6 ms·

I'd disagree. My personal opinion is, BrowserID/Persona was a bad thing for the web and it's a good thing it haven't hit any big. Sure, it was better than most

I'd disagree. My personal opinion is, BrowserID/Persona was a bad thing for the web and it's a good thing it haven't hit any big. Sure, it was better than most popular protocols out there, but it was still wrong. My opinion is that BrowserID had a very flawed core concept. I firmly believe that my identity is something that I [can] naturally define and possess. But everyone since OpenID had stolen this from the end-user and identities became something that you're provided with - and I find the very term "identity provider" unnerving. With identity providers you're not you anymore, but merely your Facebook account or your email address or your domain name - a things you only temporarily lease from a third-party like an email provider or a domain registry. Sure, there's some common sense, legal protections and stuff, but I'm don't like merely relying on those. I think, in a sane world, at least personal (i.e. non-group) identities must be merely asserted, not provided - and they must originate from a person themself. On the contrary, this login-with-ssh thingy and few other schemes (gpgAuth and WebID) are much closer to what the things should be like. While they don't yet completely resolve the distinction between an identity and a credential (it's really hard), they root your identity in something that you can actually define for yourself and handle without depending on anyone else - a key pair.

scrollaway 11y ago
I agree with most of your logic but let's also be pragmatic - something that is better than everything else out there that's actually popular, and has a chance to hit big, is good for the web. Always pursuing the impossible perfection is one of the reasons we don't have ubiquitous https for example...
- drdaeman 11y ago
  Well, yes, you're right. Seeking a perfection usually means never releasing anything. That's spot on. Yet, I'm particularly against about the BrowserID adoption because it helps to cement the idea of leased identities. At the moment, we're still with in the "warring states" world, where no particular scheme had won. This could've changed with BrowserID embedded in the User-Agent, so I fear it would be at least a decade until we'll be able to talk about something else. WebID, being a W3C WG, could've also hit big... It's not perfect, but from my understanding of the drafts it looked better than BrowserID to me. But no luck here.
  - WorldMaker 11y ago
    It's an interesting moral line in the sand you are making. Persona/BrowserID simply reuses the concept of email address as identity (and email host as identity provider). This is honestly already pretty heavily cemented in the web (I think the war has long since been lost): almost every website uses in some way emails as natural keys for identities and with the critical overuse of email as the medium for "Forgot Password" login schemes, email hosts are already everyone's de facto identity providers. At least there is more personal choice involved in email hosts, and indeed sometimes direct ownership in paid email accounts, unlike the walled garden monopolies we see in Twitter/Facebook/Google "social" logins.
    - drdaeman 11y ago
      Yes, emails are currently required on almost every site. I draw this line because BrowserID/Persona (and similar efforts) are quite special - we jump from the pages to browser's chrome, making user-agent actually handle authentication. I think that the first major standard to come - that'd be embedded in the browser - could change this game rules, because it must be (well - I don't know, I just think it is) a big thing. Even users who don't care would've bought secure yet seamless authentication, neat identity management and so on. But not something after this, because the momentum would be lost and there won't be enough incentive to switch. So, the first standard must have something sensible as credential, or - I fear - it will be a long time before we can hope for any changes. Maybe I'm wrong here.
balabaster 11y ago
The thing that makes this particularly pertinent for me is that I try and avoid Facebook & Google+ and indeed most other identity providers for the sole reason that if one of them gives over (either legitimately by subpoena or by being hacked) access to my account, there is a handy pointer to every other service I have accounts for... I'd rather not leave a centralized paper trail of everything I do in one place.
- Arnor 11y ago
  I agree in principle, but in practice I don't care much if many of my accounts get hacked or subpoenaed. Sure, I'd like to keep my communication and financial information as private as possible. My code, maybe and my personal photos and documents, but if a hacker or government organization gets access to my chess.com account or my GrubHub, I really don't care. They'll find out that I have trouble against the Sicilian Najdorf and that I eat too much cheese cake (which as of this post is open record anyway :)
  - dwiel 11y ago
    "I don't need privacy, I've got nothing to hide"
    - Arnor 11y ago
      No! That is pointedly not what I'm saying. What I'm saying is that I don't need every detail of my life to be private. I prefer that nobody go in and start playing games on my chess.com account, but I'm willing to take a higher degree of risk with that specific account than I am with, e.g. my financial accounts. It is possible to care about privacy and still accept a more convenient (less secure) way to access specific things.
lobster_johnson 11y ago
Most of the world also abuses OAuth — which is for authorizing access to information on your behalf, and is completely orthogonal to identity and authentication — for login. If we step back a bit and look at the problem, the main thing that sites should care about is proof. That is, I'm essentially a number (an opaque, abstract identity), and all the site should want is for me to be able to prove that I am that number. We should forget about email addresses, user names and passwords. A site should be able to request real-world identity information such as your name and address, but there's no need to comingle that with login. A site that isn't an e-commerce app generally has no business getting at that data in the first place. Such a system would be a boon to implementors, too. As a developer, I would greatly appreciate not having to implement another damn account/login system just so that I can remember my visitors. But nothing is going to happen until browsers implement such identity management natively, and the only way to get there is for the browser developers to collaborate on the tech.
