Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Persona Beta: Millions of Users Ready to Log In using Any Browser

identity.mozilla.com

Post reply on HN
Print view View original

171–180 of 188 posts

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#171

Post by unhammer »

scragg wrote: post #39

I tried to log in to this site https://current.trovebox.com/ which was linked on the Persona home page: http://www.mozilla.org/en-US/persona/ I tried to use my gmail address and it gave me this: http://dl.dropbox.com/u/13941904/persona.png Am I just making up a password for a Persona account and it's using my email address as the user id? I can see how some people would type in their gmail password in by mistake.

I found this bit confusing too, but in a different way.

The first time around, I knew I was making up a new password, just not where it would be stored.

Then much later I used a different computer (but firefox sync'ed) and tried logging in to Persona, got asked for a password, and thought "oh, so now I make up a new one because it's a new browser and this is BrowserID? Where is this password stored anyway?"

I'm guessing that password is stored on persona.org, not in my sync profile, but even after reading http://lloyd.io/how-browserid-works I still find this one point confusing.

EDIT: I now see that the creation bit has a "verify" field whereas the sign-in bit has only one field, I guess that should have been my hint to use the same password as before. I'm still wondering though how it works when you have several email accounts on one browser, do they all share the same password? Does persona.org know that I have all those email addresses?

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#172

Post by unhammer »

pyxy wrote: post #122

Sometimes I create accounts with email address like me+thissite@gmail.com. It is handy for filtering emails from thissite later. Will this great feature of email (SMTP?) be available to me with Persona? I mean email address synonyms.

I already have three such aliases in my Persona account. I'd say Persona makes it easier to use the me+thissite@fastmail.com method. Of course, if you add a hundred such, you'll get a very long list to click through when you log in …

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#173

Post by unhammer »

pekk wrote: post #141
ozten wrote: post #34

Earlier quoted context omitted.

You can choose any email address you control. Persona doesn't force you to use one identity. Sites that use Facebook connect on the other hand...

Nowadays you can't get a gmail account without verifying using a phone number...

Good thing email != gmail, then.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#174

Post by bluehex »

I clicked on the first link, in the announcement of one of their adopters "The Eclipse Foundation" (actually their Orion project: https://orionhub.org/), to see what the sign in flow was like. I already had a Persona account from the early announcements but wanted to see it on a real site.

The experience was bad. I signed in with Persona on Orion to be greeted with "There is no Orion account associated with your Persona email. Please register or contact your system administrator for assistance." Isn't the whole point that I don't need to register?

I clicked the register button to see what more it would require and they wanted a user name, password, and email. With such a poor integration the whole idea of not having to remember another, username and password is lost isn't it? Obviously this particular failure is the fault of the integrating site and not Persona which seems really cool.

Screen shot after logging in with Persona; then after clicking register: http://imgur.com/a/WCKnh

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#175

Post by groks »

sergiotapia wrote: post #145
groks wrote: post #142

Earlier quoted context omitted.

That's right, you're not a 'provider', you're a 'relying party' - but you are unconditionally relying on the bootstrap mozilla service. You're not supposed to swap that out and rely on some other service, you're supposed to look at the assertion provided by the browser (or the javascript shim right now, while we bootstrap). Who you verify the assertion with depends on the user's email address. So, if tomorrow Google…

I see what you mean now. I understand, but don't know how I could fix this. _Can_ this be fixed with the current state of Persona? Specifically: >Gmail key cached, and can verify the assertion without any http requests to anywhere. Would love to read some example code if you have some. Thanks!

This is the best example I've found:

https://github.com/mozilla/PyBrowserID/blob/master/browserid...

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#176

Post by derefr »

dabeeeenster wrote: post #124
6a68 wrote: post #114

Earlier quoted context omitted.

Hey, so any email address will work. If it's not a Persona identity provider, then you'll just get prompted to create an account with the persona.org fallback IdP. You can see this right now by trying to login using a gmail account vs a yahoo mail account. Does this help?

I understand the premise now, but it took me a while to figure out how it worked. The problem is, what they really need to say is something like: "You can put any email address in here. If Persona has seen you before you can just put in your password and you're set. If you put in an email address that we have an integration with (like Yahoo) then you're all set. If you put in an address that we dont know, we'll ask y…

There's a sleight-of-hand Amazon plays with their own sign-in box: they give you a single "email" box, and then two radio buttons -- "I'm new" and "I already have an account and here is my password" [with a password input below that option].

The clever thing is, the radio buttons are completely ignored -- if you have an account and the password matches, you get logged in; if you didn't put in a password, and the email isn't in their records, they bring you to the account creation flow. The radio buttons are just there to let users express a choice they expected to be able to make, and thereby keep them in flow.

