Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

161–170 of 207 posts

Re: Announcing the First Beta Release of Persona

#161

Post by JakeSc »

gbhn wrote: post #109
JakeSc wrote: post #62

My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…

I think the ship has mostly sailed on email -- most sites use email password recovery, so that choice isn't up to you unless you get a different email address for each site. You should definitely use 2-factor authentication for your email!

> I think the ship has mostly sailed on email

You're right. Gmail does an excellent job with ensuring account integrity. I've lost and subsequently recovered access to Gmail accounts, and I must say they do it right. And like you said, I especially appreciate their two-factor auth.

I hope lay people are coming to realize the security importance of their email accounts.

Re: Announcing the First Beta Release of Persona

#162

Post by JakeSc »

loumf wrote: post #138
zerostar07 wrote: post #130

Earlier quoted context omitted.

Then you would not use your primary "super secure" email as your browserId, but a secondary mail account.

The most valuable thing about your email account is that it's your password recovery mechanism. What ever email account you use for password recovery or logging into things becomes the "super secure" email account. There is no message in my email that I care more about than the one that might give you access to my bank accounts.

> There is no message in my email that I care more about than the one that might give you access to my bank accounts.

This is very well phrased. Email sort of serves two purposes these days, each with very different security models: text-based communication, and external service authentication. Do you have any ideas for separating these two functions, or at least improving their security?

Re: Announcing the First Beta Release of Persona

#163

Post by zerostar07 »

jedp wrote: post #150
zerostar07 wrote: post #132

I don't know if it's appropriate but can we list some of websites where one can login through browserID? I 'm a big fan of browserID, and would gladly beta test your integration.

Sure thing. In addition to many of Mozilla's own sites, here are some examples: - Times Crossword: http://crossword.thetimes.co.uk/ - Openphoto: http://current.openphoto.me/ - Voost: https://www.voo.st/ Our test application is this notepad application: http://123done.org/ (which you can clone from github)

Been using it for a while on http://noteplz.com/ too

Re: Announcing the First Beta Release of Persona

#164

Post by [deleted] »

jedp wrote: post #150
zerostar07 wrote: post #132

I don't know if it's appropriate but can we list some of websites where one can login through browserID? I 'm a big fan of browserID, and would gladly beta test your integration.

Sure thing. In addition to many of Mozilla's own sites, here are some examples: - Times Crossword: http://crossword.thetimes.co.uk/ - Openphoto: http://current.openphoto.me/ - Voost: https://www.voo.st/ Our test application is this notepad application: http://123done.org/ (which you can clone from github)

[deleted]

Re: Announcing the First Beta Release of Persona

#165

Post by pwman »

johnkchow wrote: post #143
fmarier wrote: post #141

Earlier quoted context omitted.

Can you be more specific as to how you find the UX lacking? Getting UX right is a priority for Persona.

I was referring to LastPass's Chrome extension specifically, not Persona's UX. Sorry for the confusion.

Can you be more specific as to how you find the LastPass UX lacking? Getting UX right is a priority for LastPass too!

Re: Announcing the First Beta Release of Persona

#166

Post by callahad »

johnkchow wrote: post #158

As a user I definitely appreciate the emphasis of privacy first as well as its clear responsibility for identification. However, from how I see it on the surface, it currently doesn't have the market reach as, say, FB Connect or Google, and I don't want to "flood" my users with too many options for authentication. What's the practical arguments of rolling out my own authentication (Rails + Devise) vs using Personas?

It's available to any user with an email address -- you don't have to limit yourself to users that have, and are willing to use, a Facebook or Google account.

Versus rolling your own, you don't have the friction of account creation / password management for new user signups if the user has ever used Persona before, and we'll be dramatically improving first-contact before the end of the year. You can completely forget about storing passwords. You don't have to send email verifications or handle forgotten passwords.

Re: Announcing the First Beta Release of Persona

#167

Post by fletchowns »

JakeSc wrote: post #62

My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated wi…

People simply need to be very very careful about protecting their email account. Use two factor authentication, use a PIN on your smartphone, don't type your email address password on random internet cafe computers, etc.

Re: Announcing the First Beta Release of Persona

#168

Post by icebraining »

fmarier wrote: post #139
icebraining wrote: post #2

Support for Persona in HN would be awesome ...

...and assuming it's written in Python (is it?), it should be pretty easy to do: https://github.com/mozilla/browserid-cookbook/blob/master/py...

Nope, HN is written in Arc: https://en.wikipedia.org/wiki/Arc_(programming_language)

Re: Announcing the First Beta Release of Persona

#169

Post by seanmonstar »

timmclean wrote: post #96
benlower wrote: post #82

What if I don't want a site to know my email address? I currently create unique email addresses for each site. How do I do that with Persona?

It looks like it'd be pretty easy to continue that practice -- just verify more than one email address, and pick the correct one when signing into each site. Try it here: http://myfavoritebeer.org/ Also, there are Mailinator-like services: https://mockmyid.com/

Exactly. And there's even this service that tries to automate this into Persona: https://github.com/nmalkin/janus

Re: Announcing the First Beta Release of Persona

#170

Post by [deleted] »

timmclean wrote: post #96
benlower wrote: post #82

What if I don't want a site to know my email address? I currently create unique email addresses for each site. How do I do that with Persona?

It looks like it'd be pretty easy to continue that practice -- just verify more than one email address, and pick the correct one when signing into each site. Try it here: http://myfavoritebeer.org/ Also, there are Mailinator-like services: https://mockmyid.com/

[deleted]
Post reply on HN