- zensavona 11y ago
  But then how will I send you sixteen emails reminding you to complete your free trial?
  - lobster_johnson 11y ago
    That is indeed a conundrum!
  - jjuhl 11y ago
    The answer to that is (obviously - and yes, I realize you are trolling) that you dont.
xorcist 11y ago
Not true. I own my domain, and I own it in a very specific juridical sense. It's not tangible, because domains aren't, but it's a lot more like owning a car than leasing a car. The ownership is stronger than for my phone number or my birth name, for example. While the term identity provider might not sound well, it is necessary for a system where you have multiple identities. And I think it's pretty well established that that is a requirement for the modern web.
- icebraining 11y ago
  Why is an IdP necessary for a system where you have multiple identities? Why can oneself provide the identity one wishes to use for the communication with the other party? I do agree that Persona with a personal domain is a much better system, but why should it be necessary to have one to avoid being tied to a third-party IdP?
  - WorldMaker 11y ago
    You don't trust your email provider? Today your email provider is already implicitly your underlying IdP for almost every website you visit that uses that email (if it has a "Forgot Password" button that sends you an email, your email provider is your IdP). All Persona attempts to do is make that implicit assumption an explicit part of that email's identity, and even tries to make it somewhat more secure than sending random tokens via often insecure/semi-secure SMTP channels, as most "Forgot Password" systems do. Ultimately yes, if you want to sign in to a website with your email address you typically have to trust your email provider. This is true on the web almost universally with or without Persona. Why is any IdP required by Persona? Identity protection and reuse across browsers are two big reasons. If I want to say that I am/use the email "wm@example.com", Persona tries to verify that I actually have access to that email (can sign in to my email provider, or can do the classic click a random token link in an email cycle if my email provider isn't supported).
    - drdaeman 11y ago
      > You don't trust your email provider? It's a luxury those days, with email providers snooping over messages to show your advertisements and all sort of TLAs snooping just because they feel so. There is some buzz about end-to-end encryption out there for a reason, and the reason is a lot of people don't trust their email providers. But I reasonably do. I'm hosting my email myself, on the hardware I own, located on my own premises. Although I may get hacked - one can't be ever sure they won't - most modern systems are too complex for any single human to grasp and sometimes bad things just happen. But I don't trust my domain registrar and the network. DNS may get poisoned/spoofed, network may be tapped and traffic redirected, registry or nameservers may get hacked or subpoenae'd (ok, I'm not a criminal, but who has a protection from powerful authorities if they suddenly decide they want you?) and whatever else.
superuser2 11y ago
Normal people will lose key material. Systems administrators sometimes lose key material! In a sane world, it needs to be possible for someone with common sense to revoke and reissue your credential if you lose it. If this is categorically posisble, then your identity is leased, not owned. Your SSH private key is not your identity, it's just some bytes. Your identity is determined by what public key is considered to be "you", i.e. what's in ~/.ssh/authorized_keys. Your infrastructure provider can usually change this, with or without your permission. Unless you own the land where the hard disk public key -> account mapping resides, your identity is leased.
- drdaeman 11y ago
  > Your SSH private key is not your identity Absolutely. It's my credential. In a perfect system, we decouple those from identities - but that's hard. If you have some ideas about this or know a system that handles this - please share a link. In a less than perfect system, we at least have to try to assure that credentials are self-sufficient and don't require a third party to just exist. That leaves us with either keypairs or pre-shared secrets (traditional passwords). Maybe something else but I don't know. > In a sane world, it needs to be possible for someone with common sense to revoke and reissue your credential if you lose it Well, yes. However, there is just no advancement at the moment - proposed general approach is just not better or worse in this regard. It's the same as if you've lost your password and email in a most traditional identity system out there. If you lose all credentials - your identity's lost and you can only talk to each consumer individually and negotiate whenever a recovery's (to a new identity) possible. This doesn't change. However, in theory, you can set up a system in which your friends or someone you trust may help you to recover or revoke your key. I'm no crypto expert, but I heard we have fancy things like threshold signatures and secret sharing schemes (where k-out-of-n members quorum is necessary to recover a secret or generate a valid signature), so I believe there are some options for the future how we can improve things - in a ways more flexible and secure than things are now.
- ploxiln 11y ago
  Here's an idea: you can designate "emergency contacts", other keypairs that can be used to recover your identity, perhaps those of your family members. They could declare the intention to recover your credentials, and then you would have 2 weeks to publish a signal that you still possess your keypair, to block the recovery. You could also revoke their designation at that point, if they are abusing it. If two weeks pass without incident, then they can publish a new public key half which is considered yours, and presumably give the private half to you.

