Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why we love Mozilla Persona

blog.zonino.co.uk

Post reply on HN
Print view View original

1–10 of 164 posts

Re: Why we love Mozilla Persona

#3

Post by lazyjones »

This doesn't work with JS disabled, with no indication that it doesn't work as intended (it just bounces the visitor back and forth between 2 pages).

Persona is very convenient for users, but it would be more secure to not trust a 3rd party.

Re: Why we love Mozilla Persona

#7

Post by pdpi »

lazyjones wrote: post #3

This doesn't work with JS disabled, with no indication that it doesn't work as intended (it just bounces the visitor back and forth between 2 pages). Persona is very convenient for users, but it would be more secure to not trust a 3rd party.

My understanding of the technology is that the endgame for persona is that you don't have to trust a third party. Instead, the authentication will be provided by the browser itself (the protocol behind Persona is called Browser ID). The current implementation is just a shim until browsers provide support for it natively.

Re: Why we love Mozilla Persona

#8

Post by jimktrains2 »

But, this doesn't solve the issue that you're still trusting someone else with your secret (your password).

We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password.

[0]: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different identities (username/password combinations) are encouraged currently is because providers can't be trusted with the secret of your password.

Re: Why we love Mozilla Persona

#9

Post by kn8 »

lotsofcows wrote: post #2

So what happens when my Person account gets compromised? I'll stick to my many accounts / many passwords approach, I think.

Use 2 factor auth to mitigate that? To me that seems safer than having 100s of different accounts with no support for 2 auth.

Re: Why we love Mozilla Persona

#10

Post by ubernostrum »

jimktrains2 wrote: post #8

But, this doesn't solve the issue that you're still trusting someone else with your secret (your password). We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password. [0]: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different i…

this doesn't solve the issue that you're still trusting someone else with your secret (your password)

If you run your own identity provider, you are only trusting yourself with your secret.

Also, nothing about Persona requires password-based authentication -- you can use any mechanism you like to authenticate to your identity provider.

Post reply on HN