Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Persona Beta: Millions of Users Ready to Log In using Any Browser

identity.mozilla.com

Post reply on HN
Print view View original

111–120 of 188 posts

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#111

Post by AnIrishDuck »

lazyjones wrote: post #68
bzbarsky wrote: post #38

Earlier quoted context omitted.

Er... "they" have also published the full source code involved (at https://github.com/mozilla/browserid ) and a privacy policy at http://www.mozilla.org/en-US/persona/privacy-policy/ that you can compare to said source code as desired, if you're using Mozilla's identity provider. As far as the architecture of the overall thing, there are also http://identity.mozilla.com/post/7899984443/privacy-and-brow... and http://…

Not even the links you posted tell me a) where certificates are stored and how they are protected, b) what measures are taken to prevent unauthorized use of those certificates by the ID provider, the browser (plugins?), other entities, c) how the act of entering an e-mail address is secure (other people may have access to my computer and know my e-mail address). Admittedly, I didn't watch the 1 hour presentation vide…

> how the act of entering an e-mail address is secure (other people may have access to my computer and know my e-mail address)

Assuming you're saying other people have access to your email account already, it's game over: practically every site will send password reset procedures on demand to the email you used to create your account.

Alternatively, if you're saying other people know your email address, that's not really relevant. They need to either be able to read email on your account (see above), or be able to implement an Identity Provider on your email domain.

If an unauthorized party is able to implement an IdP on your email domain you have an even worse problem: your email provider apparently is unable to control basic aspects of their own domain.

to actually implement an IdP, your email provider must publish a https://domain.com/.well-known/browserid file. If a rogue third party can do this at will, I'd say your email provider has horrible security and your security assumptions are probably broken anyway.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#112

Post by 6a68 »

OoTheNigerian wrote: post #29

Here is my feedback. Perhaps the marketing of "persona" to consumers should take a backseat. When I signed in to http://123done.org/ the pop up* showing "sign in with persona" confused me for a moment. For a moment, I thought.. "but I do not have a persona account" If there is a way for users to just sign in with their email without telling them how it is done, I am sure there will be even less friction. Of course, t…

The Persona branding is necessary because you aren't creating an account with the underlying website--you're creating an account with the persona.org fallback identity provider (that is, unless you're using a yahoo.com email or another Persona identity provider).

Think about it this way: suppose you create a persona.org account at site X, then visit site Y which also uses Persona for login. It would look like site Y recognized you, but how? Seems like an incoherent user experience.

Does this help at all?

Firebase offers a login service which includes Persona alongside Facebook, Github, Twitter as login options. They've got a demo here: http://firebase.github.io/firebase-simple-login/

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#113

Post by drdaeman »

Groxx wrote: post #83
drdaeman wrote: post #50

Earlier quoted context omitted.

If Persona would care about anyone's privacy, they won't use emails. Logging in with, say, Twitter account is less secure in aspect Twitter knows what sites you log in, but more secure in aspect the sites can't spam you unless you allow them to do so.

I've been thinking about this, and I have come to the conclusion that it's less of an issue than I thought it was. For a simple reason: the "email address" you provide is just an identifier. A string formatted as "user@domain", nothing more. By convention it's a usable email address, but there is literally nothing preventing someone from starting up an email-less Persona identity provider. You'd still log in with you…

This is correct, but the whole thing is marketed as email address, so it will be used as an email address, i.e. means of contacting me.

Now, consider I want to try some service I don't trust. I sign in with a email-looking identifier (which doesn't work as email address) and use the site for some time. Eventually, I become fond of this service and want it to start contacting me. With 123done.org I can't do this, nor at the mineshafter.info, nor at crossword.thetimes.co.uk. Trovebox looks broken to me, so can't tell it works, and I was lucky with voo.st, as it allowed me to add more accounts. Don't know more sites using Persona. Considering, today when you register with only Facebook or Google account relatively many sites don't let you change that binding in the future, it's very likely the situation with Persona will be the same.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#114

Post by 6a68 »

dabeeeenster wrote: post #51
riquito wrote: post #37

Earlier quoted context omitted.

