101–110 of 164 posts
Why we love/like X, And why you should, too
My immediate reaction is always something along the lines of, don't presume to tell me why I should like anything. Tell me why you like it, and be done with it.
So what happens when my Person account gets compromised? I'll stick to my many accounts / many passwords approach, I think.
i actually don't think this argument holds water.
it's the same with any auth system. you can use 2FA, etc. in the end if someone compromise your laptop you're screwed, they get all the passwords/assertions anyway.
They can't make assertions from the server side.
In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site ( http://www.sixquestions.co ) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our…
Just tried it on your site. It went easily enough. I entered my Gmail address in the Persona form, then it had me pick which Google account to use (strange that it wouldn't just choose the one for the Gmail address I entered), then it said I was signed in.
Earlier quoted context omitted.
As JavaScript is basically a required feature on the web these days, who cares? All web browsers that anyone tests for come with JS enabled. Anyone who runs NoScript or similar knows that when sites randomly break, they need to either enable JS or accept the fact that they can't visit that site without it. You can run your own Persona provider, meaning you don't have to trust a 3rd party.
>As JavaScript is basically a required feature on the web these days, who cares? People who don't live in a fantasy bubble world where that is true? "Hey, just throw away 1% of your potential user base for no reason" isn't a very compelling sales pitch.
The number of people who have JavaScript disabled and don't know how and when to re-enable it is so small as to be irrelevant.
In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site ( http://www.sixquestions.co ) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our…
Agreed. Although Persona's technical basis and privacy protections are second to none, the UX is nothing to write home about. It still feels too much like OpenID, and we know what happened to OpenID. Facebook and Twitter can get away with cross-site redirects because they're well known and people trust them. Persona doesn't have that benefit, so it can't get away with the same cumbersome UX. It needs to do better, mu…
I don't get why persona needs its own branding... Nobody knows what persona is. It should say login with Firefox. Did fb create a new brand for its login system? No it's just login with fb, same with literally every login service except freaking persona. Use your most popular brand instead of forcing all developers to evangelize a new brand. That's just not going to freaking work.
Earlier quoted context omitted.
Here's a crazy simple way to implement Persona authentication for your Apache-deployed apps/sites: https://github.com/mozilla/mod_authnz_persona (I know Apache may not be that popular with the HN crowd anymore, but I don't currently have the time to dive into nginx and do the same for it. Nevertheless, if anyone wants to do that, I'd be happy to answer questions and provide pointers into the Apache code.)
Oh wow, that's fantastic! I would love an nginx module that did this, although wishes don't go far.
Earlier quoted context omitted.
As JavaScript is basically a required feature on the web these days, who cares? All web browsers that anyone tests for come with JS enabled. Anyone who runs NoScript or similar knows that when sites randomly break, they need to either enable JS or accept the fact that they can't visit that site without it. You can run your own Persona provider, meaning you don't have to trust a 3rd party.
>As JavaScript is basically a required feature on the web these days, who cares? People who don't live in a fantasy bubble world where that is true? "Hey, just throw away 1% of your potential user base for no reason" isn't a very compelling sales pitch.
The caveat to this rule is, of course, if you have a site that is very heavily trafficked.
The goals behind Persona are excellent: strong privacy protection and relieving website operators of cumbersome and error-prone authentication management. I love the idea. It's why I implemented Persona on my site.
The execution of Persona has been a bit wobbly. Logins are critical infrastructure and it doesn't feel like Mozilla is approaching Persona from that perspective. The team has been fantastic (thanks, callahad) but when things go wrong, it can take a long time for them to get resolved. Meanwhile, I'm left scrambling for a workaround.
An example: when the Yahoo bridge was implemented, it broke Persona for everyone who used a Yahoo alias [1]. A nasty break that returned a non-helpful error message. Something that serious merits an immediate rollback, in my opinion--but instead, it was left in place for several weeks until a interim solution was rolled out. The interim solution has some fairly serious UX problems, but the full solution has been open for 10 months now [2].
I want to love Persona, and I can't really afford the time required to do my own authentication, but it scares me that I'm so dependent on it.
[1] https://github.com/mozilla/persona-yahoo-bridge/issues/178
[2] https://github.com/mozilla/persona-yahoo-bridge/issues/201
So what happens when my Person account gets compromised? I'll stick to my many accounts / many passwords approach, I think.
What happens when your email account gets compromised and the attacker uses the "forgot my password" feature on each site? If you say you use multiple email accounts, then you can also use multiple Persona accounts. In fact, support for multiple accounts is part of the plan.
I don't see how introducing a single untrusted third party, many accounts or otherwise, is better than using a couple of trusted third parties such as gmail and hotmail.