Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the First Beta Release of Persona

identity.mozilla.com

Post reply on HN
Print view View original

71–80 of 207 posts

Re: Announcing the First Beta Release of Persona

#71

Post by latchkey »

Ygg2 wrote: post #68

This is just great. I do hope this replaces Facebook connect as authentication provider, though I doubt it since getting all that user info is priceless for most sites using Facebook connect. It looks very lovely.

I don't think it'll replace Facebook, it'll just be an alternative to it. We've integrated both Persona and Facebook into our site and it works great.

For my business, we need more personal details about each person that we get by default with Facebook (name/age/sex). So, that integration will always be cleaner than Persona because it is just a few clicks.

We've been working with BID/Persona for a while now (we're linked from the /about page) and we're huge fans. If you want to play around with it... https://www.voo.st/

Re: Announcing the First Beta Release of Persona

#72

Post by forgotusername »

callahad wrote: post #64
forgotusername wrote: post #58

I really want to believe in something like this, however you'd getting much better traction by explaining a few key details: * What the hell does the JS assertion object look like? * How do I run an independent service? * In a single page, walk me through the steps to integrate? Videos, dodgy music, overenthusiastic PFYs appeal to me much less than good documentation

> What the hell does the JS assertion object look like? Needs to be updated a little bit, but check out the spec: https://github.com/mozilla/id-specs/blob/prod/browserid/inde... Note: You don't have to implement this yourself! You can POST assertions to https://verifier.login.persona.org/verify instead, and we'll return a JSON blob that lets you know if it was valid or not. Or you could run that same verifier locally…

Huh :) I went in circles on the MDN site for a few minutes.

Re: Announcing the First Beta Release of Persona

#74

Post by sandGorgon »

ozten wrote: post #56
sandGorgon wrote: post #48

What is the self-hosted equivalent of this ? I have been struggling with this problem quite a bit. I have a bunch of web apps which are quite a bit different - off the shelf forum software, wordpress, custom code, etc. - and I want to tie them all together using a single signon. What should I be using ? I distrust myself enough to know that I would prefer not rolling my own security protocol. I know that there are so…

Which pieces do you care about being self-hosted? If you use Persona on all your sites, it feels very much like SSO. I use the browserid plugin ( http://wordpress.org/extend/plugins/browserid/ ) on my personal Wordpress site. We actually had an SSO project based on CAS v2, which we killed because Persona was a better solution.

I agree about the Persona bit, but many times you are not ... shall we say "allowed" to.

Since you built an SSO, could you point me in the right direction amongst self-hosted solutions. Some comparisons and pitfalls would be most welcome.

Re: Announcing the First Beta Release of Persona

#76

Post by Zash »

Too wrote: post #5

After reading the text twice and watching both videos i still have no clue what it actually does and how it solves the problem. I'm a few pages of skimming into the documentation now but there's no overview of what it actually does in the background. Just a load of buzzwords and awesomeness!1 of how this will revolutionize my account management and how easy the API is. Is it a password manager, a biometric system or…

It's like PKIX but with JSON.

Re: Announcing the First Beta Release of Persona

#77

Post by Johngibb »

callahad wrote: post #30
romaniv wrote: post #18

I think the general idea of building better auth into browsers is a wonderful and highly necessary development. However, this implementation will completely fail if the user has JavaScript blocked and there is no fallback. And yes, this is a real issue. (Though I will probably get a lot of replies that try to dismiss it in various ways.)

That's a great point. Persona doesn't work well in non-JS, non-browser contexts, yet. The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system. So long as you can associate email addresses with accounts on your backend, you can use Persona with the same database you have right now.

Is there any way to use it for say an iPhone app interacting with web services authenticated as a user?

Re: Announcing the First Beta Release of Persona

#78

Post by romaniv »

callahad wrote: post #30
romaniv wrote: post #18

I think the general idea of building better auth into browsers is a wonderful and highly necessary development. However, this implementation will completely fail if the user has JavaScript blocked and there is no fallback. And yes, this is a real issue. (Though I will probably get a lot of replies that try to dismiss it in various ways.)

That's a great point. Persona doesn't work well in non-JS, non-browser contexts, yet. The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system. So long as you can associate email addresses with accounts on your backend, you can use Persona with the same database you have right now.

Persona doesn't work well in non-JS, non-browser contexts, yet.

So are there built-in, HTML-only versions for this in the works? It seems it should be possible to build some of this functionality into the browser, making it work without JS.

The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system.

I wouldn't call that progressive enhancement. Depending on whether the client has JS enabled, they would go through entirely different registration and auithentication processes, using different credentials. That can be very confusing to the users.

Post reply on HN