Why we love Mozilla Persona

Post by StavrosK » Mon, Feb 03, 2014, 2:52 PM UTC

darklajid wrote: post #25

ubernostrum wrote: post #10

Earlier quoted context omitted.

this doesn't solve the issue that you're still trusting someone else with your secret (your password) If you run your own identity provider, you are only trusting yourself with your secret. Also, nothing about Persona requires password-based authentication -- you can use any mechanism you like to authenticate to your identity provider.

The problem I have with that is that I haven't found decent identity providers last time I checked. Without some decent/proven implementations I'm hesitant to use it. I don't quite like using Mozilla's service (mostly not because of trust, it just feels half-assed not to go the extra mile and is considered an intermediate workaround/solution even by Mozilla, as far as I know). Without decent options to self host I gu…

Post by StavrosK » Mon, Feb 03, 2014, 2:54 PM UTC

jimktrains2 wrote: post #15

exo762 wrote: post #12

Earlier quoted context omitted.

You may as well generate onetime junk password, feed it into persona and later rely on password manager to remember it for you. You should avoid reusing your passwords across sites. BTW Persona helps you with that.

But my point is that you're still trusting your email provider with the password, and now if that get's leaked an attacker has access to (arguably/potentially) more sites than they would have before (via password resets).

Post by dochtman » Mon, Feb 03, 2014, 2:58 PM UTC

StavrosK wrote: post #23

crayola wrote: post #5

Persona is an elegant, powerful idea that is 100% in the users interest. I dearly want to see it gain traction. Kudos for disseminating your enthusiasm.

I completely agree. I was just thinking about this earlier today, there was lots of hype last year about it but it seems to have died down, and the project seems to have stalled. I really want to see it pick up steam and succeed, and I think the number one priority now is to implement plugins for major browsers. I hope the team picks up development again.

Post by cheshire137 » Mon, Feb 03, 2014, 3:02 PM UTC

drew wrote: post #24

In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site ( http://www.sixquestions.co ) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our…

Post by StavrosK » Mon, Feb 03, 2014, 3:03 PM UTC

dochtman wrote: post #45

StavrosK wrote: post #23

Earlier quoted context omitted.

I completely agree. I was just thinking about this earlier today, there was lots of hype last year about it but it seems to have died down, and the project seems to have stalled. I really want to see it pick up steam and succeed, and I think the number one priority now is to implement plugins for major browsers. I hope the team picks up development again.

The team has been focused on Persona support in Firefox OS, the Firefox Accounts stuff which relies on some of the same code as Persona, and integration on Firefox desktop. They have by no means stopped working on Persona, but resources on the Identity team seem kind of limited relative to how much there is still to be done.