Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Persona Beta: Millions of Users Ready to Log In using Any Browser

identity.mozilla.com

Post reply on HN
Print view View original

31–40 of 188 posts

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#31

Post by ecaron »

jakub_g wrote: post #19

Can someone recommend a good article about how Persona exactly works under the hood? I've seen zillions of news about Persona but haven't grasped the main concept. Comparison with OpenID will be appreciated also. Many of articles say that Persona is great and awesome etc. but do not explain what are the advantages and security implications.

If you're looking under the hood, the mechanic's blog at http://lloyd.io/how-browserid-works offers a great explanation. The Mozilla blog covered the OpenID comparison at http://identity.mozilla.com/post/7669886219/how-browserid-di..., but it doesn't embrace the level of geekery you're likely seeking.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#32

Post by kibwen »

jakub_g wrote: post #19

Can someone recommend a good article about how Persona exactly works under the hood? I've seen zillions of news about Persona but haven't grasped the main concept. Comparison with OpenID will be appreciated also. Many of articles say that Persona is great and awesome etc. but do not explain what are the advantages and security implications.

How it works under the hood: http://lloyd.io/how-browserid-works

Comparison to OpenID: http://identity.mozilla.com/post/7669886219/how-browserid-di...

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#33

Post by ozten »

lifeformed wrote: post #24

Can I associate additional data to my profile? A lot of websites I use want to know my name, nickname, age, avatar-pic, timezone, etc. It would be nice if I could store it all with my Persona account and selectively allow access to sites that request it. I could even store my credit card info, and when the site wants me to fill in my address and such, I just click to allow access to that data, which can then autofill…

No, we don't currently provide any profile information.

We'd love to see more experiments in this space. Get involved https://github.com/mozilla/browserid

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#34

Post by ozten »

daphneokeefe wrote: post #20

So I can log in everywhere using the exact same username? This will make it SO much easier for the user data trackers to capture and aggregate all of the information they can about me. I think I'll take a pass.

You can choose any email address you control. Persona doesn't force you to use one identity.

Sites that use Facebook connect on the other hand...

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#35

Post by jordan0day »

NelsonMinar wrote: post #13

Persona seems terribly important. And well designed, particularly compared to the ad hoc social login systems. I don't understand why it doesn't have more mindshare. Is it not yet ready for use by consumer sites?

It's still pretty new (as the link states, it's still in beta). I'd say that is probably a big part of it.

That, and the whole federated/shared/social login space is confusing! First there was OpenID, but then everyone jumped to OAuth. But wait, OAuth isn't really about authentication?! Throw in xAuth and all of Eran Hammer's rants, and you quickly realize that anything resembling consensus is pretty tenuous, at best.

Persona looks solid, though -- here's hoping browser developers jump on board quickly. I'm concerned that OAuth's delegated authentication mechanism might remain king for a lot of free web apps, though. The ability to require permissions to post (spam) to your users timeline/wall (even if it's not actually needed by your application) is probably pretty tempting for someone trying to work every angle possible to make money from their application. Every angle other than actually charging for their service, that is.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#36

Post by abhinavg »

jakub_g wrote: post #19

Can someone recommend a good article about how Persona exactly works under the hood? I've seen zillions of news about Persona but haven't grasped the main concept. Comparison with OpenID will be appreciated also. Many of articles say that Persona is great and awesome etc. but do not explain what are the advantages and security implications.

This is off the top of my head so maybe somebody will correct me, but:

Persona is a login system that cares about your privacy. With social login systems, the website you are logging into contacts the social login provider (Facebook/Google+/Twitter/what-have-you) when you attempt to log in. So you end up leaving a trail of breadcrumbs behind you of every site you visited (and used a social login on). Further, many people are not comfortable giving sites access to their social accounts because of privacy concerns.

With Persona, the idea is that your identity provider (can be your email provider, persona.org , or someone else) will have a key publicly available on their site. Your browser would generate a certificate that can be verified against that key. However, since the same key from the provider is used to authenticate all accounts on that provider, all the provider finds out when a website contacts it for the key is that someone is trying to log into said website. Plus, the website could cache the certificate and now the provider does not know this either.

There is more to this so you're probably better off reading one of the other links.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#37

Post by riquito »

OoTheNigerian wrote: post #29

Here is my feedback. Perhaps the marketing of "persona" to consumers should take a backseat. When I signed in to http://123done.org/ the pop up* showing "sign in with persona" confused me for a moment. For a moment, I thought.. "but I do not have a persona account" If there is a way for users to just sign in with their email without telling them how it is done, I am sure there will be even less friction. Of course, t…

"sign in with persona" may be confusing now but "sign in with your e-mail" it's pretty clear https://developer.mozilla.org/en-US/docs/persona/branding

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#38

Post by bzbarsky »

lazyjones wrote: post #22
NelsonMinar wrote: post #13

Persona seems terribly important. And well designed, particularly compared to the ad hoc social login systems. I don't understand why it doesn't have more mindshare. Is it not yet ready for use by consumer sites?

> I don't understand why it doesn't have more mindshare. Because all they've published so far is API specs and fluffy PR sites that try to portray it as "oh so much better" without offering any insight about why it is better. They can claim "more privacy" all day long, but without any details about what gets stored where and why it is supposed to be safer, they don't make a compelling case. Look at this page for exam…

Er... "they" have also published the full source code involved (at https://github.com/mozilla/browserid ) and a privacy policy at http://www.mozilla.org/en-US/persona/privacy-policy/ that you can compare to said source code as desired, if you're using Mozilla's identity provider.

As far as the architecture of the overall thing, there are also http://identity.mozilla.com/post/7899984443/privacy-and-brow... and http://identity.mozilla.com/post/11145921163/browserid-desig... and a technical specification at https://github.com/mozilla/id-specs/blob/prod/browserid/inde... that describes the exact data flow involved.

And if you read those, it should become pretty clear _why_ this is better for privacy than the FB or Google login systems. For one thing, the identity provider is never told that you're logging in.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#39

Post by scragg »

I tried to log in to this site https://current.trovebox.com/ which was linked on the Persona home page: http://www.mozilla.org/en-US/persona/

I tried to use my gmail address and it gave me this: http://dl.dropbox.com/u/13941904/persona.png Am I just making up a password for a Persona account and it's using my email address as the user id? I can see how some people would type in their gmail password in by mistake.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#40

Post by huhtenberg »

riquito wrote: post #37
OoTheNigerian wrote: post #29

Here is my feedback. Perhaps the marketing of "persona" to consumers should take a backseat. When I signed in to http://123done.org/ the pop up* showing "sign in with persona" confused me for a moment. For a moment, I thought.. "but I do not have a persona account" If there is a way for users to just sign in with their email without telling them how it is done, I am sure there will be even less friction. Of course, t…

"sign in with persona" may be confusing now but "sign in with your e-mail" it's pretty clear https://developer.mozilla.org/en-US/docs/persona/branding

It is not, actually.

A reasonable guess for "Sign in with your email" prompt is that you'd need to go through a typical account creation process using your email as a primary ID. In other words, the message looks like a synonym of "Create an account".

There gotta be more thought put into how to make people aware of Persona mechanism, because it is quite different from all existing sign-in options and it needs to be learned of explicitly.

Post reply on HN