Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why we love Mozilla Persona

blog.zonino.co.uk

Post reply on HN
Print view View original

121–130 of 164 posts

Re: Why we love Mozilla Persona

#121

Post by jmathai »

zobzu wrote: post #99
drew wrote: post #24

In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site ( http://www.sixquestions.co ) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our…

There's 2 issues with persona. 1) users don't already have a personna account setup. They're used to hit their "login with FB/Google" account instead. They don't know that persona is better privacy-wise. So for many, it's just friction. 2) persona login sometimes appears slightly slower

There's an OpenID bridge [1] to make it easier for GMail users to sign in using Persona if they're currently logged into GMail/Yahoo! [2]. I haven't used it but the end goal of Persona is that 3rd party email providers can be their own Persona identity providers.

We definitely need something like Persona but I share your concerns WRT friction. Chicken meets egg.

[1] http://identity.mozilla.com/post/56526022621/what-is-an-iden...

[2] http://identity.mozilla.com/post/57712756801/persona-makes-s...

Re: Why we love Mozilla Persona

#122

Post by StavrosK »

drdaeman wrote: post #118
StavrosK wrote: post #20

Earlier quoted context omitted.

Nothing depends on Persona. For example, see https://persowna.net/ , which I wrote and which you can use with your own domain for authentication. You can also install your own ID provider on your site and not rely on any third party.

And if "your" domain is suspended, revoked or just expired? You don't own a domain, you only temporarily lease it from a registrar. Just like with the email account with an email provider.

Yep, and that doesn't stop us from relying on email for our identity.

Re: Why we love Mozilla Persona

#123

Post by drdaeman »

StavrosK wrote: post #122
drdaeman wrote: post #118

Earlier quoted context omitted.

And if "your" domain is suspended, revoked or just expired? You don't own a domain, you only temporarily lease it from a registrar. Just like with the email account with an email provider.

Yep, and that doesn't stop us from relying on email for our identity.

I doubt if it's true. From my experience, email is usually used only as a credential, not an identity.

Some cloud evangelists try really hard to change that, though.

Re: Why we love Mozilla Persona

#124

Post by y0ghur7_xxx »

dochtman wrote: post #33
crayola wrote: post #5

Persona is an elegant, powerful idea that is 100% in the users interest. I dearly want to see it gain traction. Kudos for disseminating your enthusiasm.

Here's a crazy simple way to implement Persona authentication for your Apache-deployed apps/sites: https://github.com/mozilla/mod_authnz_persona (I know Apache may not be that popular with the HN crowd anymore, but I don't currently have the time to dive into nginx and do the same for it. Nevertheless, if anyone wants to do that, I'd be happy to answer questions and provide pointers into the Apache code.)

> I know Apache may not be that popular with the HN crowd anymore

I still love it. Thanks for the module.

Re: Why we love Mozilla Persona

#125

Post by r00fus »

KaoruAoiShiho wrote: post #74

I don't get why persona needs its own branding... Nobody knows what persona is. It should say login with Firefox. Did fb create a new brand for its login system? No it's just login with fb, same with literally every login service except freaking persona. Use your most popular brand instead of forcing all developers to evangelize a new brand. That's just not going to freaking work.

If this is the case, why not just use pseudo-crypto cross-branding and just call it: "What does the Fox say?" 350M youtube views can't be wrong, can it?

Popularity is one thing, but if a user is using Persona login on Chrome or some non-FF supporting browser, and it says "Firefox login", they're probably going to be confused, and possibly close the tab. As a site owner who's implementing Persona, that's the exact opposite of seamless.

Re: Why we love Mozilla Persona

#126

Post by ultimatedelman »

We use it at Mighty Spring (http://www.mightyspring.com) and it's pretty good! The documentation around backend setup is a bit confusing and doesn't cover some corner cases (like testing on dev servers) but with enough hacking you can get it to work. The front end plugin I went with (https://github.com/altryne/browserID-jQuery) needed a bit of tweaking (to both the code and docs, which was submitted to them), but other than that, relatively easy setup.

Our site is uniquely targeted at developers, so I felt that using Persona as a login option was only natural.

Re: Why we love Mozilla Persona

#127

Post by JohnTHaller »

asdasf wrote: post #94
JohnTHaller wrote: post #22

Earlier quoted context omitted.

As JavaScript is basically a required feature on the web these days, who cares? All web browsers that anyone tests for come with JS enabled. Anyone who runs NoScript or similar knows that when sites randomly break, they need to either enable JS or accept the fact that they can't visit that site without it. You can run your own Persona provider, meaning you don't have to trust a 3rd party.

>As JavaScript is basically a required feature on the web these days, who cares? People who don't live in a fantasy bubble world where that is true? "Hey, just throw away 1% of your potential user base for no reason" isn't a very compelling sales pitch.

It's generally less than 0.5% and the few techies that do it via NoScript are well aware of what to do when things break. And you'll spend far more than 0.5% of your time and budget working to make a JS-less fallback version of all your work.

It's like supporting IE6 at this point. It's a tradeoff. And for the vast majority of us, it's a near-complete waste of resources to cater to them.

Re: Why we love Mozilla Persona

#128

Post by StavrosK »

kijin wrote: post #73
drew wrote: post #24

In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site ( http://www.sixquestions.co ) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our…

Agreed. Although Persona's technical basis and privacy protections are second to none, the UX is nothing to write home about. It still feels too much like OpenID, and we know what happened to OpenID. Facebook and Twitter can get away with cross-site redirects because they're well known and people trust them. Persona doesn't have that benefit, so it can't get away with the same cumbersome UX. It needs to do better, mu…

If the bridge supports the 3-4 major email providers, it effectively becomes "log in with your email address" (it already supports Gmail), and A LOT of the friction goes away.

Re: Why we love Mozilla Persona

#129

Post by StavrosK »

mixedbit wrote: post #107
StavrosK wrote: post #56

Earlier quoted context omitted.

Oh wow, that's fantastic! I would love an nginx module that did this, although wishes don't go far.

You may try https://github.com/wrr/wwwhisper , although unlike the apache module, wwwhisper runs as a separate service (Django) that nginx communicates with using auth_request module.

Looks nice, thank you!

Re: Why we love Mozilla Persona

#130

Post by StavrosK »

louthy wrote: post #72

I use it for http://www.4four.org and really like it. The one small complaint I would have is that it would be great if (after initial setup) the login process was a bit faster. It should be quicker than the old-school username and password IMHO, but with the animations and latency on authentication it all seems to feel a bit sluggish. Especially as the cookie for it expires frequently - which is a bit shit for users…

The site cookie doesn't have much to do with the Persona bridge cookie. For example, for my sites, I expire users after a month, so they don't have to log in more frequently than that.

Persona never comes into it, unless they manually log out.

Post reply on HN