"sign in with persona" may be confusing now but "sign in with your e-mail" it's pretty clear https://developer.mozilla.org/en-US/docs/persona/branding

It's not clear at all. It's not clear to me and I've been a web developer for 15 years! - I go to this site that I've never been to before - It asks me to sign in with my email address, but I've never been to the site before so assume it doesn't "know" my email address - I think look for a "Create Account" button to set up my account - Now I'm confused as there is not a button anywhere - I think "Well, I can't just t…

Hey, so any email address will work. If it's not a Persona identity provider, then you'll just get prompted to create an account with the persona.org fallback IdP. You can see this right now by trying to login using a gmail account vs a yahoo mail account.

Does this help?

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#115

Post by megaman821 »

shared4you wrote: post #75

>> type in email, login to yahoo... Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman? Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

Isn't the second question equivalent to what we have now? If an attacker knows my Yahoo password, can he potentially reset all the passwords of sites I registered with using my Yahoo email address and login to them.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#116

Post by 6a68 »

lubujackson wrote: post #47
bzbarsky wrote: post #38

Earlier quoted context omitted.

Er... "they" have also published the full source code involved (at https://github.com/mozilla/browserid ) and a privacy policy at http://www.mozilla.org/en-US/persona/privacy-policy/ that you can compare to said source code as desired, if you're using Mozilla's identity provider. As far as the architecture of the overall thing, there are also http://identity.mozilla.com/post/7899984443/privacy-and-brow... and http://…

Since programmers and other tech workers still have difficulty understanding the details of Persona, this seems to be a clear PR issue. It's a lot like trying to convert normal people to Linux by telling them it's great and if they don't believe you they can read the source of the kernel. Not a very compelling defense.

We've got a lot more to offer than "use the source Luke" ;-)

There are tons of technical docs on our MDN page: https://developer.mozilla.org/docs/Persona

You can start with a high-level explanation of why Persona is different and awesome: https://developer.mozilla.org/en-US/docs/Persona/Why_Persona

From there, you can dig as deep as you'd like--we have docs to help with building an identity provider, integrating Persona into an existing site, even a list of pre-written open source plugins in a ton of languages/frameworks.

If none of that works, drop by #identity on mozilla IRC and tell us our docs suck, so we can prioritize making them better.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#117

Post by 6a68 »

macspoofing wrote: post #30

I have to say that I'm really loving Mozilla/Mozilla Research these days. Their heart is in the right place, and their research projects like Asm.js, Persona, Rust, and Firefox OS are very cool. They are what Google was in 2005.

Aw shucks, thanks!

Unlike Google in 2005, Mozilla is a non-profit actively working to protect user privacy & build a better web. Also, everything we build is open source :-)

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#118

Post by callahad »

laserDinosaur wrote: post #104

I'm confused - What is the difference between this and sites that let me login with my Google account?

Persona works with any email address, so the major difference is that you can get the "Sign in with Google" experience, with just one button, but without being forced to choose (and phone home to) Google.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#119

Post by callahad »

AndrewDucker wrote: post #7
menny wrote: post #3

Earlier quoted context omitted.

Persona should add two-factor authentication. For that matter, any open-ID or similar technology should add that.

Persona is only handling authentication temporarily. Once email providers start providing their own Identity Providers then the security falls entirely on them. For instance, once GMail starts being its own authenticator, my two-factor authentication there will kick in.

Identity Bridging will eventually get 60-80% of users functionally off of our fallback and onto their provider's native authentication paths, but I do wonder if the Persona fallback support two-factor auth natively for the remaining 20-40% of users.

Thoughts?

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#120

Post by drdaeman »

badida wrote: post #98
drdaeman wrote: post #50

Earlier quoted context omitted.

If Persona would care about anyone's privacy, they won't use emails. Logging in with, say, Twitter account is less secure in aspect Twitter knows what sites you log in, but more secure in aspect the sites can't spam you unless you allow them to do so.

Choose your identity providers (and thus email addresses) wisely. They should be filtering spam for you / letting you control things. And they shouldn't be doing it by forcing you into their silo, the way "login with Twitter" buttons work.

Actually, it's my biggest problem with Persona is that the source of my identity is not me, but some third party I have to trust.

I run my email addresses on my own (physically-owned) servers. I know various approaches to filtering spam, and the best one in my experience is to not have a littered inbox is to have a private non-dictionary per-service email address and not expose it anywhere else.

The only mandatory third party between me and the Internet is domain registrar, I lease my domain name from. Not trustworthy, but this is the best one could have while all authentication systems are tightly coupled with DNS.

Post reply on HN