31–40 of 154 posts
I haven't look at the specs deeply, but it would be nice to have a system that did not need any kind of server at all, but the browser itself could be the Persona identity provider. The actual local data needed to pull it off could be replicated (encrypted) to cloud storage so it would work across all your devices and browsers, but the actual profile data itself would never be readable by the servers. I started looki…
Earlier quoted context omitted.
Firefox supports Persona and they're not going to support OpenID.
Can you elaborate on that? OpenID was designed to be browser-independent. Persona is essentially a distributed openID with some extra browser integration. Sure Mozilla doesn't support openID, but I'm unsure what you would want them to do...
Currently wondering the most sensible approach to make a single-user website support this protocol, so that I can make my email address (the only valid email address at my domain) support Persona natively. I don't really want to have to set up a username/password system with a single user. I'd almost prefer to manually hand my identity's private key to each browser I want to use. I wonder how much work it would take…
It seems all required is publishing a `/.well-known` URL that delegates to another provider, although it's not obvious if such a provider exists yet. Pretty cool it's this straightforward, though.
Earlier quoted context omitted.
It seems all required is publishing a `/.well-known` URL that delegates to another provider, although it's not obvious if such a provider exists yet. Pretty cool it's this straightforward, though.
I don't want to delegate to another provider, though; I'd like to take advantage of the decentralized approach, and authenticate my own email address.
How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…
There are ways to formulate the same question which would be much nicer and less negative, for example:
"It's great to see other solutions providing things similar to OpenID. Can anyone explain what are the differences with OpenID?"
Simply writing: "How is this different from XXX?" just sounds rude and negative.
Earlier quoted context omitted.
I don't want to delegate to another provider, though; I'd like to take advantage of the decentralized approach, and authenticate my own email address.
What is your preferred server environment? This would be a fun project to whip up quickly.
Hence the idea of just pre-generating the key pair and sharing the key with my browsers via Firefox Sync.
The provisioning and signin pages could point to static pages that just say "If you're seeing this, you're trying to authenticate as me and you aren't me; go away."
I haven't look at the specs deeply, but it would be nice to have a system that did not need any kind of server at all, but the browser itself could be the Persona identity provider. The actual local data needed to pull it off could be replicated (encrypted) to cloud storage so it would work across all your devices and browsers, but the actual profile data itself would never be readable by the servers. I started looki…
However I've got one question: was this conceived from the start with security in mind and is it simple enough as to not be plagued with the countless security issues which product that are too complex inevitably run into?
I'm thinking, for example, of the various recent OAuth SNAFUs.