Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona makes signing in easy for Gmail users

identity.mozilla.com

Post reply on HN
Print view View original

91–100 of 122 posts

Re: Persona makes signing in easy for Gmail users

#91

Post by Amadou »

The problem with persona is that it sends the same identifier to all websites (nominally your email address). That makes it super-easy for those websites to feed your activity to a central tracker like DoubleClick which will consolidate all usage information from all DoubleClick affiliated websites.

Persona would be a lot more privacy-preserving if it generated a unique identifier for each website. A "persona" for each website instead of one persona for the entire interwebz. Since the system is mostly automated it shouldn't be that hard to add one extra layer of indirection.

It might even be possible to shoe-horn it in to the current protocol with just a little bit extra on the browser and identity provider sides, but no change on the website code.

If anyone has actually done that, please post, I'd like to hear about it. Availability of that functionality would sway me to start using Persona and probably anyone else who is worried about spreading their email adddress far and wide across the internet.

Re: Persona makes signing in easy for Gmail users

#92

Post by croikle »

eslaught wrote: post #90

Does this mean that Google implemented a Persona endpoint for Gmail, or that Mozilla is now using OpenID (or whatever it is Google uses now) to piggyback on Google's existing login mechanisms?

Judging by [1], the latter.

1: http://identity.mozilla.com/post/56526022621/what-is-an-iden...

Re: Persona makes signing in easy for Gmail users

#93

Post by Amadou »

Skalman wrote: post #61
trimbo wrote: post #53

Earlier quoted context omitted.

I highly recommend using Chrome's multiple user feature to log into your separate gmail accounts. This is the only thing that has kept me sane at the last couple companies where we used Google Apps.

I use Firefox... and I don't think I wan't to be logged into multiple accounts - it's just that now Persona requires it.

FWIW - firefox has supported multiple profiles for years, long before Chrome even existed.

Run it with the following command-line arguments: -ProfileManager -new-instance

That brings up a profile picker/creater. Each profile is isolated, different plugins, different cookies, etc. The only information leakage is when a plugin keeps its own data outside of the profile directory, like Adobe Flash keeps its version of cookies in a per-user directory rather than a per-profile directory.

Re: Persona makes signing in easy for Gmail users

#95

Post by callahad »

eslaught wrote: post #90

Does this mean that Google implemented a Persona endpoint for Gmail, or that Mozilla is now using OpenID (or whatever it is Google uses now) to piggyback on Google's existing login mechanisms?

Croikle's right. This is using Google's public OpenID endpoint to validate your email address, and bootstrap a Persona certificate. We did this independently of Google, though we are in informal contact with the relevant folks on that side of the Valley.

Re: Persona makes signing in easy for Gmail users

#96

Post by callahad »

Amadou wrote: post #91

The problem with persona is that it sends the same identifier to all websites (nominally your email address). That makes it super-easy for those websites to feed your activity to a central tracker like DoubleClick which will consolidate all usage information from all DoubleClick affiliated websites. Persona would be a lot more privacy-preserving if it generated a unique identifier for each website. A "persona" for ea…

Persona isn't a panacea. If websites collude, and you use the same address on each site, then they'll be able to correlate their user tables.

That's identical to the status quo, and fixing it is not one of Persona's explicit goals.

We're very consciously trying to hit a pragmatic middle ground that moves the web closer to user empowerment, without being so different as to hinder adoption. Consider: if you're already collecting email addresses for your users, you can immediately start using Persona without changing any of your assumptions about your data model. It's portable and it dovetails into current practices.

However, it is technically possible to do what you want right now, so long as you have your own domain and write a small browser extension. Longer term, we're currently working with a partner on a possible extension to the provider protocol which would make it easier to implement that sort of "directed identity."

Re: Persona makes signing in easy for Gmail users

#97

Post by ubernostrum »

clarkevans wrote: post #7

I'm looking forward to when their LDAP adapter [1] is ready for prime-time so that we can use it internally for our own email addresses. I'm curious if the GMail adapter would work if you host your company email at google? [1] https://github.com/mozilla/vinz-clortho/

As callahad pointed out, it's already in use for some Mozilla sites, and I at least haven't seen any problems with it. In fact, I just logged into one (with my Mozilla LDAP credentials) earlier today :)

Re: Persona makes signing in easy for Gmail users

#98

Post by williamsharkey »

1. Why the popup window?

2. Are developers permitted to strip the Persona branding - to make the login process seem to flow with the current website - not a bolt on?

3. Would you consider including tiny profile icon links next to the button itself, to facilitate single-click profile sign-on/switch?

Re: Persona makes signing in easy for Gmail users

#99

Post by voltagex_ »

ozten wrote: post #46
gioele wrote: post #16

I hope there will soon be a way to `apt-get install mozilla-persona` on a personal server. That would seriously help the deployment a really decentralized Persona.

Tell me more! Do you want Persona authentication on your website or do you want a deamon that is an identity provider for your personal domain? What language or platform would be ideal?

Here's another one:

There's a couple of posts on meta.discourse.org asking how to integrate Discourse with an existing Single Sign On (assume all users have email addresses)

With Persona on a LAN-side server, you could even have emails like janesmith@intranet.local and it'd still be seamless.

Re: Persona makes signing in easy for Gmail users

#100

Post by callahad »

williamsharkey wrote: post #98

1. Why the popup window? 2. Are developers permitted to strip the Persona branding - to make the login process seem to flow with the current website - not a bolt on? 3. Would you consider including tiny profile icon links next to the button itself, to facilitate single-click profile sign-on/switch?

> 1. Why the popup window?

Persona follows the LIFD architecture: http://www.open-mike.org/entry/lifding-the-web

Popups allow us to create a nice messaging channel between the shim / localstorage at persona.org and the website the user is trying to log into, without losing their state on that website.

> 2. Are developers permitted to strip the Persona branding - to make the login process seem to flow with the current website - not a bolt on?

Sure. Brand it however you want. "Sign in with your email" converts best. The popup will always follow the same basic form, but you are able to add your logo, a human readable name, and a background color to influence its design: http://identity.mozilla.com/post/55796551587/persona-a-login...

Check out the login on https://see.drupalpersona.me https://webmaker.org and https://ting.com for examples.

> 3. Would you consider including tiny profile icon links next to the button itself, to facilitate single-click profile sign-on/switch?

Our UX folks are actively experimenting with this. Look for Ryan Feeley's posts on the dev-identity mailing list for some explorations.

Post reply on HN