Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona - Mozilla's decentralized and secure authentication system

developer.mozilla.org

Post reply on HN
Print view View original

21–30 of 53 posts

Re: Persona - Mozilla's decentralized and secure authentication system

#21

Post by gambler »

fmarier wrote: post #20
gambler wrote: post #15

Earlier quoted context omitted.

Two big issues so far: it still uses email for password resets (without alternatives that I know of) and it doesn't work without JavaScript. I hope both of them get addressed.

The fallback identity provider (at login.persona.org) does use email for password resets, but other identity providers will likely use other mechanisms.

I hope so, but why not do the right thing in the default identity provider?

Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it:

a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security issues if they don't.

b) Stop using emails for password resets, since you don't really know how trustworthy your users' email providers are.

Re: Persona - Mozilla's decentralized and secure authentication system

#22

Post by StavrosK »

gambler wrote: post #21
fmarier wrote: post #20

Earlier quoted context omitted.

The fallback identity provider (at login.persona.org) does use email for password resets, but other identity providers will likely use other mechanisms.

I hope so, but why not do the right thing in the default identity provider? Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it: a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security iss…

Because they just went in beta and there's tons of other stuff to iron out first?

Re: Persona - Mozilla's decentralized and secure authentication system

#23

Post by StavrosK »

shantanubala wrote: post #5
lukev wrote: post #2

Other than the benefit of using strong crypto under the hood, I'm not sure what benefits this has over a system like openid. It has about the same level of interactional complexity, and at the additional cost of requiring browser support. If we're going to have browser support anyway, I'd rather just use standard two-way SSL and put the work into developing better UI and private key distribution systems for it. It's…

Usability involves more than one target audience: it also has to be easy for developers to integrate. BrowserID (Persona) took me minutes to implement. On a non-trivial project, it may take a couple hours. The beauty of this is the fact that it still works without built-in browser support. It's designed to be a forwards-compatible API that only becomes more usable with time. Additionally, email is an excellent way to…

I've forgone traditional auth in favor of Persona because there are just too many advantages. The user might already have an account, the flow is very good if they don't, it takes literally three minutes to integrate django-browserid (or whatever it's called now) versus skinning quite a few templates for all the login and reset forms, it saves the user from having to remember yet another password, etc etc.

I couldn't be happier with a signin solution. It even complements my legacy solution very well, you can see a demo at http://www.yourpane.com (click "Persona", never mind the email field.)

Re: Persona - Mozilla's decentralized and secure authentication system

#24

Post by wgd »

I really like the overall result of Persona when used for logging into a web site, but has anyone come up with a good way of integrating Persona login with mobile apps or APIs?

I suppose mobile apps would ideally use some sort of Persona login service provided by the underlying OS, and until such a thing exists I guess an app could reimplement all the user-agent logic and load the user's login page in a webview. But I have no idea how at all I would go about designing an API for a website which uses Persona for logins.

Re: Persona - Mozilla's decentralized and secure authentication system

#25

Post by callahad »

natch wrote: post #16

Authentication mechanisms and they way they are implemented can have bleedover into the ability of a user to maintain control of their anonymity and privacy. Has there been any writeup that explains the potential impact of Persona on privacy? Not just the impact when used as intended, but also any unintended effects?

I'm not aware of any standalone articles, but something of that nature would be really fantastic. Such an article would probably be best if written by someone outside of the Persona team.

Re: Persona - Mozilla's decentralized and secure authentication system

#26

Post by callahad »

wgd wrote: post #24

I really like the overall result of Persona when used for logging into a web site, but has anyone come up with a good way of integrating Persona login with mobile apps or APIs? I suppose mobile apps would ideally use some sort of Persona login service provided by the underlying OS, and until such a thing exists I guess an app could reimplement all the user-agent logic and load the user's login page in a webview. But…

We don't have a good path for native apps, yet. There have been a few experiments using Persona in native iOS (Pancake) and Android (Soup) environments, and it apparently works great in PhoneGap apps, if you use the ChildBrowser plugin.

The bug to watch is this one: https://github.com/mozilla/browserid/issues/2034 supporting environments without popups will clear the way for good native SDKs.

Re: Persona - Mozilla's decentralized and secure authentication system

#27

Post by gambler »

fmarier wrote: post #14
eslaught wrote: post #13

Are there any good descriptions for how Persona works? I can find plenty of developer documentation on this site, but I can't seem to find a good, concise description of what parties are involved and what the protocol is, etc. (Maybe I'm not looking deep enough? Anyway, thanks in advance.)

This talk gets into how the protocol works without getting too much into the crypto: https://www.youtube.com/watch?v=iZBTc7iEkQY

I just watched the video. So, apparently, the long-term goal is to have email providers to support this and sign user certificates. I'm still not clear on what information a certificate would contain.

More importantly, I really dislike the answer to second question from the audience. Even when the system is fully supported without fallbacks, hacking person's email account will grant the attacker ability to log into all websites as the victim?

I already am quite concerned with how much control over everyone's identities services like Gmail have. If I understand it correctly, Persona will give them more direct control over user's identities. It's only decentralized in a sense that different email providers will be able to implement it separately, and verify identities of their users.

I hope I'm missing something from the big picture here.

Re: Persona - Mozilla's decentralized and secure authentication system

#28

Post by Nux »

Sami_Lehtinen wrote: post #18
Nux wrote: post #11

How would I log in from a friend's computer with Persona? How about from an Internet cafe; how safe would it be? Persona looks like something that lock's you into a certain device or at least makes it harder to log in on device's that are not your own. I'd rather they made OpenID less scarry (to average Joe) instead.

You really shouldn't login from any non-secure terminal. I have catched even pros doing that mistake with production systems. It's major fail!

Major fail or not a good part of the world does not own their own computer.

Re: Persona - Mozilla's decentralized and secure authentication system

#29

Post by ozten »

Nux wrote: post #11

How would I log in from a friend's computer with Persona? How about from an Internet cafe; how safe would it be? Persona looks like something that lock's you into a certain device or at least makes it harder to log in on device's that are not your own. I'd rather they made OpenID less scarry (to average Joe) instead.

Please try this today. It's one main reason The Times uses it on their Crossword product...

This is safe on a public computer or shared device, if you logout.

Persona also has some UI around public versus personal devices.

Re: Persona - Mozilla's decentralized and secure authentication system

#30

Post by inportb »

gambler wrote: post #27
fmarier wrote: post #14

Earlier quoted context omitted.

This talk gets into how the protocol works without getting too much into the crypto: https://www.youtube.com/watch?v=iZBTc7iEkQY

I just watched the video. So, apparently, the long-term goal is to have email providers to support this and sign user certificates. I'm still not clear on what information a certificate would contain. More importantly, I really dislike the answer to second question from the audience. Even when the system is fully supported without fallbacks, hacking person's email account will grant the attacker ability to log into a…

  > Even when the system is fully supported without fallbacks,
  > hacking person's email account will grant the attacker
  > ability to log into all websites as the victim?
With or without Persona/BrowserID, your email account(s) is the key for logging into a whole bunch of other Web services, since it is already used for resetting passwords and such. Persona/BrowserID does not solve this problem.

The big picture is that it makes distributed identity easy for the average user to grok.

Post reply on HN