[deleted]
[deleted]
Persona is distributed. Today.
41–50 of 154 posts
Re: Persona is distributed. Today.
#42How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration ce…
Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-di... In short, three big differences: 1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them. 2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal…
How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)
Re: Persona is distributed. Today.
#43One nitpick about the current implementation: It was hard for me to know if I already had a Persona ID. I'm still not sure. I ended up "resetting" my Persona password to log into Trovebox. I have no idea if this actually created my Persona ID by doing so, or if I had one before. A developer like me might realize that this is idempotent and just go ahead, but your ordinary joe user might be put off.
Re: Persona is distributed. Today.
#44I don't understand how this is an advantage over just using email address as username with a password, like many sites do already. Can someone please explain the benefit?
[Edit: message to user Anonymous09, who replied to me below - you appear to have been hellbanned since the past three weeks. Thought you ought to know.]
Re: Persona is distributed. Today.
#45http://www.getpersonas.com/en-US/ I have been confused by the distinction between these two for the longest time, and I'm hardly alone. Any plans to rename one or the other?
[deleted]
Re: Persona is distributed. Today.
#46Earlier quoted context omitted.
Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-di... In short, three big differences: 1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them. 2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal…
How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)
Check out around the 16:00 mark in this video: https://www.youtube.com/watch?v=nJff23UdNAI
Notice that provisioning (steps 1 and 2) and logging into a site (steps 3 and 4) are two completely independent processes, with the browser mediating any identifiable identity-provider-to-target-site communication.
Re: Persona is distributed. Today.
#47Earlier quoted context omitted.
Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-di... In short, three big differences: 1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them. 2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal…
How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)
Persona stores a signed statement from the IdP in your browser (currently using localStorage). Once you get the statement from your IdP verifying your identity, you can log in using the same proof many times without contacting the IdP, until it expires.
Re: Persona is distributed. Today.
#48Earlier quoted context omitted.
Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-di... In short, three big differences: 1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them. 2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal…
How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)
The service you log into knows the identity provider's public key and a cert for the user (the user's public key signed by the identity provider).
The service can verify the user's cert against the identity provider's public key with this information. The service initially contacts the identity provider to get the provider's public key, so the identity provider can infer that someone is attempting to log into the service as one of its users.
Once the service has the provider's public key, it can be cached by the service until it expires, and while it's cached, the service can verify logins without contacting the server again by checking that the cert presented by the user to the service has a legitimate signature from the identity provider's public key.
So if someone logs into HN using their Gmail ID (assuming both services grow support for the protocol), all Gmail knows is that at least one person attempted to log into HN using a gmail address. Who was trying to log in, whether that login was successful, and the number of other people who logged into HN with Gmail after that, are all facts that would be completely hidden from Google.
Re: Persona is distributed. Today.
#49It sounds great both for users and for devs which, I'm sure, is going to help it take off. However I've got one question: was this conceived from the start with security in mind and is it simple enough as to not be plagued with the countless security issues which product that are too complex inevitably run into? I'm thinking, for example, of the various recent OAuth SNAFUs.
> was this conceived from the start with security in mind
Absolutely. Point 4 in the Mozilla Manifesto: "Individuals' security on the Internet is fundamental and cannot be treated as optional." (http://www.mozilla.org/about/manifesto.en.html#principles)
> is it simple enough as to not be plagued with the countless security issues which product that are too complex inevitably run into?
We hope so. Persona's design and implementation have gone through several internal and external audits, and thus far it appears sound. Keeping everything as simple as possible is a core goal.
Re: Persona is distributed. Today.
#50I still have a funny feeling about the robustness of Persona. For instance - let's say one of my emails gets hacked, my crappy Yahoo email. Does that give them access to my other Persona accounts? Would I (or anyone else) be able to know if the account is compromised? Normally you change your password and that's the end of it, but I'm not sure what happens with Persona.
What if my kid brother uses my computer - wouldn't he have access to any site that allows Persona logins? How do you lock it down?