Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Persona Beta: Millions of Users Ready to Log In using Any Browser

identity.mozilla.com

Post reply on HN
Print view View original

131–140 of 188 posts

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#131

Post by cmpitg »

6a68 wrote: post #112
OoTheNigerian wrote: post #29

Here is my feedback. Perhaps the marketing of "persona" to consumers should take a backseat. When I signed in to http://123done.org/ the pop up* showing "sign in with persona" confused me for a moment. For a moment, I thought.. "but I do not have a persona account" If there is a way for users to just sign in with their email without telling them how it is done, I am sure there will be even less friction. Of course, t…

The Persona branding is necessary because you aren't creating an account with the underlying website--you're creating an account with the persona.org fallback identity provider (that is, unless you're using a yahoo.com email or another Persona identity provider). Think about it this way: suppose you create a persona.org account at site X, then visit site Y which also uses Persona for login. It would look like site Y…

So how about something like "Sign in to ABC with Persona", or "Sign in to ABC with Personal using your email" (more specific)?

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#132

Post by sergiotapia »

groks wrote: post #128
sergiotapia wrote: post #61

I implemented persona for ASP.Net MVC3 and it was hands down the easiest login system I've ever built in my career. From a developer standpoint it's very intuitive, the documentation is great, and I loved it so much I open sourced my implementation. https://github.com/sergiotapia/ASP.Net-MVC3-Persona-Demo Please give this a shot! I would only like them to keep more information on hand, like a first name, or an avatar…

I don't think you've actually implemented the protocol. Like most of the other examples I've looked at, you explicitly check every login attempt with the hard-coded mozilla verifier. This breaks two of the selling features of browserid: 1) Your identity provider doesn't know where/when you login because the relying party (the website) is supposed to cache the identity providers public key. 2) When identity providers…

You're correct. This is _not_ a persona provider. It would be more correct to call it "Here's how you can use Persona in an MVC3 application."

---

>So, as a bootstrap mechanism the Persona service fails, because assuming people jump on the browserid bandwagon, we'll still be stuck using Persona because all the websites have implemented the protocol wrong (as in this case).

Please elaborate here. You can just switch out the provider (in my case Mozilla) for another one easy enough. You're not tied down to a particular implementation.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#133

Post by 6a68 »

drdaeman wrote: post #120
badida wrote: post #98

Earlier quoted context omitted.

Choose your identity providers (and thus email addresses) wisely. They should be filtering spam for you / letting you control things. And they shouldn't be doing it by forcing you into their silo, the way "login with Twitter" buttons work.

Actually, it's my biggest problem with Persona is that the source of my identity is not me, but some third party I have to trust. I run my email addresses on my own (physically-owned) servers. I know various approaches to filtering spam, and the best one in my experience is to not have a littered inbox is to have a private non-dictionary per-service email address and not expose it anywhere else. The only mandatory th…

Actually, there's no reason you can't write your own personal identity provider: https://developer.mozilla.org/en-US/docs/Persona/Implementin...

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#134

Post by ozten »

megaman821 wrote: post #115
shared4you wrote: post #75

>> type in email, login to yahoo... Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman? Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

Isn't the second question equivalent to what we have now? If an attacker knows my Yahoo password, can he potentially reset all the passwords of sites I registered with using my Yahoo email address and login to them.

Great point. Previously discussed on HN, but this story paints the picture of the world we're already living in http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#135

Post by ricardobeat »

TylerE wrote: post #125
6a68 wrote: post #112

Earlier quoted context omitted.

The Persona branding is necessary because you aren't creating an account with the underlying website--you're creating an account with the persona.org fallback identity provider (that is, unless you're using a yahoo.com email or another Persona identity provider). Think about it this way: suppose you create a persona.org account at site X, then visit site Y which also uses Persona for login. It would look like site Y…

You're losing 95% of users right there, including many techies. What's "Persona" vs "persona.org" vs "Persona identity provider" vs "persona.org fallback identity provider"

I don't think any site using OpenID has a 95% bounce rate because of it. Persona is the name of the magic, you need a way to tell it from OAuth and other sign-in mechanisms.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#136

Post by ricardobeat »

cmpitg wrote: post #131
6a68 wrote: post #112

Earlier quoted context omitted.

