Persona - Mozilla's decentralized and secure authentication system • Hacker News Board

Re: Persona - Mozilla's decentralized and secure authentication system

#51

Post by ygjb » Mon, Oct 01, 2012, 6:15 AM UTC

gambler wrote: post #48

simonbrown wrote: post #43

Earlier quoted context omitted.

What should they use for password resets?

That depends on the kind of services they provide. Simplest options that come to mind are nothing (like this wesbsite) or a printed reset code with owner notification on use and 1-day wait period. At the very least they can allow power users to disable password resets when they want.

Nothing is extremely painful for a federated identity protocol (although I think it should be a clear option for those of us who take these things seriously!). Printed reset codes are part of the way there, but how many people will actually save or print out the file?

SMS confirmation is another mechanism, and one that is viable in most of the world, but has a different set of risks.

I think a combination of these are a good approach, but this is a really tough problem in the identity space, and if you have any suggestions on how to improve it in a way that is viable for a large user base, your feedback would be greatly appreciated!

Re: Persona - Mozilla's decentralized and secure authentication system

#52

Post by ygjb » Mon, Oct 01, 2012, 6:17 AM UTC

callahad wrote: post #25

natch wrote: post #16

Authentication mechanisms and they way they are implemented can have bleedover into the ability of a user to maintain control of their anonymity and privacy. Has there been any writeup that explains the potential impact of Persona on privacy? Not just the impact when used as intended, but also any unintended effects?

I'm not aware of any standalone articles, but something of that nature would be really fantastic. Such an article would probably be best if written by someone outside of the Persona team.

Just a further comment, anyone interested in writing such an analysis or document should contact us with any questions!

Re: Persona - Mozilla's decentralized and secure authentication system

#53

Post by Tantrick » Mon, Oct 01, 2012, 5:18 PM UTC

Flimm wrote: post #35

gambler wrote: post #21

Earlier quoted context omitted.

I hope so, but why not do the right thing in the default identity provider? Lately, there have been tons of high-profile hacks that boiled down to taking control of victim's email and resetting passwords to other accounts. What's seems to be the best response possible from web developers? Is it: a) Demand that all your users use Gmail with enabled two-factor authentication, then smugly blame them for all security iss…

One of the ways crackers gain access to a user's email is by guessing their password, a simple task when a huge number of users use the same password everywhere. With Persona, only your email provider (and the persona.org fallback) have your password (two passwords in the case of the fallback), hashed or not. If you're already a password ninja and use a different and unpredictable password on every different site wit…

I use Two-Factor Authentication across a lot of my accounts. I feel a lot more secure when I can telesign into my account. If you have that option available to you use it, it is worth the time and effort to have the confidence that your account won't get hacked and your personal information isn't up for grabs. If you opt into 2FA, you will have to "Confirm your phone". You would receive a text message with a specific code to be entered into the system. If you don't want to do this every single time, you can designate your smartphone, PC, or tablet as a trusted device and they will allow you to telesign in without the text code. Should an attempt to login from an unrecognized device happen, it would not be allowed.