Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

41–50 of 207 posts

Re: Announcing the First Beta Release of Persona

#41

Post by ozten »

DASD wrote: post #37

Are there any websites with implementations that don't prompt directly for Mozilla's site(i.e. asking for your preferred BrowserID provider)? I'd like to see how clunky the interface becomes when there are more providers(such as if I want to become my own provider) than just Mozilla. Is the user then confused by asking for a provider..ala OpenID? Am I correct in presuming Persona is an implementation of BrowserID? I'…

Go to https://eyedee.me and create an DASD account

Go to http://crossword.thetimes.co.uk/ - this is a non-Mozilla RP

Enter DASD@eyedee.com - This is a Primary Identity provider, source at [1]

So you see there is no BrowserID provider choosing screen, it's naturally part of the flow. you enter DASD@eyedee.com and the system checks for support and delegates to eyedee.com.

[1] https://github.com/mozilla/eyedee.me

Re: Announcing the First Beta Release of Persona

#42

Post by zeemonkee2 »

I've implemented this for my playground/weekend project site: http://myowndamnphotos.com.

It works quite well, with a few gotchas (mainly in the JS, handling the watch() event). If you're using Python the pyBrowserID library helps with some low-level details although it's easy enough with requests/urllib.

Re: Announcing the First Beta Release of Persona

#43

Post by DASD »

binarymax wrote: post #32

Have been messing around with BrowserID since it first went public last year (with a node.js backend) and I love it. Its so much more straightforward to implement than oauth and openid, and the fact that it's tied to your email address is perfect. I'm definitely going to be using it as my primary auth system going forward. Great job Mozilla!

Do you have examples of sites that don't use Persona as the BrowserID implementation? I'd like to see how sites are handling the user prompt when there are going to be alternative providers to Mozilla's Persona service.

Re: Announcing the First Beta Release of Persona

#45

Post by DASD »

ozten wrote: post #41
DASD wrote: post #37

Are there any websites with implementations that don't prompt directly for Mozilla's site(i.e. asking for your preferred BrowserID provider)? I'd like to see how clunky the interface becomes when there are more providers(such as if I want to become my own provider) than just Mozilla. Is the user then confused by asking for a provider..ala OpenID? Am I correct in presuming Persona is an implementation of BrowserID? I'…

Go to https://eyedee.me and create an DASD account Go to http://crossword.thetimes.co.uk/ - this is a non-Mozilla RP Enter DASD@eyedee.com - This is a Primary Identity provider, source at [1] So you see there is no BrowserID provider choosing screen, it's naturally part of the flow. you enter DASD@eyedee.com and the system checks for support and delegates to eyedee.com. [1] https://github.com/mozilla/eyedee.me

Thanks for posting the process flow. So (https://login.persona.org/sign_in) will always be shown? If so, then how is this truly decentralized with my privacy concerns mentioned above?

Re: Announcing the First Beta Release of Persona

#46

Post by opendomain »

ozten wrote: post #12
opendomain wrote: post #4

I can not get Persona to work. I go to Mozilla developer network: https://developer.mozilla.org/en-US/ , see the login button and click on it and it redirects me back to the same page. I am using Firefox 15

The first run on MDN can be a little confusing. Does it work for you on http://crossword.thetimes.co.uk/ ? If not, we'd love to help identify your issue https://github.com/mozilla/browserid/issues/new

Yea - there was nowhere for me to sign up. I think the problem may be the pop-up did not work on Firefox. I used Chrome and was able to create an account and then everything worked. I also tested on IE8 and had some javascript error, but just hit refresh twice and was able to login.

Re: Announcing the First Beta Release of Persona

#47

Post by weaksauce »

htmltablesrules wrote: post #35
callahad wrote: post #17

Earlier quoted context omitted.

It's decentralized public-key based authentication, wrapped up in an extremely user- and dev-friendly package. Francois Marier did a good job of explaining it at Kiwi PyCon 2012: https://www.youtube.com/watch?v=iZBTc7iEkQY (Think OpenID, but easier to use, easier to implement, and with better privacy protection.) In brief: instead of a username and password at login, you get a user's email address and cryptographical…

>No more password column in your database... Who has liability when a user of mine says their account got hacked? The email provider? My site? Mozilla? If one of my users has $100 go missing from their account, then they are going to expect me to replace it, not the email provider, not mozilla. I don't like the idea of shifting security to a outside platform, because I still retain all the liability when things go ba…

For financial items you could use two factor authentication. Or if your service has something that can be done with a lower set of privileges you could use persona there and fall back to "more secure" methods for anything with financial effects or account changes.

The use case seems to be more for sites like twitter, hacker news, reddit, etc...

Re: Announcing the First Beta Release of Persona

#48

Post by sandGorgon »

What is the self-hosted equivalent of this ? I have been struggling with this problem quite a bit.

I have a bunch of web apps which are quite a bit different - off the shelf forum software, wordpress, custom code, etc. - and I want to tie them all together using a single signon. What should I be using ? I distrust myself enough to know that I would prefer not rolling my own security protocol.

I know that there are solutions like Kerberos, etc. but is it really practical for a bunch of websites running on Rackspace + EC2 ?

Re: Announcing the First Beta Release of Persona

#49

Post by netfire »

timmclean wrote: post #21
petepete wrote: post #16

I thought [1] Mozilla Personas were themes? [1] http://www.getpersonas.com/en-US/ Evidently I need to pay more attention.

Used to be: http://identity.mozilla.com/post/18038609895/introducing-moz...

This link posted says they are looking to rename Personas to something different, but it doesn't look like its actually happened yet (or what it will be called). Given that the getpersonas.com website is still calling them Personas, I'd say the Personas name is still alive and well (and easily confused with the new Persona product)

Re: Announcing the First Beta Release of Persona

#50

Post by binarymax »

DASD wrote: post #43
binarymax wrote: post #32

Have been messing around with BrowserID since it first went public last year (with a node.js backend) and I love it. Its so much more straightforward to implement than oauth and openid, and the fact that it's tied to your email address is perfect. I'm definitely going to be using it as my primary auth system going forward. Great job Mozilla!

Do you have examples of sites that don't use Persona as the BrowserID implementation? I'd like to see how sites are handling the user prompt when there are going to be alternative providers to Mozilla's Persona service.

No since what I do is pretty experimental side projects and fine to just use the persona end of things. Also I don't currently have anything public running right now myself (as it just entered beta so I won't release until v1.0).

If you haven't tried it out yet I encourage you to do so...it only took me 30 minutes to get up and running the first time around.

Post reply on HN