Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona - Mozilla's decentralized and secure authentication system

developer.mozilla.org

Post reply on HN
Print view View original

31–40 of 53 posts

Re: Persona - Mozilla's decentralized and secure authentication system

#31

Post by Flimm »

natch wrote: post #16

Authentication mechanisms and they way they are implemented can have bleedover into the ability of a user to maintain control of their anonymity and privacy. Has there been any writeup that explains the potential impact of Persona on privacy? Not just the impact when used as intended, but also any unintended effects?

There's an hour long video discussing the measures taken to protect the user's privacy, given by Ben Adida, one of the developers. It's 12 months old, but I believe the protocol hasn't changed enough to make the information out of date.

https://www.youtube.com/watch?v=QDSh3osE4GQ

Also, see this blog post:

http://identity.mozilla.com/post/7899984443/privacy-and-brow...

Re: Persona - Mozilla's decentralized and secure authentication system

#32

Post by Flimm »

gambler wrote: post #27
fmarier wrote: post #14

Earlier quoted context omitted.

This talk gets into how the protocol works without getting too much into the crypto: https://www.youtube.com/watch?v=iZBTc7iEkQY

I just watched the video. So, apparently, the long-term goal is to have email providers to support this and sign user certificates. I'm still not clear on what information a certificate would contain. More importantly, I really dislike the answer to second question from the audience. Even when the system is fully supported without fallbacks, hacking person's email account will grant the attacker ability to log into a…

> If I understand it correctly, Persona will give [identity services like Gmail] more direct control over user's identities.

No, Gmail already has that control. Almost every website out there allows you to reset your password by sending you an email. If you control the user's email, you can change their passwords. Persona changes nothing in this regard.

Re: Persona - Mozilla's decentralized and secure authentication system

#33

Post by gambler »

Flimm wrote: post #32
gambler wrote: post #27

Earlier quoted context omitted.

I just watched the video. So, apparently, the long-term goal is to have email providers to support this and sign user certificates. I'm still not clear on what information a certificate would contain. More importantly, I really dislike the answer to second question from the audience. Even when the system is fully supported without fallbacks, hacking person's email account will grant the attacker ability to log into a…

> If I understand it correctly, Persona will give [identity services like Gmail] more direct control over user's identities. No, Gmail already has that control. Almost every website out there allows you to reset your password by sending you an email. If you control the user's email, you can change their passwords. Persona changes nothing in this regard.

1. Right now, Gmail has only as much control over accounts as individual website developers give it. It's up to us to implement alternative password reset system and make them the default. Any website can (and in my opinion should) switch to something else at any time, because, firstly, password reset system is decoupled from core authentication mechanism and, secondly, it is under web developer's control. Mass adoption of Persona will change this problem from locally solvable to unsolvable. If this becomes the authentication standard (which seems to be the project's goal), you will have to trust user's email provider.

2. Right now, Gmail can reset your password, but it cannot silently authorize someone else to use your account without you knowing. It seems (and correct me if I'm wrong here), that with Persona such scenarios will become possible.

Re: Persona - Mozilla's decentralized and secure authentication system

#34

Post by abrichr »

eslaught wrote: post #13

Are there any good descriptions for how Persona works? I can find plenty of developer documentation on this site, but I can't seem to find a good, concise description of what parties are involved and what the protocol is, etc. (Maybe I'm not looking deep enough? Anyway, thanks in advance.)

https://developer.mozilla.org/en-US/docs/Persona/Protocol_Ov...

Re: Persona - Mozilla's decentralized and secure authentication system

#35

Post by Flimm »

gambler wrote: post #21
fmarier wrote: post #20

Earlier quoted context omitted.

The fallback identity provider (at login.persona.org) does use email for password resets, but other identity providers will likely use other mechanisms.

I hope so, but why not do the right thing in the default identity provider? Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it: a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security iss…

One of the ways crackers gain access to a user's email is by guessing their password, a simple task when a huge number of users use the same password everywhere. With Persona, only your email provider (and the persona.org fallback) have your password (two passwords in the case of the fallback), hashed or not.

If you're already a password ninja and use a different and unpredictable password on every different site without forgetting them, Persona isn't an improvement in security. If you don't, as most users don't, Persona makes authentication more secure and more user-friendly at the same time.

With Persona, your weakest point would still be your email provider, which is why it would still be wise to recommend two-factor authentication for your email.

If you're already a password ninja and use a different and unpredictable password on every different site without forgetting them, AND you have enabled two-factor authentication with your email provider, Persona IS an improvement in security. This is because, with Persona, having two-factor authentication for your email would automatically mean two-factor authentication for all your websites as well.

Re: Persona - Mozilla's decentralized and secure authentication system

#36

Post by Flimm »

gambler wrote: post #33
Flimm wrote: post #32

Earlier quoted context omitted.

> If I understand it correctly, Persona will give [identity services like Gmail] more direct control over user's identities. No, Gmail already has that control. Almost every website out there allows you to reset your password by sending you an email. If you control the user's email, you can change their passwords. Persona changes nothing in this regard.

