Live data from Hacker News

New Persona Beta: Millions of Users Ready to Log In using Any Browser

identity.mozilla.com

121–130 of 188 posts

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#121

I like Persona a lot and I would love to implement it on some of my sites, but I wonder how to best describe what it does to the average user. "Sign in with Persona" will probably look just as bad as "Sign in with Facebook"...

Three possible approaches, from most to least verbose:

1. http://sloblog.io/login has a nice, explanatory landing page.

2. https://www.voo.st/ has a small string of explanatory text at the point where a user chooses between Facebook or Persona auth.

3. http://crossword.thetimes.co.uk/ has a simple, unbranded "log in" button that just opens the popup.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#123

When it works with Gmail, then the world gets better.

Though we might need a month or two to get a few last details ironed out, an identity bridge for Gmail is absolutely coming soon. Until then, we wanted to soft launch with a single bridge (Yahoo) before throwing the switch for everyone.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#124
post #114

Earlier quoted context omitted.

It's not clear at all. It's not clear to me and I've been a web developer for 15 years! - I go to this site that I've never been to before - It asks me to sign in with my email address, but I've never been to the site before so assume it doesn't "know" my email address - I think look for a "Create Account" button to set up my account - Now I'm confused as there is not a button anywhere - I think "Well, I can't just t…

Hey, so any email address will work. If it's not a Persona identity provider, then you'll just get prompted to create an account with the persona.org fallback IdP. You can see this right now by trying to login using a gmail account vs a yahoo mail account. Does this help?

I understand the premise now, but it took me a while to figure out how it worked. The problem is, what they really need to say is something like:

"You can put any email address in here. If Persona has seen you before you can just put in your password and you're set. If you put in an email address that we have an integration with (like Yahoo) then you're all set. If you put in an address that we dont know, we'll ask you to create an account and then you'll be signed in. We might well have seen you before, so maybe try your 'normal' email address but the chances are you won't know whether we know about you as this is all too new."

Because THAT is basically how it works (AFAICT) but obviously that's a lot of text and no one actually reads text on websites.

The problem is that no one knows WTF persona is. Like my Dad and my wife have no idea what it is. They are also REALLY nervous about just putting their email address and password for a separate account into a website they have never seen before, AND FOR GOOD REASON!

This is a total usability clusterfuck. You expect my Dad (who calls the entire internet "Google") to accept this and not get worried about it?

They need to put MASSIVE INTERNET BRAND LOGOS in that box. Like Facebook, Google, Yahoo, Apple. Brands like that. Brands that, you know, my Dad has actually heard of and might actually have an account with.

I can see they are going in that direction with the Yahoo announcement, and MASSIVE KUDOS to them for that, that's a big step. Bit right now the usability is fucked and will stay fucked until the Persona brand as as big as Apple's or Google's. So never.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#125
post #112

Here is my feedback. Perhaps the marketing of "persona" to consumers should take a backseat. When I signed in to http://123done.org/ the pop up* showing "sign in with persona" confused me for a moment. For a moment, I thought.. "but I do not have a persona account" If there is a way for users to just sign in with their email without telling them how it is done, I am sure there will be even less friction. Of course, t…

The Persona branding is necessary because you aren't creating an account with the underlying website--you're creating an account with the persona.org fallback identity provider (that is, unless you're using a yahoo.com email or another Persona identity provider). Think about it this way: suppose you create a persona.org account at site X, then visit site Y which also uses Persona for login. It would look like site Y…

You're losing 95% of users right there, including many techies. What's "Persona" vs "persona.org" vs "Persona identity provider" vs "persona.org fallback identity provider"

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#126

Persona seems terribly important. And well designed, particularly compared to the ad hoc social login systems. I don't understand why it doesn't have more mindshare. Is it not yet ready for use by consumer sites?

It's still pretty new (as the link states, it's still in beta). I'd say that is probably a big part of it. That, and the whole federated/shared/social login space is confusing ! First there was OpenID, but then everyone jumped to OAuth. But wait, OAuth isn't really about authentication?! Throw in xAuth and all of Eran Hammer's rants, and you quickly realize that anything resembling consensus is pretty tenuous, at bes…

OAuth is still very useful if you need more data from a user than just that he's who he says he is. If your app processes user data from another source, OAuth is still the best choice.

