Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Persona - Mozilla's decentralized and secure authentication system

developer.mozilla.org

Post reply on HN
Print view View original

1–10 of 53 posts

Re: Persona - Mozilla's decentralized and secure authentication system

#2

Post by lukev »

Other than the benefit of using strong crypto under the hood, I'm not sure what benefits this has over a system like openid. It has about the same level of interactional complexity, and at the additional cost of requiring browser support.

If we're going to have browser support anyway, I'd rather just use standard two-way SSL and put the work into developing better UI and private key distribution systems for it. It's even more secure and has a great user experience once you've set up the key in the browser and authorized it to the site.

Re: Persona - Mozilla's decentralized and secure authentication system

#4

Post by StavrosK »

lukev wrote: post #2

Other than the benefit of using strong crypto under the hood, I'm not sure what benefits this has over a system like openid. It has about the same level of interactional complexity, and at the additional cost of requiring browser support. If we're going to have browser support anyway, I'd rather just use standard two-way SSL and put the work into developing better UI and private key distribution systems for it. It's…

The benefit is orders of magnitude better usability. I couldn't get users to grok OpenID, this just needs an email and password.

How will my mom log in to an SSL-certificate-requesting site from another computer?

Re: Persona - Mozilla's decentralized and secure authentication system

#5

Post by shantanubala »

lukev wrote: post #2

Other than the benefit of using strong crypto under the hood, I'm not sure what benefits this has over a system like openid. It has about the same level of interactional complexity, and at the additional cost of requiring browser support. If we're going to have browser support anyway, I'd rather just use standard two-way SSL and put the work into developing better UI and private key distribution systems for it. It's…

Usability involves more than one target audience: it also has to be easy for developers to integrate.

BrowserID (Persona) took me minutes to implement. On a non-trivial project, it may take a couple hours. The beauty of this is the fact that it still works without built-in browser support. It's designed to be a forwards-compatible API that only becomes more usable with time.

Additionally, email is an excellent way to establish a user's identity, and the fact that it's designed around email makes it easy for a regular person to understand its authentication flow.

The problem with SSL is that it is an all-or-nothing technology. There's a chicken and egg problem: people won't make good UI for it until it's widely used, but people won't use it until it has a good UI. Persona provides an implementation of BrowserID that has a decent UI, and the user experience will only get better with time as more people use it. The chicken/egg problem is solved there, but two-way SSL right now is practically unusable for anyone who isn't very familiar with it (most people). Using an email address is very familiar, though.

Re: Persona - Mozilla's decentralized and secure authentication system

#7

Post by lukev »

StavrosK wrote: post #4
lukev wrote: post #2

Other than the benefit of using strong crypto under the hood, I'm not sure what benefits this has over a system like openid. It has about the same level of interactional complexity, and at the additional cost of requiring browser support. If we're going to have browser support anyway, I'd rather just use standard two-way SSL and put the work into developing better UI and private key distribution systems for it. It's…

The benefit is orders of magnitude better usability. I couldn't get users to grok OpenID, this just needs an email and password. How will my mom log in to an SSL-certificate-requesting site from another computer?

This has pretty much the same end-user experience as OpenID, unless I'm misunderstanding something. The user still has to sign in to the IdP.

Re: Persona - Mozilla's decentralized and secure authentication system

#8

Post by StavrosK »

lukev wrote: post #7
StavrosK wrote: post #4

Earlier quoted context omitted.

The benefit is orders of magnitude better usability. I couldn't get users to grok OpenID, this just needs an email and password. How will my mom log in to an SSL-certificate-requesting site from another computer?

This has pretty much the same end-user experience as OpenID, unless I'm misunderstanding something. The user still has to sign in to the IdP.

You're underestimating how familiar someone's email address is versus an OpenID URL whose significance the user doesn't know and whose use she can't grasp.

Re: Persona - Mozilla's decentralized and secure authentication system

#9

Post by ams6110 »

StavrosK wrote: post #8
lukev wrote: post #7

Earlier quoted context omitted.

This has pretty much the same end-user experience as OpenID, unless I'm misunderstanding something. The user still has to sign in to the IdP.

You're underestimating how familiar someone's email address is versus an OpenID URL whose significance the user doesn't know and whose use she can't grasp.

Agreed. URLs as an identifier are completely alien to non-technical folks. Even I think the notion is odd. They just don't make any sense. Plus they are hard to type correctly. Email addresses don't have these problems.
Post reply on HN