Why we love Mozilla Persona • Hacker News Board

Re: Why we love Mozilla Persona

#141

Post by jdlshore » Mon, Feb 03, 2014, 10:50 PM UTC

jt2190 wrote: post #136

jdlshore wrote: post #109

I've been using Persona as my sole login mechanism on http://letscodejavascript.com for over a year. I want to love it, but I don't. The goals behind Persona are excellent: strong privacy protection and relieving website operators of cumbersome and error-prone authentication management. I love the idea. It's why I implemented Persona on my site. The execution of Persona has been a bit wobbly. Logins are critical infr…

> ...I can't really afford the time required to do my own > authentication... Just curious: What does your perfect solution look like?

Perfect solution? It works like it was custom-built for my site, is as easy and predictable to implement as Persona's `get()` API, and of course has excellent security, privacy, and operations.

I would have been willing to pay for such a thing had it existed when I started. It would have needed to be proven, though, because I worry about longevity. The exact price isn't so important, within reason; say, less than $100/mo. At the higher end of that range, I'd expect it to have some serious word-of-mouth gushing.

Re: Why we love Mozilla Persona

#142

Post by drew » Mon, Feb 03, 2014, 10:59 PM UTC

EGreg wrote: post #134

drew wrote: post #24

In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site ( http://www.sixquestions.co ) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our…

How do you know users clearly prefer it?

We track clicks on each of the four login methods, and compare it with successful sign in events with each of them. So we know completion rates for each type, plus which types are preferred by users. Nothing fancy, just google analytics events + checking the users table.

Re: Why we love Mozilla Persona

#143

Post by icebraining » Mon, Feb 03, 2014, 11:18 PM UTC

lotsofcows wrote: post #110

icebraining wrote: post #98

Earlier quoted context omitted.

What happens when your email account gets compromised and the attacker uses the "forgot my password" feature on each site? If you say you use multiple email accounts, then you can also use multiple Persona accounts. In fact, support for multiple accounts is part of the plan.

Like any sensible person, all my security question answers are of the "Correct Horse Battery Staple" type. I don't see how introducing a single untrusted third party, many accounts or otherwise, is better than using a couple of trusted third parties such as gmail and hotmail.

The goal of Persona is that you should be able to use Hotmail and Gmail as your trusted identity provider; the current system is just a stopgap until there's more support from providers.

Re: Why we love Mozilla Persona

#144

Post by lifeisstillgood » Tue, Feb 04, 2014, 12:18 AM UTC

The UK government is about to launch an Identity assurance scheme where different providers (Post Office etc) check your drivers license then give you an account hw in is then oauth'able

in short Facebook logins but with actual real names that like governments can trust

just saying that this might be the start of what usually happens to private companies colonising what turns out to be a public good

Re: Why we love Mozilla Persona

#145

Post by eruditely » Tue, Feb 04, 2014, 12:40 AM UTC

sliverstorm wrote: post #101

I guess this is just a sign that I am getting crotchety, but headlines like this just anger me: Why we love/like X, And why you should, too My immediate reaction is always something along the lines of, don't presume to tell me why I should like anything. Tell me why you like it, and be done with it.

Your anger is misplaced. They did do exactly that.

Re: Why we love Mozilla Persona

#146

Post by drblast » Tue, Feb 04, 2014, 12:49 AM UTC

If you're like me and this is the first time you're hearing about this, and want to know more about the implementation, check the bottom of this page:

https://developer.mozilla.org/en-US/Persona?redirectlocale=e...

Edit: I've checked out the login process in the linked site, and it works well, but the popup window U/I seems like it's ripe for phishing attempts. It would be very easy to replicate the look of that window and fool people into thinking they're using Persona when they're not.

Re: Why we love Mozilla Persona

#147

Post by eruditely » Tue, Feb 04, 2014, 12:52 AM UTC

sliverstorm wrote: post #101

I guess this is just a sign that I am getting crotchety, but headlines like this just anger me: Why we love/like X, And why you should, too My immediate reaction is always something along the lines of, don't presume to tell me why I should like anything. Tell me why you like it, and be done with it.

Your anger is misplaced. They did do exactly that.

Re: Why we love Mozilla Persona

#148

Post by jtheory » Tue, Feb 04, 2014, 1:08 AM UTC

icebraining wrote: post #91

rebelde wrote: post #85

Earlier quoted context omitted.

No, and that is what I would usually do since I understand how these things work. (IE does come in handy at times.) The point that I am trying to make is that normal users who don't know these tricks can run into this barrier.

I don't think normal users have multiple Google accounts, though.

Eh, that depends.

All it takes is a personal Gmail account plus working for a company that uses Google Apps.

Re: Why we love Mozilla Persona

#149

Post by ericathegreat » Tue, Feb 04, 2014, 1:49 AM UTC

Biggest problem I have with Persona is one of it's main selling points; if you log in to one place you're logged into all the places. That may sound great, but it really isn't. It means that you can log out of a site because you don't want people sharing your machine to have access to it. You then log into a different, lower-security site. Instantly that first site is accessible again.

I wrote a whole thing on Persona a while back ( http://lepidllama.net/blog/trying-out-mozilla-persona-browse... ) but that ended up being the killer for me. It might be fine for activities like posting comments on a blog, but any site which stores or presents some aspect of who am I to the world needs to be a bit more secure than that!

Re: Why we love Mozilla Persona

#150

Post by Sami_Lehtinen » Tue, Feb 04, 2014, 2:08 AM UTC

StavrosK wrote: post #43

jimktrains2 wrote: post #15

Earlier quoted context omitted.

But my point is that you're still trusting your email provider with the password, and now if that get's leaked an attacker has access to (arguably/potentially) more sites than they would have before (via password resets).

How so? If an attacker gets your mail password, they can pretty much already password-reset every single site you use.

That is exactly why sites shouldn't provide password reset by email. Email shouldn't be used for authentication in any case. It's really insecure solution.