Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Persona Beta: Millions of Users Ready to Log In using Any Browser

identity.mozilla.com

Post reply on HN
Print view View original

81–90 of 188 posts

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#81

Post by TheCoelacanth »

dilipray wrote: post #65

So, openid by firefox is called persona? I would like to use google, twitter. What are the special features of this? I don't think anybody would like to use firefox OS. But it's good, but it has a heavy competition in the future.

1. Privacy: the identity provider can't tell what site you are logging in to.

2. It's decentralized: any email provider can provide Persona authentication for the email addresses that it handles. You don't have to rely on Mozilla to do this except as a fallback for email providers who don't support Persona.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#82

Post by davecap1 »

ozten wrote: post #18
davecap1 wrote: post #15

I like Persona a lot and I would love to implement it on some of my sites, but I wonder how to best describe what it does to the average user. "Sign in with Persona" will probably look just as bad as "Sign in with Facebook"...

"Sign in with your Email" is pretty clear. via https://developer.mozilla.org/en-US/docs/persona/branding

Ah thanks for that

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#83

Post by Groxx »

drdaeman wrote: post #50
abhinavg wrote: post #36

Earlier quoted context omitted.

This is off the top of my head so maybe somebody will correct me, but: Persona is a login system that cares about your privacy. With social login systems, the website you are logging into contacts the social login provider (Facebook/Google+/Twitter/what-have-you) when you attempt to log in. So you end up leaving a trail of breadcrumbs behind you of every site you visited (and used a social login on). Further, many pe…

If Persona would care about anyone's privacy, they won't use emails. Logging in with, say, Twitter account is less secure in aspect Twitter knows what sites you log in, but more secure in aspect the sites can't spam you unless you allow them to do so.

I've been thinking about this, and I have come to the conclusion that it's less of an issue than I thought it was. For a simple reason: the "email address" you provide is just an identifier. A string formatted as "user@domain", nothing more.

By convention it's a usable email address, but there is literally nothing preventing someone from starting up an email-less Persona identity provider. You'd still log in with your_username@noemailpersona.com, but that's just a formality that doesn't need to be hooked up to an actual mail server at any point.

Never using that account to actually communicate would put it on par with any other auth system you can come up with. Disposable when you want to dispose of it, and no need to ever dispose of it unless you want to. The whole issue with some people changing their email addresses for spam-fighting / inbox-cleaning purposes is a non-issue with this kind of an account.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#85

Post by newman314 »

riquito wrote: post #37
OoTheNigerian wrote: post #29

Here is my feedback. Perhaps the marketing of "persona" to consumers should take a backseat. When I signed in to http://123done.org/ the pop up* showing "sign in with persona" confused me for a moment. For a moment, I thought.. "but I do not have a persona account" If there is a way for users to just sign in with their email without telling them how it is done, I am sure there will be even less friction. Of course, t…

"sign in with persona" may be confusing now but "sign in with your e-mail" it's pretty clear https://developer.mozilla.org/en-US/docs/persona/branding

The popup has to explain WHY it is asking for an email address. Else, Average Joe is just going to assume you are a spam site asking for his email.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#86

Post by Steuard »

drdaeman wrote: post #50
abhinavg wrote: post #36

Earlier quoted context omitted.

This is off the top of my head so maybe somebody will correct me, but: Persona is a login system that cares about your privacy. With social login systems, the website you are logging into contacts the social login provider (Facebook/Google+/Twitter/what-have-you) when you attempt to log in. So you end up leaving a trail of breadcrumbs behind you of every site you visited (and used a social login on). Further, many pe…

If Persona would care about anyone's privacy, they won't use emails. Logging in with, say, Twitter account is less secure in aspect Twitter knows what sites you log in, but more secure in aspect the sites can't spam you unless you allow them to do so.

Not an issue, as far as I can tell. Sign in as "OnlyMyPersonaIdentity@example.com" (or whatever) and then never check the mail: you get an easy, consistent identity, and all the sites get is an email-shaped label.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#87

Post by enygmadae »

If anyone's curious about using PHP and jQuery to integrate it into their sites, check out this article I wrote up: http://websec.io/2012/10/01/Using-Mozilla-Persona-with-PHP-j...

It's got curl and streams examples so it should cover 95% of the PHP installs out there. Its crazy how easy it is to drop in and implement...Mozilla's done a great job with it so far. I look forward to more integration of it in the future.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#89

Post by badida »

lazyjones wrote: post #68
bzbarsky wrote: post #38

Earlier quoted context omitted.

Er... "they" have also published the full source code involved (at https://github.com/mozilla/browserid ) and a privacy policy at http://www.mozilla.org/en-US/persona/privacy-policy/ that you can compare to said source code as desired, if you're using Mozilla's identity provider. As far as the architecture of the overall thing, there are also http://identity.mozilla.com/post/7899984443/privacy-and-brow... and http://…

Not even the links you posted tell me a) where certificates are stored and how they are protected, b) what measures are taken to prevent unauthorized use of those certificates by the ID provider, the browser (plugins?), other entities, c) how the act of entering an e-mail address is secure (other people may have access to my computer and know my e-mail address). Admittedly, I didn't watch the 1 hour presentation vide…

Let's see if I can help provide some answers here:

a) certificates are stored in localStorage for https://login.persona.org. They are very short-lived (hours), so that we don't have to deal with revocation, since that would likely be impossible on a per-user scale.

b) there's no way you can prevent an identity provider from misusing your identity. They're your identity provider. You chose them because you trust them to credential you and not let other folks impersonate you.

b') browser extensions already have full control over your life. That's something that should be addressed longer term, but Persona is not making this any worse.

b'') other entities cannot access the localStorage for login.persona.org, so that should be okay.

c) you're not just entering an email address. You're also proving you own it, for example by being logged into your Yahoo.com account, or by clicking the confirmation link we send you. What we're doing is minimizing the number of steps you have to take to prove you own an email address. But you still have to own it.

You should check out our documentation, which is quite thorough:

  https://developer.mozilla.org/en-US/docs/persona
I think we've provided a lot of hard data and docs to back our claims, but we're happy to provide more, of course.
Post reply on HN