The Persona branding is necessary because you aren't creating an account with the underlying website--you're creating an account with the persona.org fallback identity provider (that is, unless you're using a yahoo.com email or another Persona identity provider). Think about it this way: suppose you create a persona.org account at site X, then visit site Y which also uses Persona for login. It would look like site Y…

So how about something like "Sign in to ABC with Persona", or "Sign in to ABC with Personal using your email" (more specific)?

It's the same as "Sign in with Google", "Connect with Facebook", "Sign in with Twitter". It's implied.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#137

Post by Groxx »

drdaeman wrote: post #113
Groxx wrote: post #83

Earlier quoted context omitted.

I've been thinking about this, and I have come to the conclusion that it's less of an issue than I thought it was. For a simple reason: the "email address" you provide is just an identifier. A string formatted as "user@domain", nothing more. By convention it's a usable email address, but there is literally nothing preventing someone from starting up an email-less Persona identity provider. You'd still log in with you…

This is correct, but the whole thing is marketed as email address, so it will be used as an email address, i.e. means of contacting me. Now, consider I want to try some service I don't trust. I sign in with a email-looking identifier (which doesn't work as email address) and use the site for some time. Eventually, I become fond of this service and want it to start contacting me. With 123done.org I can't do this, nor…

Hopefully, the existence / use of non-emailable browserid providers would encourage sites to accept alternate / custom 'primary' email addresses. It's definitely a chicken-and-egg problem though, and far from guaranteed that it would be resolved happily. And I'm in complete agreement on the marketing, and it's a problem for this setup - the system is young though, maybe this can be changed.

Though honestly I suspect browserid would encourage this anyway, since people are likely to use their primary email address, and they are likely to change to a different address in the future. If sites want to keep people through such a change, they'll want to allow changing it (since I doubt I'm alone in resenting sites that require me to maintain an address I don't use. resentment isn't good for retention).

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#138

Post by ZirconCode »

laserDinosaur wrote: post #104

I'm confused - What is the difference between this and sites that let me login with my Google account?

Another big thing is privacy. Signing in with google, or facebook pretty much enables them to stalk you. This can't happen with person due to its architecture =)

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#139

Post by cinquemb »

takluyver wrote: post #93
cinquemb wrote: post #64

Earlier quoted context omitted.

I'm personally not a big fan of social sign in, and i doubt i'm going to use persona (at this time). Persona seems like to me kinda like what the chinese are doing with requiring people to use .gov ids on the web. Sure in china it will be by force and here it will be opt in, but in my eyes the result will be the same: making it easier to track people across the web. I don't feel like persona solves the ability for a…

As I understand it, there's nothing to stop you using a separate Persona ID for each site you visit, and none of your IDs has to be tied to your real life identity. But most people already give the same username and same e-mail on loads of different websites, so we're happy to carry on doing that. For now, most Persona users are stored in a central location by Mozilla. The idea is that e-mail providers take over auth…

Hmm, I can see how this would be better than using facebook connect for the risk adverse (though I must question that if one is using something like facebook connect or google whatever in the first place).

But most web users aren't risk adverse, and I question the utility this will have over facebook connect when using it in some kind of application that the user wants to use that requires some kind of social data in order to get the most out of the app.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#140

Post by cmpitg »

ricardobeat wrote: post #136
cmpitg wrote: post #131

Earlier quoted context omitted.

So how about something like "Sign in to ABC with Persona", or "Sign in to ABC with Personal using your email" (more specific)?

It's the same as "Sign in with Google", "Connect with Facebook", "Sign in with Twitter". It's implied.

Well, I personally don't think they do imply the same thing from a user's perspective.

* Google, Facebook, Twitter, ... have become so well-known brands comparing to the new Persona. Normal users could quickly get a sense of what "Sign in with Google/Facebook/Twitter/..." means, but not "Sign in with Persona" means.

* Persona is not a social network while other mentioned brands are or provide a sense of social network. A user might perceive "signing in with " as an act of making the site a part of the network; while with Persona it's totally different.

Post reply on HN