1. Right now, Gmail has only as much control over accounts as individual website developers give it. It's up to us to implement alternative password reset system and make them the default. Any website can (and in my opinion should) switch to something else at any time, because, firstly, password reset system is decoupled from core authentication mechanism and, secondly, it is under web developer's control. Mass adopt…

1. You're comparing Persona to an imaginary world where most websites don't rely on email providers to prove authentication. I'm comparing Persona with the actual situation where people use the same password everywhere. Persona isn't perfect, but it is much better than what the vast majority of websites use, and it allows even better methods to be implemented where needed. Furthermore, Persona is more usable, and therefore more attractive and more likely to be deployed widely.

2. Yes, it can. It can delete password reset notifications. If the notification contained the password in plain text, then there would be no easy way to find out whether Gmail logged in to your account on X. If the notification contained a password reset link, there is a possibility that the user would subsequently discover that their password was no longer accepted on X. But given that most users use the same password everywhere, Gmail already has a huge potential for evil, as it could just use the passwords it has already collected. Users that worry about Gmail can use an alternative email provider or their own, after all, email and Persona are both decentralised. Website developers that worry about Gmail can use other authentication methods on top of Persona, such as in-house two-factor authentication.

tldr; if Gmail is evil, both Persona and current systems can't stop it. If that worries you, use your own email server, and use other authentication methods on top of Persona on your websites.

Re: Persona - Mozilla's decentralized and secure authentication system

#37

Post by gambler »

Flimm wrote: post #36
gambler wrote: post #33

Earlier quoted context omitted.

1. Right now, Gmail has only as much control over accounts as individual website developers give it. It's up to us to implement alternative password reset system and make them the default. Any website can (and in my opinion should) switch to something else at any time, because, firstly, password reset system is decoupled from core authentication mechanism and, secondly, it is under web developer's control. Mass adopt…

1. You're comparing Persona to an imaginary world where most websites don't rely on email providers to prove authentication. I'm comparing Persona with the actual situation where people use the same password everywhere. Persona isn't perfect, but it is much better than what the vast majority of websites use, and it allows even better methods to be implemented where needed. Furthermore, Persona is more usable, and the…

You're comparing Persona to an imaginary world where most websites don't rely on email providers to prove authentication.

I'm comparing hypothetical mass-adoption of Persona with hypothetical mass-adoption of alternative password reset policy. It seems like a fair comparison.

Re: Persona - Mozilla's decentralized and secure authentication system

#38

Post by callahad »

gambler wrote: post #27
fmarier wrote: post #14

Earlier quoted context omitted.

This talk gets into how the protocol works without getting too much into the crypto: https://www.youtube.com/watch?v=iZBTc7iEkQY

I just watched the video. So, apparently, the long-term goal is to have email providers to support this and sign user certificates. I'm still not clear on what information a certificate would contain. More importantly, I really dislike the answer to second question from the audience. Even when the system is fully supported without fallbacks, hacking person's email account will grant the attacker ability to log into a…

Persona does place a lot of power in the hands of email providers, but as Flimm points out, that's already the status quo. Persona doesn't make that any worse.

What's more, Persona can be used with any email provider, so users can control who they trust, or take that trust into their own hands. Because that trust relationship is more explicit, users are (as your post demonstrates) more likely to consider the implications of trusting a specific email provider, which is a good thing.

A world with better password reset policies is still a world with passwords, and leak after leak have shown that 1) it's hard to get every site to do the right thing, and 2) people use and re-use terrible passwords. Persona lets sites do the right thing by default (since there is no password to store), and it lets me as a user better control my own security.

Re: Persona - Mozilla's decentralized and secure authentication system

#39

Post by wmf »

gambler wrote: post #33
Flimm wrote: post #32

Earlier quoted context omitted.

> If I understand it correctly, Persona will give [identity services like Gmail] more direct control over user's identities. No, Gmail already has that control. Almost every website out there allows you to reset your password by sending you an email. If you control the user's email, you can change their passwords. Persona changes nothing in this regard.

1. Right now, Gmail has only as much control over accounts as individual website developers give it. It's up to us to implement alternative password reset system and make them the default. Any website can (and in my opinion should) switch to something else at any time, because, firstly, password reset system is decoupled from core authentication mechanism and, secondly, it is under web developer's control. Mass adopt…

you will have to trust the user's email provider

Or another way to look at it is that you put the burden of choosing a responsible identity provider on the user. If the user chooses poorly they get owned, not you.

Re: Persona - Mozilla's decentralized and secure authentication system

#40

Post by wmf »

lukev wrote: post #7
StavrosK wrote: post #4

Earlier quoted context omitted.

The benefit is orders of magnitude better usability. I couldn't get users to grok OpenID, this just needs an email and password. How will my mom log in to an SSL-certificate-requesting site from another computer?

This has pretty much the same end-user experience as OpenID, unless I'm misunderstanding something. The user still has to sign in to the IdP.

In OpenID you have to enter your IDP URL and then optionally sign in to the IDP.

In Persona you will just click a button (because your browser knows your IDP) and then optionally sign in to your IDP. A huge difference.

Post reply on HN