What happens to my account if Persona dies or is temporarily down? Does that mean that I'm locked out?
Your cookie stays valid if you haven't logged out.
Why we love Mozilla Persona
21–30 of 164 posts
Re: Why we love Mozilla Persona
#22This doesn't work with JS disabled, with no indication that it doesn't work as intended (it just bounces the visitor back and forth between 2 pages). Persona is very convenient for users, but it would be more secure to not trust a 3rd party.
As JavaScript is basically a required feature on the web these days, who cares? All web browsers that anyone tests for come with JS enabled. Anyone who runs NoScript or similar knows that when sites randomly break, they need to either enable JS or accept the fact that they can't visit that site without it.
You can run your own Persona provider, meaning you don't have to trust a 3rd party.
Re: Why we love Mozilla Persona
#23Persona is an elegant, powerful idea that is 100% in the users interest. I dearly want to see it gain traction. Kudos for disseminating your enthusiasm.
I completely agree. I was just thinking about this earlier today, there was lots of hype last year about it but it seems to have died down, and the project seems to have stalled.
I really want to see it pick up steam and succeed, and I think the number one priority now is to implement plugins for major browsers. I hope the team picks up development again.
Re: Why we love Mozilla Persona
#24In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important.
I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site (http://www.sixquestions.co) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our next-worst performer (Twitter), and half the rate of our best performer (Facebook). For all the concerns people have with authorizing Facebook/Twitter access, that is (in my view) offset by the alien-ness of Persona's login flow. We've heard from lots of users that logging in with Persona is unusual and they thought they were doing something wrong because they'd never seen anything like that.
So, as much as I believe in Persona, I'm about to deploy a change that removes it entirely. It adds a lot of surface area to our testing and future development, but if it means we lose fewer users in their signup flow, it will be worth it.
Re: Why we love Mozilla Persona
#25But, this doesn't solve the issue that you're still trusting someone else with your secret (your password). We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password. [0]: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different i…
this doesn't solve the issue that you're still trusting someone else with your secret (your password) If you run your own identity provider, you are only trusting yourself with your secret. Also, nothing about Persona requires password-based authentication -- you can use any mechanism you like to authenticate to your identity provider.
The problem I have with that is that I haven't found decent identity providers last time I checked.
Without some decent/proven implementations I'm hesitant to use it. I don't quite like using Mozilla's service (mostly not because of trust, it just feels half-assed not to go the extra mile and is considered an intermediate workaround/solution even by Mozilla, as far as I know). Without decent options to self host I guess I could implement it myself - but that's a big step.
So .. although I'm a fan of the concept, I'm still not using Persona anywhere.
Re: Why we love Mozilla Persona
#26This doesn't work with JS disabled, with no indication that it doesn't work as intended (it just bounces the visitor back and forth between 2 pages). Persona is very convenient for users, but it would be more secure to not trust a 3rd party.
My understanding of the technology is that the endgame for persona is that you don't have to trust a third party. Instead, the authentication will be provided by the browser itself (the protocol behind Persona is called Browser ID). The current implementation is just a shim until browsers provide support for it natively.
The authentication will actually be provided by your identity provider (which will usually, but not necessarily, be your email provider).
Re: Why we love Mozilla Persona
#27This doesn't work with JS disabled, with no indication that it doesn't work as intended (it just bounces the visitor back and forth between 2 pages). Persona is very convenient for users, but it would be more secure to not trust a 3rd party.
My understanding of the technology is that the endgame for persona is that you don't have to trust a third party. Instead, the authentication will be provided by the browser itself (the protocol behind Persona is called Browser ID). The current implementation is just a shim until browsers provide support for it natively.
And what's the timeline for Mozilla providing it in Firefox?
Re: Why we love Mozilla Persona
#28Earlier quoted context omitted.
this doesn't solve the issue that you're still trusting someone else with your secret (your password) If you run your own identity provider, you are only trusting yourself with your secret. Also, nothing about Persona requires password-based authentication -- you can use any mechanism you like to authenticate to your identity provider.
The problem I have with that is that I haven't found decent identity providers last time I checked. Without some decent/proven implementations I'm hesitant to use it. I don't quite like using Mozilla's service (mostly not because of trust, it just feels half-assed not to go the extra mile and is considered an intermediate workaround/solution even by Mozilla, as far as I know). Without decent options to self host I gu…
Have a look at mine:
https://bitbucket.org/djc/persona-totp
It's less than 150 LOC of Python code (plus some HTML templates and a few basic tests).
Re: Why we love Mozilla Persona
#29> We think that Persona is a great attempt at improving usability, security and privacy...
We use Persona and love it. However, I wouldn't trust Persona for securing sensitive information. There seems to be no password requirements (at least when I checked months ago.)
Re: Why we love Mozilla Persona
#30But, this doesn't solve the issue that you're still trusting someone else with your secret (your password). We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password. [0]: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different i…
SRP doesn't solve that problem. Applications that authenticate with SRP hold crackable password derivatives.