Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona makes signing in easy for Gmail users

identity.mozilla.com

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Persona makes signing in easy for Gmail users

#101

Post by Skalman »

Skalman wrote: post #60
callahad wrote: post #23

Earlier quoted context omitted.

myname+website@gmail.com should absolutely work -- please file a bug if not: https://github.com/mozilla/browserid-sideshow/issues/new

Huh - it does work, as you say. I guess I misremembered. EDIT: Now I remember my use case. My email is actually myname+randomstring+website@otherdomain.com, and so I want to sign in with the same randomstring every time. Previously when signing in to Persona with my Gmail email address it would suggest all alternatives, and I'd choose the appropriate one. Now it logs in with Gmail directly instead. Of course, this is…

Yet another use case that's more difficult now: I use randomstring@gmail.com for some sites where I expect to get lots of spam, and then forward email based on some filters.

Re: Persona makes signing in easy for Gmail users

#102

Post by Skalman »

Amadou wrote: post #93
Skalman wrote: post #61

Earlier quoted context omitted.

I use Firefox... and I don't think I wan't to be logged into multiple accounts - it's just that now Persona requires it.

FWIW - firefox has supported multiple profiles for years, long before Chrome even existed. Run it with the following command-line arguments: -ProfileManager -new-instance That brings up a profile picker/creater. Each profile is isolated, different plugins, different cookies, etc. The only information leakage is when a plugin keeps its own data outside of the profile directory, like Adobe Flash keeps its version of co…

Oh yeah - I use about 5 different profiles with one main profile. It's not a solution, though: I want to be logged into main@gmail.com and log into other sites with randomstring@gmail.com and I'd prefer to not have to be logged in there at all.

Re: Persona makes signing in easy for Gmail users

#103

Post by gioele »

StavrosK wrote: post #65
callahad wrote: post #55

Earlier quoted context omitted.

Check out the docs under the "Identity Providers" heading here: https://developer.mozilla.org/en-US/docs/Mozilla/Persona Shane Tomlinson and I gave a talk about turning your own domain into a Identity Provider at FOSDEM this year, which might be helpful: https://www.youtube.com/watch?v=0YRq9LWnlBw Also, if you'd like to source dive: - Minimal, static, Mailinator-style IdP: https://github.com/callahad/mockmyid/ - Mini…

As I mentioned below, I also wrote a service to turn your domain into an identity provider (so you can log in with you@yourdomain.com): https://persowna.net/ It's free for now, and will probably always be free for individual usage.

Your service is nice, but the whole point of my question was to have to a simple way to install something that could make me independent of any 3rd-party service like yours. :)

Re: Persona makes signing in easy for Gmail users

#104

Post by callahad »

Skalman wrote: post #101
Skalman wrote: post #60

Earlier quoted context omitted.

Huh - it does work, as you say. I guess I misremembered. EDIT: Now I remember my use case. My email is actually myname+randomstring+website@otherdomain.com, and so I want to sign in with the same randomstring every time. Previously when signing in to Persona with my Gmail email address it would suggest all alternatives, and I'd choose the appropriate one. Now it logs in with Gmail directly instead. Of course, this is…

Yet another use case that's more difficult now: I use randomstring@gmail.com for some sites where I expect to get lots of spam, and then forward email based on some filters.

We'll switch from proxying via OpenID to OAuth 2 in the next few months, which will make that seamless again thanks to the `login_hint` option to Google's OAuth endpoint.

Re: Persona makes signing in easy for Gmail users

#105

Post by StavrosK »

gioele wrote: post #103
StavrosK wrote: post #65

Earlier quoted context omitted.

As I mentioned below, I also wrote a service to turn your domain into an identity provider (so you can log in with you@yourdomain.com): https://persowna.net/ It's free for now, and will probably always be free for individual usage.

Your service is nice, but the whole point of my question was to have to a simple way to install something that could make me independent of any 3rd-party service like yours. :)

Oh. Then, what the other posters said :P

Re: Persona makes signing in easy for Gmail users

#107

Post by Lukasa »

jeena wrote: post #56
ozten wrote: post #46

Earlier quoted context omitted.

Tell me more! Do you want Persona authentication on your website or do you want a deamon that is an identity provider for your personal domain? What language or platform would be ideal?

I want to be my own identity provider, which ever web technology, php, ruby, python, JavaScript.

I wrote a blog post about implementing an IdP from scratch in Python. (Uses Django, but the lessons should be transferable). https://lukasa.co.uk/2013/04/Writing_A_Persona_Identity_Prov...

Re: Persona makes signing in easy for Gmail users

#109

Post by baha_man »

callahad wrote: post #10
dchest wrote: post #8

Earlier quoted context omitted.

It used some another (failed?) provider before (which connected accounts to Gmail, Yahoo, etc.)

HN was using Clickpass (YC Summer 07), which was acquired and shuttered by Janrain early last year. Amusingly enough, Stack Overflow still has a (broken) Clickpass button on its login page. If I recall correctly, Clickpass was a centralized OpenID proxy, whereas Persona is trying to bootstrap a fully decentralized protocol. We don't want to even be able to track you. :) [Edit: Corrected YC cohort. Thanks wamatt!]

"Amusingly enough, Stack Overflow still has a (broken) Clickpass button on its login page."

Where? I can't see it.

Re: Persona makes signing in easy for Gmail users

#110

Post by AndrewDucker »

barmstrong wrote: post #108

Can someone explain the security implications of Persona? In what ways is it more or less secure than other authentication mechanisms (username/password, two factor auth, etc)? Thanks!

You don't hand your password to anyone but your email provider - and they can implement two-factor authentication (or anything else they like) - as GMail have done, for instance.

Which means that 99% of sites don't need to worry about security for passwords, and you don't need to worry that your password has been stolen by hackers and now they're trying that same password on every site you might have ever used.

It's also decentralised, so there's no tracking of what sites you've logged in to. (Or, at least, it will be, once email providers implement IDPs themselves rather than using the Mozilla fallback). And the way the certification works, the IDP has no idea what sites you're signing into, so you're safe from that too.

Post reply on HN