Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why we love Mozilla Persona

blog.zonino.co.uk

Post reply on HN
Print view View original

151–160 of 164 posts

Re: Why we love Mozilla Persona

#151

Post by nly »

StavrosK wrote: post #42
tptacek wrote: post #30

Earlier quoted context omitted.

SRP doesn't solve that problem. Applications that authenticate with SRP hold crackable password derivatives.

I got excited by SRP a few months ago and looked into it, but decided that it didn't have that many advantages compared to storing hashes properly on the server (with a strong KDF) and using TLS.

The 'storing hashes properly on the server' problem is the biggest problem with website authentication right now, as seen by the number of breaches resulting in weak-ass hash dumps.

With SRP the derivation of strong keys using a KDF is done by the client. Not only is this more scalable, it means users don't have to trust web developers, who are almost never cryptographers, to get the 'storing hashes properly' bit right. Not having to trust is great. Not having to trust websites with our chosen passwords also means most of the risk of reusing passwords across services just goes away. In short it's epic win for users, but it's extremely difficult to get people to see that the real problem is a bad trust model.

Another reason to like it is it's safe to use over vanilla unencrypted, unauthenticated connections, which could be important because certificate authority integrity is, imho, the second biggest trust issue on the web right now.

Persona and OpenID etc are flawed because they copy that very same CA trust model.

Re: Why we love Mozilla Persona

#152

Post by jimktrains2 »

Sami_Lehtinen wrote: post #150
StavrosK wrote: post #43

Earlier quoted context omitted.

How so? If an attacker gets your mail password, they can pretty much already password-reset every single site you use.

That is exactly why sites shouldn't provide password reset by email. Email shouldn't be used for authentication in any case. It's really insecure solution.

Unfortunately security questions aren't much better. The best solution is to expect the user to safely and securely store a reset-key (kind of like Mozilla's Sync).

However, to the average, non-techie user this is

* Bad UX * They won't store it securely * They'll lose it

Another option is using public keys with some form of transition mechanism.

Re: Why we love Mozilla Persona

#154

Post by nl »

whitef0x wrote: post #114
kijin wrote: post #73

Earlier quoted context omitted.

Agreed. Although Persona's technical basis and privacy protections are second to none, the UX is nothing to write home about. It still feels too much like OpenID, and we know what happened to OpenID. Facebook and Twitter can get away with cross-site redirects because they're well known and people trust them. Persona doesn't have that benefit, so it can't get away with the same cumbersome UX. It needs to do better, mu…

OpenID never really made it not just because of their bad UX design but also because they never got major players to push it to the public. Google or Facebook would much rather have you use their service as login credentials as it makes more monetary sense to do so than to hand it over to some non-profit foundation like Mozilla or OpenID. Data = money in this world and everyone wants more money.

Google, Yahoo and AOL all support(ed) OpenId login using their site as an IDP.

Google's FriendConnect was built on it.

That's a fair bit of "push".

Re: Why we love Mozilla Persona

#155

Post by timmclean »

StavrosK wrote: post #131
callahad wrote: post #90

Earlier quoted context omitted.

Gah. We still need to switch from OpenID to OAuth for our GMail bridge; OpenID doesn't allow us to tell Google what address we're trying to authenticate. Sorry!

Need any help with that/is there a ticket?

I found this: https://github.com/mozilla/persona-gmail-bridge/pull/114

Re: Why we love Mozilla Persona

#156

Post by lucasjans »

StavrosK wrote: post #40
lucasjans wrote: post #29

> We think that Persona is a great attempt at improving usability, security and privacy... We use Persona and love it. However, I wouldn't trust Persona for securing sensitive information. There seems to be no password requirements (at least when I checked months ago.)

That's incorrect, the identity provider is not specified by the protocol. Each user can use whatever IdP they want, with arbitrary password requirements. I built my own IdP that has 2-factor auth, for example: https://www.persowna.net/

It's possible to implement an identity provider, sure. But that doesn't change the fact that there are no password requirements using Mozilla's default provider. Poor default design.

Btw, your service sounds very nice for those interested in securing a domain, but I was a little surprised by the pricing. Nearly as much as a Google Apps license itself.

Re: Why we love Mozilla Persona

#157

Post by hmans »

pja wrote: post #53
hmans wrote: post #37

Persona is _awesome_. I use it on all my sites. But it also proof that being awesome not only is not good enough to be successful, but simply doesn't matter. The user is not interested in a solution that is awesome, but one that doesn't scare him. And a big ugly third-party popup is as scary as stuff on the web gets these days. Remember Ogg Vorbis?

Vorbis ended up being very successful in some niches - audio for games springs to mind. Persona might find its own niche, even if it never completely displaces Facebook user authentication on the web.

Absolutely. Ogg Vorbis could have crushed the big licensed formats, though, if the Xiph Foundation had had any clue about telling a good story.

I love Persona and I love Ogg Vorbis, but both fail(ed) at understanding what _normal_ people look for in authentication/audio compression formats.

Re: Why we love Mozilla Persona

#158

Post by blueskin_ »

quadrangle wrote: post #81
blueskin_ wrote: post #32

Yet another OpenID/OAuth/Whatever? Another SPOF. Give me separate logins and KeePass any day.

simply wrong. This is NOT another OpenID. Your judgment is an ignorant one. The long-term vision is even further from the current substantial departure from OpenID: to be verified by your browser instead via JS etc.

That sounds even less secure, if anything.

Re: Why we love Mozilla Persona

#159

Post by darklajid »

wulczer wrote: post #76
darklajid wrote: post #25

Earlier quoted context omitted.

The problem I have with that is that I haven't found decent identity providers last time I checked. Without some decent/proven implementations I'm hesitant to use it. I don't quite like using Mozilla's service (mostly not because of trust, it just feels half-assed not to go the extra mile and is considered an intermediate workaround/solution even by Mozilla, as far as I know). Without decent options to self host I gu…

Since everyone is plugging their own: here's a identity provider daemon written in Go: https://github.com/wulczer/persona-idp It uses my Mail Transfer Agent to identify, so I can just use me email password to log in to Persona-enabled sites, but you can easily swap it out for a different credentials checker.

That's quite cool - actually that'd be exactly what I want to host myself.

Not a fan of go (cough The stripe CTF made it again clear that go get isn't exactly what I want, ever), and don't want to build stuff on my box, but I'll certainly check it out. Thanks for chiming in!

Re: Why we love Mozilla Persona

#160

Post by eklavya »

JoshTriplett wrote: post #66
eklavya wrote: post #14

If there is one company I can trust my data with, it's Mozilla.

It's funny that the few entities we'd be more inclined to trust are the ones that go out of their way to make sure we don't have to trust them: Firefox Sync does client-side encryption so you don't have to trust the server, Persona does authentication via an identity provider so you don't have to trust persona.org...

I didn't mean persona when I said trusting with my data. I am just saying if ever I could trust a company with my data, it would be Mozilla (shows how much I trust them).
Post reply on HN