scrollaway 11y ago

I agree with most of your logic but let's also be pragmatic - something that is better than everything else out there that's actually popular, and has a chance to hit big, is good for the web. Always pursuing the impossible perfection is one of the reasons we don't have ubiquitous https for example...

drdaeman 11y ago
Well, yes, you're right. Seeking a perfection usually means never releasing anything. That's spot on. Yet, I'm particularly against about the BrowserID adoption because it helps to cement the idea of leased identities. At the moment, we're still with in the "warring states" world, where no particular scheme had won. This could've changed with BrowserID embedded in the User-Agent, so I fear it would be at least a decade until we'll be able to talk about something else. WebID, being a W3C WG, could've also hit big... It's not perfect, but from my understanding of the drafts it looked better than BrowserID to me. But no luck here.
- WorldMaker 11y ago
  It's an interesting moral line in the sand you are making. Persona/BrowserID simply reuses the concept of email address as identity (and email host as identity provider). This is honestly already pretty heavily cemented in the web (I think the war has long since been lost): almost every website uses in some way emails as natural keys for identities and with the critical overuse of email as the medium for "Forgot Password" login schemes, email hosts are already everyone's de facto identity providers. At least there is more personal choice involved in email hosts, and indeed sometimes direct ownership in paid email accounts, unlike the walled garden monopolies we see in Twitter/Facebook/Google "social" logins.
  - drdaeman 11y ago
    Yes, emails are currently required on almost every site. I draw this line because BrowserID/Persona (and similar efforts) are quite special - we jump from the pages to browser's chrome, making user-agent actually handle authentication. I think that the first major standard to come - that'd be embedded in the browser - could change this game rules, because it must be (well - I don't know, I just think it is) a big thing. Even users who don't care would've bought secure yet seamless authentication, neat identity management and so on. But not something after this, because the momentum would be lost and there won't be enough incentive to switch. So, the first standard must have something sensible as credential, or - I fear - it will be a long time before we can hope for any changes. Maybe I'm wrong here.

balabaster 11y ago

The thing that makes this particularly pertinent for me is that I try and avoid Facebook & Google+ and indeed most other identity providers for the sole reason that if one of them gives over (either legitimately by subpoena or by being hacked) access to my account, there is a handy pointer to every other service I have accounts for... I'd rather not leave a centralized paper trail of everything I do in one place.

Arnor 11y ago
I agree in principle, but in practice I don't care much if many of my accounts get hacked or subpoenaed. Sure, I'd like to keep my communication and financial information as private as possible. My code, maybe and my personal photos and documents, but if a hacker or government organization gets access to my chess.com account or my GrubHub, I really don't care. They'll find out that I have trouble against the Sicilian Najdorf and that I eat too much cheese cake (which as of this post is open record anyway :)
- dwiel 11y ago
  "I don't need privacy, I've got nothing to hide"
  - Arnor 11y ago
    No! That is pointedly not what I'm saying. What I'm saying is that I don't need every detail of my life to be private. I prefer that nobody go in and start playing games on my chess.com account, but I'm willing to take a higher degree of risk with that specific account than I am with, e.g. my financial accounts. It is possible to care about privacy and still accept a more convenient (less secure) way to access specific things.

lobster_johnson 11y ago

Most of the world also abuses OAuth — which is for authorizing access to information on your behalf, and is completely orthogonal to identity and authentication — for login. If we step back a bit and look at the problem, the main thing that sites should care about is proof. That is, I'm essentially a number (an opaque, abstract identity), and all the site should want is for me to be able to prove that I am that number. We should forget about email addresses, user names and passwords. A site should be able to request real-world identity information such as your name and address, but there's no need to comingle that with login. A site that isn't an e-commerce app generally has no business getting at that data in the first place. Such a system would be a boon to implementors, too. As a developer, I would greatly appreciate not having to implement another damn account/login system just so that I can remember my visitors. But nothing is going to happen until browsers implement such identity management natively, and the only way to get there is for the browser developers to collaborate on the tech.

