31–40 of 122 posts
I'm really glad they finally added this. Persona is a great way to login and better for developers and users.
Really excited for this. Password authentication is an absolute disaster on the Internet, and despite at least 8 years of development solutions like OpenID are not succeeding fast enough. Mozilla Persona looks really promising. Sure wish there were a Chrome extension for it!
(Persona works on all major browsers, save MobileIE and Chrome for iOS. Fixes are in the works for those two.)
Earlier quoted context omitted.
It used some another (failed?) provider before (which connected accounts to Gmail, Yahoo, etc.)
HN was using Clickpass (YC Summer 07), which was acquired and shuttered by Janrain early last year. Amusingly enough, Stack Overflow still has a (broken) Clickpass button on its login page. If I recall correctly, Clickpass was a centralized OpenID proxy, whereas Persona is trying to bootstrap a fully decentralized protocol. We don't want to even be able to track you. :) [Edit: Corrected YC cohort. Thanks wamatt!]
Then a few years later (2012), Yola sold the IP and users to Janrain [2]
[1] https://news.ycombinator.com/item?id=402973
[2] http://janrain.com/clickpass-acquired-by-janrain/
EDIT: my pleasure callahad :)
I'm really glad they finally added this. Persona is a great way to login and better for developers and users.
What is the benefit of this (from a developer/website perspective) over using OpenID? I can't really see the difference... obviously I'm missing something fundamental...
- Persona works with any email address. This means you can reach anyone that hits your site, without forcing them to sign up with a third party provider.
- I can answer the question "what email address do you want to log in with?" I can't answer the question "what is your OpenID?" nor can I remember which of the 13 buttons on Stack Overflow I used last.
- OpenID requires phoning home with every login transaction. Persona explicitly does not. Your provider doesn't get to learn where you are logging in.
Edit: Put another way, can you tell me what your Google OpenID URL is without cheating? Can most people? If not, then you're only able to select a provider from a predetermined whitelist on each website. That undermines your ability to self-identify, self-assert, and choose who you trust. The open web deserves better.
I'm really glad they finally added this. Persona is a great way to login and better for developers and users.
What is the benefit of this (from a developer/website perspective) over using OpenID? I can't really see the difference... obviously I'm missing something fundamental...
https://developer.mozilla.org/en-US/docs/Mozilla/Persona/Why...
Someone still needs to solve the "what verifier do I use problem" in a decentralized way, or we're going to see Persona follow OAuth and be dominated by Google, Facebook, and Twitter accounts.
(Persona always prompts you with a completely free-form email input field and routes you to the appropriate provider based on that.)
Earlier quoted context omitted.
You almost always want their email address so that you can email them a password reset link in case they forget their password, which is even more important on smaller obscure sites where that's bound to happen.
If users don't want to provide an email (and then can't reset their password), that should be their prerogative.