Persona - Mozilla's decentralized and secure authentication system • Hacker News Board

Re: Persona - Mozilla's decentralized and secure authentication system

#41

Post by Sami_Lehtinen » Sun, Sep 30, 2012, 4:29 AM UTC

gambler wrote: post #27

fmarier wrote: post #14

Earlier quoted context omitted.

This talk gets into how the protocol works without getting too much into the crypto: https://www.youtube.com/watch?v=iZBTc7iEkQY

I just watched the video. So, apparently, the long-term goal is to have email providers to support this and sign user certificates. I'm still not clear on what information a certificate would contain. More importantly, I really dislike the answer to second question from the audience. Even when the system is fully supported without fallbacks, hacking person's email account will grant the attacker ability to log into a…

You can always host your own email services.

Re: Persona - Mozilla's decentralized and secure authentication system

#42

Post by flashmob » Sun, Sep 30, 2012, 10:11 AM UTC

Does persona reveal your email address to the website that you login to?

OpenID usually doesn't reveal your email address.

For example, when logging in to Google via OpenID, google will only send back a unique identifier that means 'yes, the user has a google account' but no other personal information. Yahoo does the same.

(of course, it's possible to use OpenID extensions to get a user's email at their discretion)

Does persona work in the same way?

Re: Persona - Mozilla's decentralized and secure authentication system

#43

Post by simonbrown » Sun, Sep 30, 2012, 2:02 PM UTC

gambler wrote: post #21

fmarier wrote: post #20

Earlier quoted context omitted.

The fallback identity provider (at login.persona.org) does use email for password resets, but other identity providers will likely use other mechanisms.

I hope so, but why not do the right thing in the default identity provider? Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it: a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security iss…

What should they use for password resets?

Re: Persona - Mozilla's decentralized and secure authentication system

#44

Post by mike-cardwell » Sun, Sep 30, 2012, 2:10 PM UTC

gambler wrote: post #21

fmarier wrote: post #20

Earlier quoted context omitted.

The fallback identity provider (at login.persona.org) does use email for password resets, but other identity providers will likely use other mechanisms.

I hope so, but why not do the right thing in the default identity provider? Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it: a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security iss…

My mail server encrypts all of my email with my public PGP key on the way in. So even if you gain access to my email account, you still can't read my email - https://grepular.com/Automatically_Encrypting_all_Incoming_E...

Public key crypto has many usability problems, but it solves a lot of other problems. I wish some of the big mail providers like Google would throw some money and people at it.

Re: Persona - Mozilla's decentralized and secure authentication system

#45

Post by vivab0rg » Sun, Sep 30, 2012, 2:58 PM UTC

Just integrated it on a personal Padrino project. Beautifully simple user and developer-side. Congratulations and thanks Mozilla!

Re: Persona - Mozilla's decentralized and secure authentication system

#46

Post by [deleted] » Sun, Sep 30, 2012, 3:58 PM UTC

gambler wrote: post #37

Flimm wrote: post #36

Earlier quoted context omitted.

1. You're comparing Persona to an imaginary world where most websites don't rely on email providers to prove authentication. I'm comparing Persona with the actual situation where people use the same password everywhere. Persona isn't perfect, but it is much better than what the vast majority of websites use, and it allows even better methods to be implemented where needed. Furthermore, Persona is more usable, and the…

You're comparing Persona to an imaginary world where most websites don't rely on email providers to prove authentication. I'm comparing hypothetical mass-adoption of Persona with hypothetical mass-adoption of alternative password reset policy. It seems like a fair comparison.

[deleted]

Re: Persona - Mozilla's decentralized and secure authentication system

#47

Post by Flimm » Sun, Sep 30, 2012, 4:06 PM UTC

flashmob wrote: post #42

Does persona reveal your email address to the website that you login to? OpenID usually doesn't reveal your email address. For example, when logging in to Google via OpenID, google will only send back a unique identifier that means 'yes, the user has a google account' but no other personal information. Yahoo does the same. (of course, it's possible to use OpenID extensions to get a user's email at their discretion) D…

Yes, Persona does reveal your email address to the website you log in to. This is considered a feature, because:

1. It prevents lock-in to Persona. (If you want to migrate away from Persona, you can just send the users an email and introduce the new authentication mechanism.)

2. Most websites will need some way to contact the user, and will ask for their email address any way.

3. Users understand the concept of email addresses as identifiers.

If you care about keeping your email address private, you can always use the features your email provider offers such as forwarding email addresses.

Re: Persona - Mozilla's decentralized and secure authentication system

#48

Post by gambler » Sun, Sep 30, 2012, 4:13 PM UTC

simonbrown wrote: post #43

gambler wrote: post #21

Earlier quoted context omitted.

I hope so, but why not do the right thing in the default identity provider? Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it: a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security iss…

What should they use for password resets?

That depends on the kind of services they provide. Simplest options that come to mind are nothing (like this wesbsite) or a printed reset code with owner notification on use and 1-day wait period. At the very least they can allow power users to disable password resets when they want.

Re: Persona - Mozilla's decentralized and secure authentication system

#49

Post by BystanderX » Mon, Oct 01, 2012, 12:13 AM UTC

gambler wrote: post #21

fmarier wrote: post #20

Earlier quoted context omitted.

The fallback identity provider (at login.persona.org) does use email for password resets, but other identity providers will likely use other mechanisms.

I hope so, but why not do the right thing in the default identity provider? Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it: a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security iss…

Because it's not the "default" identity provider, it's the "fallback" identity provider. They're trying to define a open standard which would end up with any number of identity providers. The goal is something that can bootstrap the system into usage.

As far as what to do about users? You can't fix the problem. Nothing is going to be 100% secure, and the flesh is always going to be the biggest weakness if the machine has been well designed.

If you really want conjecture on it, though, I would suggest you first ask "Is this something tied to a citizen's identity, or a online identity?", because most things that process fiat currency in any capacity will fall into the former, and should probably merit a recovery system outside of email.

I would argue, however, that anything falling into the latter and should be handled with email.

Re: Persona - Mozilla's decentralized and secure authentication system

#50

Post by ygjb » Mon, Oct 01, 2012, 6:12 AM UTC

Flimm wrote: post #35

gambler wrote: post #21

Earlier quoted context omitted.

I hope so, but why not do the right thing in the default identity provider? Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it: a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security iss…

One of the ways crackers gain access to a user's email is by guessing their password, a simple task when a huge number of users use the same password everywhere. With Persona, only your email provider (and the persona.org fallback) have your password (two passwords in the case of the fallback), hashed or not. If you're already a password ninja and use a different and unpredictable password on every different site wit…

Your last point is not completely accurate; with Persona and 2-factor auth on your email account, you would then have verified ownership of your email account via 2-factor authentication. This doesn't mean that every assertion generated by your Persona account will have been generated with 2-factor auth.

Still, as you say, an improvement :D