Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

131–140 of 207 posts

Re: Announcing the First Beta Release of Persona

#131

Post by zerostar07 »

callahad wrote: post #129
qikquestion wrote: post #98

Let me add my understanding. Please correct me if it is wrong. Actual user case if everything is in place: 1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/ ) 2.hit the login link. Give your email address (superuser123@gmail.com or superuser123@yahoo.com) 3.it prompts for your password - gmail password or yahoo password 4.post authentication it takes you to the website wit…

That's completely spot on. Right now, if your email provider doesn't have native support, we ask you to create a persona.org account so that Mozilla can vouch for you. In the future, this goes away. Similarly, the UI is all displayed in response to navigator.id.* functions. If a browser implements those natively, the Persona UI at login.persona.org completely goes away. The more successful Persona is, the less Mozill…

So if i signup now with my @gmail account through persona.org, what happens when google starts supporting browserid natively?

Re: Announcing the First Beta Release of Persona

#133

Post by ozten »

zerostar07 wrote: post #131
callahad wrote: post #129

Earlier quoted context omitted.

That's completely spot on. Right now, if your email provider doesn't have native support, we ask you to create a persona.org account so that Mozilla can vouch for you. In the future, this goes away. Similarly, the UI is all displayed in response to navigator.id.* functions. If a browser implements those natively, the Persona UI at login.persona.org completely goes away. The more successful Persona is, the less Mozill…

So if i signup now with my @gmail account through persona.org, what happens when google starts supporting browserid natively?

The BrowserID protocol states that Google should be used for authentication, instead of the fallback persona.org account.

Re: Announcing the First Beta Release of Persona

#134

Post by ozten »

donrhummy wrote: post #118
tofumatt wrote: post #116

Earlier quoted context omitted.

I believe the aim is to have email providers be able to auth your persona email instead of Mozilla, but Mozilla exists as a sort of polyfill if the provider (eg. hotmail.com, gmail.com, your-custom-domain.net) doesn't do persona yet. Also, yes: people can still choose crummy passwords. Personally, I don't think the appeal is in better security; it's convenience of single sign-on without it being tied to a. identity o…

Right, but the email providers are only authenticating you to Persona. As far as the websites using Persona are concerned, it's persona.org that authenticates you. And the appeal that Mozilla is pushing is definitely better security (as well as a distributed security authentication versus one for-profit authority - I definitely trust Mozilla MUCH more than Facebook or twitter, but it's still a central authority). You…

As a website you can do local verification of the log in assertion.

Mozilla hosts a verifier as a convenience, but you don't have to use it.

Re: Announcing the First Beta Release of Persona

#135

Post by fmarier »

qikquestion wrote: post #98

Let me add my understanding. Please correct me if it is wrong. Actual user case if everything is in place: 1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/ ) 2.hit the login link. Give your email address (superuser123@gmail.com or superuser123@yahoo.com) 3.it prompts for your password - gmail password or yahoo password 4.post authentication it takes you to the website wit…

> 3.it prompts for your password - gmail password or yahoo password

Yes. In this case the "it" that prompts for your password will be an iframe served from gmail/yahoo. Once they support Persona natively, login.persona.org is no longer in the loop and your gmail/yahoo password goes directly to gmail/yahoo.

Re: Announcing the First Beta Release of Persona

#136

Post by icebraining »

BryanB55 wrote: post #94

This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email passwo…

That's what two-factor auth is for.

Re: Announcing the First Beta Release of Persona

#137

Post by weaksauce »

dochtman wrote: post #102
JakeSc wrote: post #62

My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…

Persona, the protocol, doesn't actually rely on your email account's password. It uses the domain from your email account to figure out how to authenticate you; if you want to use some other way than via your email, that's fine.

The password that I create when I setup persona is for what exactly? It doesn't seem to be used at all after the creation a persona.

Re: Announcing the First Beta Release of Persona

#138

Post by loumf »

zerostar07 wrote: post #130
BryanB55 wrote: post #94

This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email passwo…

Then you would not use your primary "super secure" email as your browserId, but a secondary mail account.

The most valuable thing about your email account is that it's your password recovery mechanism. What ever email account you use for password recovery or logging into things becomes the "super secure" email account.

There is no message in my email that I care more about than the one that might give you access to my bank accounts.

Re: Announcing the First Beta Release of Persona

#140

Post by fmarier »

notatoad wrote: post #86
Osiris wrote: post #60

I just tried it on the Times Crossword page. The workflow is really simple and elegant. I put in my email address. It took a second to determine there was no Persona account, then asked for me to create a password. After that, I clicked on an authorization link in my email account and as soon as I did that it immediately logged me in. I clicked Log out and back in again and it immediately recognized me and logged me…

It does seem a pretty elegant way to log in, the only concern i have is that it's kind of unclear what password i needed to use to login. I had already created a browserID password at some point in the past, so when i went to the times crossword and clicked sign in, i was prompted for a password. my first thought was maybe i had already signed up for the times crossword, so i tried the password i probably would have…

Thanks, that's really good feedback.

I've pasted your comments into a bug report: https://github.com/mozilla/browserid/issues/2539

Feel free to jump in if you have ideas on how we can phrase this better.

Post reply on HN