Also, people recognize Facebook and Google as brands they already have accounts with. When a user sees a big blue/red Sign In With Facebook/Google button, that's an easier decision than hand-keying your credentials (especially on a tiny and slow mobile keyboard). Moreover, users trust Facebook and Google to know how to secure their passwords better than randomsiteijustfound.com, so they may believe OAuth is safer than trusting that randomsiteijustfound.com's developer knows how to properly hash a password.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#127

Earlier quoted context omitted.

The popup has to explain WHY it is asking for an email address. Else, Average Joe is just going to assume you are a spam site asking for his email.

After you click a button labeled sign in, the popup reads "[Your site] uses Persona instead of usernames to sign you in. To sign in with Persona, please enter your email address." I'm not sure I can do better than that text -- do you have any suggestions?

Sure. How about adding "This does not require registration in advance." (Or "previous registration" or "a previous account" or whatever is clearest). The problem is users searching for "Create Account" instead of "Sign In" when there is no "Create Account".

Edit: Sorry, on review this post was tangential to the point to which you were responding (about why the email is needed). It was targeted more at the point about user confusion by the login process.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#128

I implemented persona for ASP.Net MVC3 and it was hands down the easiest login system I've ever built in my career. From a developer standpoint it's very intuitive, the documentation is great, and I loved it so much I open sourced my implementation. https://github.com/sergiotapia/ASP.Net-MVC3-Persona-Demo Please give this a shot! I would only like them to keep more information on hand, like a first name, or an avatar…

I don't think you've actually implemented the protocol. Like most of the other examples I've looked at, you explicitly check every login attempt with the hard-coded mozilla verifier. This breaks two of the selling features of browserid:

1) Your identity provider doesn't know where/when you login because the relying party (the website) is supposed to cache the identity providers public key.

2) When identity providers start implementing browserid, it's not going to make any difference because you're not checking back with the identity providers website, as encoded in the assertion.

What you've implemented here is more like Microsoft Passport - a single point of failure through which all logins flow.

So, as a bootstrap mechanism the Persona service fails, because assuming people jump on the browserid bandwagon, we'll still be stuck using Persona because all the websites have implemented the protocol wrong (as in this case).

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#129
post #114

Earlier quoted context omitted.

It's not clear at all. It's not clear to me and I've been a web developer for 15 years! - I go to this site that I've never been to before - It asks me to sign in with my email address, but I've never been to the site before so assume it doesn't "know" my email address - I think look for a "Create Account" button to set up my account - Now I'm confused as there is not a button anywhere - I think "Well, I can't just t…

Hey, so any email address will work. If it's not a Persona identity provider, then you'll just get prompted to create an account with the persona.org fallback IdP. You can see this right now by trying to login using a gmail account vs a yahoo mail account. Does this help?

So, maybe the short description should not be 'sign in with persona' or 'sign in with your email', but 'sign in with any email'.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#130
post #49

Earlier quoted context omitted.

Directly from the article: Julius Schorzman of DailyCred, the instant CRM package for any web site, implemented Persona and remarked “We’ve seen from our internal metrics that more than 70% of users still prefer email and password authentication over social log-in like Facebook. Implementing Persona is actually easier than Facebook Connect, or any OAuth implementation we’ve seen.” People want control over their ident…

I'm personally not a big fan of social sign in, and i doubt i'm going to use persona (at this time). Persona seems like to me kinda like what the chinese are doing with requiring people to use .gov ids on the web. Sure in china it will be by force and here it will be opt in, but in my eyes the result will be the same: making it easier to track people across the web. I don't feel like persona solves the ability for a…

You can run your own persona identity provider on your own domain, then use an email address at that domain to log in. You get to control the authentication, the password policy, decide on multi-factor, etc.

This actually very much can solve the inability people have to control their identity on the web.

Post reply on HN