Live data from Hacker News

Persona makes signing in easy for Gmail users

identity.mozilla.com

111–120 of 122 posts

Re: Persona makes signing in easy for Gmail users

#111

Can someone explain the security implications of Persona? In what ways is it more or less secure than other authentication mechanisms (username/password, two factor auth, etc)? Thanks!

Persona is basically just public-key cryptography, but with a nice interface on top.

What you're really doing when you sign in to your identity provider is getting a certificate, signed by them, and containing a serialized public key (from a keypair generated and stored in your browser).

What you're really doing when "signing in" to a Persona-enabled site is sending them the certificate and a signed assertion, and letting them check all the signatures (public key in the certificate verifies the signature on the assertion, and the provider's public key is obtained to verify the signature on the certificate).

The only entity involved in this who needs to get a password from you is the identity provider, and password auth isn't required for that; it's just an easy and common way to do it. Sites you log into using Persona never ask for, see, or store a password for you.

The certificates are transient (they expire within 24 hours). The assertions generated by your browser are transient (they expire within 5 minutes). The keypairs generated and stored by your browser can be transient (you don't need to use the same keypair each time you sign in to your identity provider), and are tied to a specific email address and browser instance.

The whole thing is also designed to be decentralized. For most people, for now, Mozilla is the identity provider, but you can run your own (relatively easy) or use a trusted third-party provider. All that matters in a provider is that it speaks the protocol.

This means that comparing Persona to "password authentication" or "two-factor auth" is not really a useful question; your provider can use any mechanism you both agree on to verify you and give you a certificate. Though the immediate big win is, of course, that if there's a password involved, only the provider ever handles it, so you don't have to worry about a bunch of sites' password-storage practices, and you may not even have to worry about your provider's (if your provider doesn't use passwords to verify you).

The provider also doesn't know what sites you're signing in to with Persona; they don't receive the assertion from the site you sign into, they just provide a copy of their public key so the site can complete verification.

Re: Persona makes signing in easy for Gmail users

#112
post #3

I've seen a few demos of this. The developer story is great. Easy to integrate, no need to worry about screwing up storing passwords and you are not abdicating authentication to some evil or possibly evil in the future, company.

Not trying to troll or anything, but how do we know Mozilla won't be evil in the future? I'm sure you could find people who thought that about Google back in the day, they seem to now be routinely called out for questionable evils.

Well.. I agree with you here. We can never really tell.

Re: Persona makes signing in easy for Gmail users

#113
post #91

The problem with persona is that it sends the same identifier to all websites (nominally your email address). That makes it super-easy for those websites to feed your activity to a central tracker like DoubleClick which will consolidate all usage information from all DoubleClick affiliated websites. Persona would be a lot more privacy-preserving if it generated a unique identifier for each website. A "persona" for ea…

Can't they already do this based on your email address they have on profile?

Re: Persona makes signing in easy for Gmail users

#114
post #79

Earlier quoted context omitted.

Not trying to troll or anything, but how do we know Mozilla won't be evil in the future? I'm sure you could find people who thought that about Google back in the day, they seem to now be routinely called out for questionable evils.

AFAIK Right now there are two things that Mozilla controls. 1) login.persona.org that takes care of authentication 2) a JavaScript shim that developers add to their sites to get the login button to work. Persona is designed in such a way that reliance on Mozilla will be phased out as email providers take care of #1 and as browsers start to implement #2. As of now I think FireFox is the only browser that has #2 baked…

Not clear to me why we would trust "email providers" to do a great (i.e. well-implemented, secure, etc.) job at providing authentication services.

Re: Persona makes signing in easy for Gmail users

#115

Really excited for this. Password authentication is an absolute disaster on the Internet, and despite at least 8 years of development solutions like OpenID are not succeeding fast enough. Mozilla Persona looks really promising. Sure wish there were a Chrome extension for it!

I wish TLS-SRP was more prominent or that some mutual auth protocol was common (http://arxiv.org/abs/0911.5230).

Then you're never sending anything sensitive to the server.

Sure, it still has the issue of the user choosing a good password, but persona doesn't really get around this, just makes the mail server deal with it.

Re: Persona makes signing in easy for Gmail users

#116
post #79

Earlier quoted context omitted.

AFAIK Right now there are two things that Mozilla controls. 1) login.persona.org that takes care of authentication 2) a JavaScript shim that developers add to their sites to get the login button to work. Persona is designed in such a way that reliance on Mozilla will be phased out as email providers take care of #1 and as browsers start to implement #2. As of now I think FireFox is the only browser that has #2 baked…

Not clear to me why we would trust "email providers" to do a great (i.e. well-implemented, secure, etc.) job at providing authentication services.

Then pick someone who does convince you, or run your own authentication. The point is that it is designed to be decentralised.

Re: Persona makes signing in easy for Gmail users

#118

Earlier quoted context omitted.

HN was using Clickpass (YC Summer 07), which was acquired and shuttered by Janrain early last year. Amusingly enough, Stack Overflow still has a (broken) Clickpass button on its login page. If I recall correctly, Clickpass was a centralized OpenID proxy, whereas Persona is trying to bootstrap a fully decentralized protocol. We don't want to even be able to track you. :) [Edit: Corrected YC cohort. Thanks wamatt!]

"Amusingly enough, Stack Overflow still has a (broken) Clickpass button on its login page." Where? I can't see it.

The button was removed a few hours ago: http://meta.stackoverflow.com/questions/192501/remove-obsole...

Re: Persona makes signing in easy for Gmail users

#119

Earlier quoted context omitted.

I had this misunderstanding also, but if I understand it correctly... Basically a site using Persona tries to send you to your email provider to authenticate. If your email provider is running Persona, you'll authenticate through them, and the email provider sends a token back confirming your identity. Mozilla is the default identity provider for people whose email providers don't run Persona (yet). Once the project…

>Also it will in theory work as a browser extension, so your email provider sends your browser the token, and your browser sends the token to the websites you log in to. So your email provider doesn't know where you're logging in. I don't understand this. Presumably there's nothing stopping Website X sending both: a) my email address; and b) Website X's URL. Scenario: Joe Bloggs tries to log in to www.SiteThatSellsCa…

> I don't understand this. Presumably there's nothing stopping Website X sending both: a) my email address; and b) Website X's URL.

Yes, but there's nothing stopping them from doing that today. Persona doesn't help you if the site you sign into can't be trusted with the identity you give them. But nothing requires you to give them your normal e-mail address - you could just use throwaway if you find that a concern.

This is not what Persona tries to fix.

Persona is single sign-on where the identity provider does not know which site you sign in to, unlike current solutions where e.g. Google, Twitter or Facebook knows where you sign in whether or not the site you sign into is trustworthy or not.

Re: Persona makes signing in easy for Gmail users

#120
post #3

I've seen a few demos of this. The developer story is great. Easy to integrate, no need to worry about screwing up storing passwords and you are not abdicating authentication to some evil or possibly evil in the future, company.

Not trying to troll or anything, but how do we know Mozilla won't be evil in the future? I'm sure you could find people who thought that about Google back in the day, they seem to now be routinely called out for questionable evils.

Mozilla is a global non-profit organization dedicated to building a public good -- an Internet that works for everyone.

Google is a giant multi-national corporations that measures revenue in the tens of billions of dollars per quarter.

That means that Mozilla's responsibility is to the people of the world and Google's responsibility is to maximize financial returns for the the already well-off financial class that invested in Google stock.

Does that help you see the difference?

Post reply on HN