4 ms·

Your requirement is unrealistic. "safe AND simple" can not be if the problem is inherently complex. Security is complex. Sure there could be third party provid

Your requirement is unrealistic. "safe AND simple" can not be if the problem is inherently complex. Security is complex. Sure there could be third party providers that take care of the complexity and provide a service for you, but then is it safe? You could attempt to do it yourself, but then you loose the simplicity and still you don't know if it is safe.

spronkey 11y ago
Well, to be fair, it wouldn't be all that complex if we just had one standard instead of many many many to learn. I don't find OAuth2 as implemented by most all that complex, and I didn't really find OAuth1 all that bad either. The web UI for persona, on the other hand... Who on earth thought it was a good idea to have a two step for username THEN password!?
- efdee 11y ago
  > Who on earth thought it was a good idea to have a two step for username THEN password!? I haven't used Persona, but maybe this is because not all users use passwords? Sometimes you use AD authentication, or token generators, or ...
  - spronkey 11y ago
    Sure. But what percentage of users would that be? Single digits?
- jorams 11y ago
  > Who on earth thought it was a good idea to have a two step for username THEN password!? Google, as of a while ago. Persona at least had a good reason for it, with not all users needing to enter a password.
  - spronkey 11y ago
    Perhaps, but it seemed to do a pretty poor job of remembering me... At least with Google, despite them being a pretty poor example of good auth UX, you only ever have to type in your password (+ 2fa code etc)
- sp332 11y ago
  Microsoft does the same thing with many of their logins. You put in your user ID, and it uses that to know what server is going to authenticate you and forwards you to it.
sergiosgc 11y ago
It can be safe and simple to use, while being complex on the identity provider's side of the equation. Mozilla Persona was not simple, introduced a ton of new concepts, but you only had to learn all of it if you were an identity provider. For identity "consumers", you could implement and launch into production within an hour of work.

spronkey 11y ago

Well, to be fair, it wouldn't be all that complex if we just had one standard instead of many many many to learn. I don't find OAuth2 as implemented by most all that complex, and I didn't really find OAuth1 all that bad either. The web UI for persona, on the other hand... Who on earth thought it was a good idea to have a two step for username THEN password!?

efdee 11y ago
> Who on earth thought it was a good idea to have a two step for username THEN password!? I haven't used Persona, but maybe this is because not all users use passwords? Sometimes you use AD authentication, or token generators, or ...
- spronkey 11y ago
  Sure. But what percentage of users would that be? Single digits?
jorams 11y ago
> Who on earth thought it was a good idea to have a two step for username THEN password!? Google, as of a while ago. Persona at least had a good reason for it, with not all users needing to enter a password.
- spronkey 11y ago
  Perhaps, but it seemed to do a pretty poor job of remembering me... At least with Google, despite them being a pretty poor example of good auth UX, you only ever have to type in your password (+ 2fa code etc)
sp332 11y ago
Microsoft does the same thing with many of their logins. You put in your user ID, and it uses that to know what server is going to authenticate you and forwards you to it.

sergiosgc 11y ago

It can be safe and simple to use, while being complex on the identity provider's side of the equation. Mozilla Persona was not simple, introduced a ton of new concepts, but you only had to learn all of it if you were an identity provider. For identity "consumers", you could implement and launch into production within an hour of work.