91–100 of 164 posts
Earlier quoted context omitted.
Do you get this problem if you use a different browser for the other gmail account?
No, and that is what I would usually do since I understand how these things work. (IE does come in handy at times.) The point that I am trying to make is that normal users who don't know these tricks can run into this barrier.
Earlier quoted context omitted.
Did they give up on the in-browser stuff? Or did I just get the plan completely wrong then?
If I recall correctly, the in-browser stuff is just a UI for selecting your email address and contacting your identity provider.
This doesn't work with JS disabled, with no indication that it doesn't work as intended (it just bounces the visitor back and forth between 2 pages). Persona is very convenient for users, but it would be more secure to not trust a 3rd party.
As JavaScript is basically a required feature on the web these days, who cares? All web browsers that anyone tests for come with JS enabled. Anyone who runs NoScript or similar knows that when sites randomly break, they need to either enable JS or accept the fact that they can't visit that site without it. You can run your own Persona provider, meaning you don't have to trust a 3rd party.
People who don't live in a fantasy bubble world where that is true? "Hey, just throw away 1% of your potential user base for no reason" isn't a very compelling sales pitch.
Earlier quoted context omitted.
The protocol itself doesn't come with an SPOF. Only the transitional current implementation, required for bootstrapping purposes, does require the JavaScript shim hosted by Mozilla. In the future, at least Firefox itself (on desktop, Android, and Firefox OS) will come with built-in support. And, quite importantly, running your own identity provider (which is another SPOF in many systems) is pretty straightforward and…
If Identity Provider goes down, it is a SPOF for the account, but the same is with FB/Twitter login
Earlier quoted context omitted.
If I recall correctly, the in-browser stuff is just a UI for selecting your email address and contacting your identity provider.
I wouln't say "just". It solves an important problem, the fact that the site you are logging in could have a javascript keylogger to read the password you are going to enter.
So what happens when my Person account gets compromised? I'll stick to my many accounts / many passwords approach, I think.
If you say you use multiple email accounts, then you can also use multiple Persona accounts. In fact, support for multiple accounts is part of the plan.
In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site ( http://www.sixquestions.co ) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our…
1) users don't already have a personna account setup. They're used to hit their "login with FB/Google" account instead. They don't know that persona is better privacy-wise. So for many, it's just friction.
2) persona login sometimes appears slightly slower
The important thing here is that as Persona protocol (BrowserID)'s creator, Mozilla really really wants someone else (potentially YOU the user) to run the Identity Bridge. Currently Mozilla does this for non-Gmail and non-Yahoo users too boost adoption. So when you sign up you are asked to give a new password on sign up. If you are paranoid, you should of course give a new password instead the one you use for your email (which I assume may be reused for multiple accounts...)
But being able to authenticate yourself on your own is what makes Persona useful.
edit: at realworld crypto, this was given as a talk. This is Google's possible direction.