A better Persona login box could just do the same thing, but without the password input box under the "I already have an account" option. In fact, since selecting an option is the last step of the flow, just have an email field with two buttons, "Sign Up" and "Log In". Both buttons do the same thing :)

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#178

Post by groks »

seanmonstar wrote: post #147
groks wrote: post #142

Earlier quoted context omitted.

That's right, you're not a 'provider', you're a 'relying party' - but you are unconditionally relying on the bootstrap mozilla service. You're not supposed to swap that out and rely on some other service, you're supposed to look at the assertion provided by the browser (or the javascript shim right now, while we bootstrap). Who you verify the assertion with depends on the user's email address. So, if tomorrow Google…

Actually, the the verifier (verifier.login.persona.org) runs code that could be run on any server. It _does_ check Gmail for the well-known file first, and then, since not found, uses the fallback of login.persona.org. As soon as Gmail (or any id provider) implements a well-known file, the verifier will immediately use that instead. And the script that does all this _could_ be run on your own server. The only reason…

I think this is a bad idea:

You are using marketing terms like "Persona is distributed. Today" (last weeks blog title) but it isn't, because every auth request flows through mozilla servers. You are also advertising that it is so simple, the entire website example is 70 lines of python (recent talk), but it isn't, because you aren't implementing browserid, you're delegating to the centralised mozilla server.

Advertising that it is distributed and simple does not accurately communicate the current state of the implementation. Look at the spec:

https://github.com/mozilla/id-specs/blob/prod/browserid/inde...

> This assertion is a Backed Identity Assertion, as defined above. We call it assertion here for simplicity, since the Relying Party typically need only pass this assertion to a verifier service without worrying about the specific semantics of the assertion string.

It does not say that the centralised mozilla verifier is temporary, but expected.

This all leads to people getting the wrong impression. As you say, it is hard to get people to update software on their servers, but they don't even know that they have to - because it's distributed, today, and simple - so they aren't going to be looking. Another group of people are going to look at the spec and implementations and think: what is the point of yet another login scheme which just pipes everything through mozilla?

This is not going to help the adoption of browserid.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#179

Post by OoTheNigerian »

6a68 wrote: post #112
OoTheNigerian wrote: post #29

Here is my feedback. Perhaps the marketing of "persona" to consumers should take a backseat. When I signed in to http://123done.org/ the pop up* showing "sign in with persona" confused me for a moment. For a moment, I thought.. "but I do not have a persona account" If there is a way for users to just sign in with their email without telling them how it is done, I am sure there will be even less friction. Of course, t…

The Persona branding is necessary because you aren't creating an account with the underlying website--you're creating an account with the persona.org fallback identity provider (that is, unless you're using a yahoo.com email or another Persona identity provider). Think about it this way: suppose you create a persona.org account at site X, then visit site Y which also uses Persona for login. It would look like site Y…

I get where you are coming from but I strongly thing you should test it.

So if for instance, the user enters his email and is using a persona identity provider, e.g Yahoo It could just give a message 'Sweet, why don't you login with Yahoo " or create an account.

If the user has a Persona account already, once the email is put, it could say "Perfect! You are logged in"

If the user is using persona for the first time and does not user an identity provider, it could just bring a persona form.

Of course, for each instance, you could have a tiny "powered by persona" somewhere. With a bit of thinking it can be refined.

I do not see any reason why a user will want to start thinking about what persona is. They will just use an alternative (Facebook). What persona should be aiming for should be to become "login with email" and not another 3-in-one brand called persona.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#180

Post by StavrosK »

callahad wrote: post #169
PommeDeTerre wrote: post #168

Earlier quoted context omitted.

That's unfortunate to hear. I would have hoped that you'd be more aware of its actual level of adoption. Taking an objective look at the situation, as somebody who isn't tied to the project, I just don't see it being used. While so many web sites and applications allow authentication using Google, Facebook, Twitter and even some other more obscure providers, I never see Persona listed as an option. The adopters liste…

I contest that GNU Mailman, the Eclipse Foundation, Firebase, the Born This Way Foundation, and Discourse are hardly "minor, at best." Not to mention extensive dogfooding within Mozilla itself. Less flippantly, these things take time. While the initiative has been public for some time, it's only been in beta for roughly 6 months. It would be irresponsible for many organizations to jump on board this early, and taking…

Well, as both a developer and a user, I hope that Persona catches on. I certainly use it on all my new sites, and preach it whenever I can.

It's definitely still early. Hopefully it will spread quickly.

EDIT: Where's the Firebase signup? I only see a Github and a plain one.

Post reply on HN