zensavona 11y ago
But then how will I send you sixteen emails reminding you to complete your free trial?
- lobster_johnson 11y ago
  That is indeed a conundrum!
- jjuhl 11y ago
  The answer to that is (obviously - and yes, I realize you are trolling) that you dont.

xorcist 11y ago

Not true. I own my domain, and I own it in a very specific juridical sense. It's not tangible, because domains aren't, but it's a lot more like owning a car than leasing a car. The ownership is stronger than for my phone number or my birth name, for example. While the term identity provider might not sound well, it is necessary for a system where you have multiple identities. And I think it's pretty well established that that is a requirement for the modern web.

icebraining 11y ago
Why is an IdP necessary for a system where you have multiple identities? Why can oneself provide the identity one wishes to use for the communication with the other party? I do agree that Persona with a personal domain is a much better system, but why should it be necessary to have one to avoid being tied to a third-party IdP?
- WorldMaker 11y ago
  You don't trust your email provider? Today your email provider is already implicitly your underlying IdP for almost every website you visit that uses that email (if it has a "Forgot Password" button that sends you an email, your email provider is your IdP). All Persona attempts to do is make that implicit assumption an explicit part of that email's identity, and even tries to make it somewhat more secure than sending random tokens via often insecure/semi-secure SMTP channels, as most "Forgot Password" systems do. Ultimately yes, if you want to sign in to a website with your email address you typically have to trust your email provider. This is true on the web almost universally with or without Persona. Why is any IdP required by Persona? Identity protection and reuse across browsers are two big reasons. If I want to say that I am/use the email "wm@example.com", Persona tries to verify that I actually have access to that email (can sign in to my email provider, or can do the classic click a random token link in an email cycle if my email provider isn't supported).
  - drdaeman 11y ago
    > You don't trust your email provider? It's a luxury those days, with email providers snooping over messages to show your advertisements and all sort of TLAs snooping just because they feel so. There is some buzz about end-to-end encryption out there for a reason, and the reason is a lot of people don't trust their email providers. But I reasonably do. I'm hosting my email myself, on the hardware I own, located on my own premises. Although I may get hacked - one can't be ever sure they won't - most modern systems are too complex for any single human to grasp and sometimes bad things just happen. But I don't trust my domain registrar and the network. DNS may get poisoned/spoofed, network may be tapped and traffic redirected, registry or nameservers may get hacked or subpoenae'd (ok, I'm not a criminal, but who has a protection from powerful authorities if they suddenly decide they want you?) and whatever else.

superuser2 11y ago

Normal people will lose key material. Systems administrators sometimes lose key material! In a sane world, it needs to be possible for someone with common sense to revoke and reissue your credential if you lose it. If this is categorically posisble, then your identity is leased, not owned. Your SSH private key is not your identity, it's just some bytes. Your identity is determined by what public key is considered to be "you", i.e. what's in ~/.ssh/authorized_keys. Your infrastructure provider can usually change this, with or without your permission. Unless you own the land where the hard disk public key -> account mapping resides, your identity is leased.

drdaeman 11y ago
> Your SSH private key is not your identity Absolutely. It's my credential. In a perfect system, we decouple those from identities - but that's hard. If you have some ideas about this or know a system that handles this - please share a link. In a less than perfect system, we at least have to try to assure that credentials are self-sufficient and don't require a third party to just exist. That leaves us with either keypairs or pre-shared secrets (traditional passwords). Maybe something else but I don't know. > In a sane world, it needs to be possible for someone with common sense to revoke and reissue your credential if you lose it Well, yes. However, there is just no advancement at the moment - proposed general approach is just not better or worse in this regard. It's the same as if you've lost your password and email in a most traditional identity system out there. If you lose all credentials - your identity's lost and you can only talk to each consumer individually and negotiate whenever a recovery's (to a new identity) possible. This doesn't change. However, in theory, you can set up a system in which your friends or someone you trust may help you to recover or revoke your key. I'm no crypto expert, but I heard we have fancy things like threshold signatures and secret sharing schemes (where k-out-of-n members quorum is necessary to recover a secret or generate a valid signature), so I believe there are some options for the future how we can improve things - in a ways more flexible and secure than things are now.
ploxiln 11y ago
Here's an idea: you can designate "emergency contacts", other keypairs that can be used to recover your identity, perhaps those of your family members. They could declare the intention to recover your credentials, and then you would have 2 weeks to publish a signal that you still possess your keypair, to block the recovery. You could also revoke their designation at that point, if they are abusing it. If two weeks pass without incident, then they can publish a new public key half which is considered yours, and presumably give the private half to you.