Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Persona Beta: Millions of Users Ready to Log In using Any Browser

identity.mozilla.com

Post reply on HN
Print view View original

91–100 of 188 posts

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#91

Post by badida »

lazyjones wrote: post #71
6a68 wrote: post #66

Earlier quoted context omitted.

Yow, that's rough. We try really hard to publish docs that will help non-technical users, sites considering using Persona, and potential identity providers. The best starting point is probably the top-level MDN page: https://developer.mozilla.org/docs/Persona

I am a technical user. I just don't want to wade through source code or watch 1 hour long videos to understand why this is supposedly secure. I can accept that not telling ID providers where users are logging in enhances their privacy (whether they care or not is debatable). However, I do not see why accounts are protected better, especially compared to different passwords for every site. What is my identity tied to?…

To be fair, if you want to understand why something is supposedly secure, you will have to spend some time :)

Let's see if I can help.

Your identity is tied to your ability to prove that you own an email address. You can do that by clicking a confirmation link we send you. Or, as of Beta2 (today!), you can do that by having your domain implement the Persona Identity Provider API, where your domain publishes a public-key and issues certificates to you based on that public key, which you can then use to sign into web sites. Also as of today, we do that for Yahoo users by bridging to Yahoo OpenID, so basically Persona is an OpenID client to Yahoo, gets Yahoo to vouch for your email, and based on that issues you a Persona certificate (backed by our public key) for your email address.

But whatever way you go, it's about proving you own an email address and obtaining a certificate for it.

Yes, someone who has access to your browser can fake your identity if you don't lock your browser/OS, but that's nothing new. In fact, the simple password change is how we mitigate that. As soon as you change your password, we invalidate all sessions on all devices. Certificates last only a few hours, so they'll be disabled quickly too.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#92

Post by sergiotapia »

6a68 wrote: post #62
sergiotapia wrote: post #61

I implemented persona for ASP.Net MVC3 and it was hands down the easiest login system I've ever built in my career. From a developer standpoint it's very intuitive, the documentation is great, and I loved it so much I open sourced my implementation. https://github.com/sergiotapia/ASP.Net-MVC3-Persona-Demo Please give this a shot! I would only like them to keep more information on hand, like a first name, or an avatar…

Thanks sergiotapia! Please ping the dev-identity list with your feature ideas, or open a bug on github; our roadmap depends on community input. We have a list of libraries/plugins in a ton of other languages on MDN: https://developer.mozilla.org/en-US/docs/Persona/Libraries_a...

Where would this github be? Do you mean the browserid repository on Github?

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#93

Post by takluyver »

cinquemb wrote: post #64
ozten wrote: post #49

Earlier quoted context omitted.

Directly from the article: Julius Schorzman of DailyCred, the instant CRM package for any web site, implemented Persona and remarked “We’ve seen from our internal metrics that more than 70% of users still prefer email and password authentication over social log-in like Facebook. Implementing Persona is actually easier than Facebook Connect, or any OAuth implementation we’ve seen.” People want control over their ident…

I'm personally not a big fan of social sign in, and i doubt i'm going to use persona (at this time). Persona seems like to me kinda like what the chinese are doing with requiring people to use .gov ids on the web. Sure in china it will be by force and here it will be opt in, but in my eyes the result will be the same: making it easier to track people across the web. I don't feel like persona solves the ability for a…

As I understand it, there's nothing to stop you using a separate Persona ID for each site you visit, and none of your IDs has to be tied to your real life identity. But most people already give the same username and same e-mail on loads of different websites, so we're happy to carry on doing that.

For now, most Persona users are stored in a central location by Mozilla. The idea is that e-mail providers take over authenticating users, so eventually there should only be a few users that Mozilla stores credentials for. I'm hoping that GMail will add support soon.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#94

Post by badida »

Flimm wrote: post #57

For this to be adopted, you need to have at least one major email provider implementing it, at least one major browser, and at least one major website. If you don't have the three corners of the triangle, people will inevitably judge Persona by its fallback implementation and will fail to understand the advantages Persona offers. The good news is Mozilla have managed to implement a bridge that makes it look like one…

Very good points, and we agree. We're going to bridge more Identity Providers. We're working on native implementations (though I suspect that those are less pressing than the other two angles.)

As for big web sites... we've got some things in the works. But that's where you and others on HN can help. If you like Persona, if you like the vision we have, then help us. Pick one site where you can implement it. Ditch social login, which users hate, and pick Persona instead.

As cliche as it might sound, I think I have to say this: Be the change you want to see in the Web. Help us make Persona, the one login system that respects users, truly successful.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#95

Post by ozten »

shared4you wrote: post #75

>> type in email, login to yahoo... Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman? Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

> Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman?

Nope.

Architectures like OpenID "phone home" and report your movement across the web.

Persona was explicitly designed to be privacy preserving.

> Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

Yes, if an attacker has your yahoo email address and password, they can log in as you. BUT, you can take advantage of two factor auth from Yahoo as well as other security features they provide, to keep yourself safe.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#96

Post by badida »

shared4you wrote: post #75

>> type in email, login to yahoo... Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman? Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona.

However, if you use the "login with Yahoo" button (or Google or Facebook), then yes, they can track all of your activity.

To your second point: great question! No, the attacker cannot. We still protect your other email addresses with a Persona password.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#97

Post by badida »

badida wrote: post #96
shared4you wrote: post #75

>> type in email, login to yahoo... Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman? Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona. However, if you use the "login with Yahoo" button (or Google or Facebook), then yes, they can track all of your activity. To your second point: great question! No, the attacker cannot. We still protect your other email addresses with a Persona password.

Oh wait, I misread your point. Yes, the attacker can log into all Persona web sites if they know your Yahoo password. But that's the way the cookie crumbles with federated identity. It's the same thing if you pick a Yahoo email address as your recovery email. Pick your identity providers wisely!

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#98

Post by badida »

drdaeman wrote: post #50
abhinavg wrote: post #36

Earlier quoted context omitted.

This is off the top of my head so maybe somebody will correct me, but: Persona is a login system that cares about your privacy. With social login systems, the website you are logging into contacts the social login provider (Facebook/Google+/Twitter/what-have-you) when you attempt to log in. So you end up leaving a trail of breadcrumbs behind you of every site you visited (and used a social login on). Further, many pe…

If Persona would care about anyone's privacy, they won't use emails. Logging in with, say, Twitter account is less secure in aspect Twitter knows what sites you log in, but more secure in aspect the sites can't spam you unless you allow them to do so.

Choose your identity providers (and thus email addresses) wisely. They should be filtering spam for you / letting you control things. And they shouldn't be doing it by forcing you into their silo, the way "login with Twitter" buttons work.

Re: New Persona Beta: Millions of Users Ready to Log In using Any Browser

#100

Post by 6a68 »

sergiotapia wrote: post #92
6a68 wrote: post #62

Earlier quoted context omitted.

Thanks sergiotapia! Please ping the dev-identity list with your feature ideas, or open a bug on github; our roadmap depends on community input. We have a list of libraries/plugins in a ton of other languages on MDN: https://developer.mozilla.org/en-US/docs/Persona/Libraries_a...

Where would this github be? Do you mean the browserid repository on Github?

Yup! https://github.com/mozilla/browserid/issues/new
Post reply on HN