through HTML/JS/CSS from individual sites. The user should have the option to easily throw away certs (i.e. without clicking through a bunch of "Settings" dialogs), and should have the information she needs to know when to do that.

Re: Persona is distributed. Today.

#149

Earlier quoted context omitted.

It's the same as Facebook Connect. Logging out of Facebook doesn't log you out of all the connected sites, but it does prevent you from logging in to others, which is what the GP was asking.

That is not my interpretation of the original question, but thanks for clarifying. This discussion points to a potential for a sort of confusion we've seen before. It used to be a big user education problem to get all users to press the "log out" button when they were done using a site, especially on "public" computers. To some people maybe this is still a problem? (Actually, before that it was a bit of a struggle ge…

Oh, yes. Persona now integrates with logouts as well, so they know when you click "log out" from a site and the user agent can prompt the user to log out of Persona completely or just that site. I don't think they can tell every site you're logged into to log you out by logging out from one site, though.

Re: Persona is distributed. Today.

#150

Earlier quoted context omitted.

That is not my interpretation of the original question, but thanks for clarifying. This discussion points to a potential for a sort of confusion we've seen before. It used to be a big user education problem to get all users to press the "log out" button when they were done using a site, especially on "public" computers. To some people maybe this is still a problem? (Actually, before that it was a bit of a struggle ge…

Oh, yes. Persona now integrates with logouts as well, so they know when you click "log out" from a site and the user agent can prompt the user to log out of Persona completely or just that site. I don't think they can tell every site you're logged into to log you out by logging out from one site, though.

That's really interesting. I had previously assumed that the stored cert was per-user and available for many sites, with each site using its stored cert from the Persona provider to validate the user cert from the client. (I'm not sure why I assumed that.) Now I see that it's per-user and per-site. The more I learn the more I like Persona.
Post reply on HN