11–20 of 164 posts
So what happens when my Person account gets compromised? I'll stick to my many accounts / many passwords approach, I think.
Use 2 factor auth to mitigate that? To me that seems safer than having 100s of different accounts with no support for 2 auth.
Any account will be compromised - it's only a matter of time. When that happens, it's best (as recent articles in Wired, Ars Technica and others demonstrate) to have a broad account "ecosystem".
But, this doesn't solve the issue that you're still trusting someone else with your secret (your password). We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password. [0]: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different i…
You should avoid reusing your passwords across sites. BTW Persona helps you with that.
Earlier quoted context omitted.
Use 2 factor auth to mitigate that? To me that seems safer than having 100s of different accounts with no support for 2 auth.
2FA is a nice add one but not a panacea. Any account will be compromised - it's only a matter of time. When that happens, it's best (as recent articles in Wired, Ars Technica and others demonstrate) to have a broad account "ecosystem".
What about Facebook/Google/Twitter Sign In buttons - do you think Persona is an improvement over those?
But, this doesn't solve the issue that you're still trusting someone else with your secret (your password). We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password. [0]: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different i…
You may as well generate onetime junk password, feed it into persona and later rely on password manager to remember it for you. You should avoid reusing your passwords across sites. BTW Persona helps you with that.
But, this doesn't solve the issue that you're still trusting someone else with your secret (your password). We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password. [0]: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different i…
this doesn't solve the issue that you're still trusting someone else with your secret (your password) If you run your own identity provider, you are only trusting yourself with your secret. Also, nothing about Persona requires password-based authentication -- you can use any mechanism you like to authenticate to your identity provider.
Good point.
> Also, nothing about Persona requires password-based authentication -- you can use any mechanism you like to authenticate to your identity provider.
Good point. However, since noöne uses SRP or anything similar, de facto you're still sharing a secret (unless you're running your own provider).
We don't know your password. Google doesn't know you're signing in to Zonino... mozilla knows ;)
Also, iirc, Google doesn't have to know where you're signing in either. I'll have to double check that part.
What happens to my account if Persona dies or is temporarily down? Does that mean that I'm locked out?
What happens to my account if Persona dies or is temporarily down? Does that mean that I'm locked out?