10 ms·
I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I
by SwellJoe 11y ago
I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience.
Now, here's the sad thing, for me: I didn't even know Persona existed until its demise was being discussed on HN and reddit. Persona is exactly what I want for my users and my sites; and for my own use of the web. And, I didn't even know it was an option until it stopped being an option.
In short: I strongly agree. Mozilla has to focus resources on areas where it can have the biggest impact on privacy and the open web. This is one of those areas.
I hated to see Thunderbird dropped from the Mozilla roster, as it is my mail client of choice, but I understand where they're coming from. I hated to see FirefoxOS end, but I never got to use it, and it seems to have been doomed from the get-go by poor market fit and difficulty competing with the three biggest tech companies in the world in a market where money and influence play a role in which devices get into users hands. But, Persona is exactly the right kind of thing for Mozilla to be doing, and there's no reason they can't do it effectively, and without a huge amount of resources.
- manigandham 11y agoSide note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.
- scrollaway 11y agoTheoretically yes, but it's not as simple as that. Every identity can have more than one email associated with it, and emails can change over time. So "username == email" is fine as long as the concept of a username mutating is fine.
- manigandham 11y agoI don't see a problem, it just means you can login with multiple emails then. They're still unique to you. LinkedIn and Facebook and other services already do this. A username/real name can still be used as the "name" if this is an online community or something similar.
- kbenson 11y agoLinkedIn and Facebook can do this because your email is not your username. There likely isn't really a username in those systems, just a user id. Almost all systems have a user id, but the distinction here is slightly different. Instead of a user record which has an id, username and possibly full name, Facebook likely has a user record with an id, a (display) username, and then there is a separate set of auth records with the multiple ways you can authenticate to the account, such as emails and passwords, API tokens, phone numbers, etc. It may not sound like a big distinction, but there is a big distinction there. Instead of your username being your email address, they've abstracted the authentication from the core user record such that usernames are not used for authentication, so don't have to mutate if the authentication identifier (email address, phone number) changes, just some auth settings. This is obviously a much more extensible and robust way to deal with authentication over time, but it's also obvious it's much more complex than a simple username/password pair.
- stickfigure 11y agoWhat you're describing is "use a synthetic primary key for your User", which is something even the most naive junior web developer does automatically these days. There's nothing special about LinkedIn and Facebook except that they went through the trouble of adding additional authentication mechanisms. You can too, no matter what you treat as a "username".
- kbenson 11y agoI'm not entirely sure where you got the impression I was implying it was hard and esoteric, and only Facebook and LinkedIn could do so. I was simply noting that there's a difference between email as a username and email as part of one or more authentication tokens, and the differences in design and how it affects the possible future need of users to change what are often usable as authentication (email addresses, phone numbers, etc).
- nileshtrivedi 11y agoYou are describing the tripartite identity pattern: http://habitatchronicles.com/2008/10/the-tripartite-identity-pattern/ http://habitatchronicles.com/2008/10/the-tripartite-identity...
- k__ 11y agoWouldn't a new email be as unique as the old one? I mean mutating is only a problem if usernames collide.
- moron4hire 11y agoThese are not unique to email addresses as identifiers, because people change over time. You can't even count on people's real names staying the same over time, as something as simple as marriage gives many an impetus to change it. Any database that assumes immutability of one's visible identity is broken by design.
- emidln 11y agoServices that don't require email for functionality shouldn't require email addresses at all. An excellent example of this is reddit.
- skrebbel 11y agoFunctionality such as "forgot password"?
- sp332 11y agoCompletely optional. Like HN for example.
- CM30 11y agoSo if someone forgets their login details, they're basically screwed? Because I've used some sites like that, and they're a royal pain whenever something goes wrong. For example, TV Tropes didn't used to have a password reset, so every time something went wrong, you'd pretty much have to either register a new account or bug someone on the forums about it. Same with another site I was on, except the usual solution was seemingly 'find one of the staff on another site they're a member of and send them a message there'. Made for a nice security hole too, since people could (and did) impersonate others and get given their accounts as a result. You need some sort of email (or other contact information, like a phone number) simply so people can get their account details back in a semi secure way.
- sp332 11y agoYou can have a password reset feature, but it would be optional. If the person decides not to include their email, they would have to bug a mod who would maybe reinstate them. You could also use SMS or a twitter handle or even snail mail instead of requiring an email address.
- sghodas 11y agoYou'd rather share your phone number or home address than your email address?
- Silhouette 11y agoThat depends on context, of course. As an obvious example, if you're actually selling something, you very much do need to know the real name and possibly real address of the person you are contracting with.
- manigandham 11y agoYes, I was only talking about usernames and how they're often unnecessary for most sites, especially the login process.
- izacus 11y agoSo what happens when I want to change my email? I lose all my accounts?
- manigandham 11y agoYou... just update your email. Or add the new one if the service supports multiple.
- amsb 11y agoIt depends on the security needs of the service. Email addresses are discoverable making it easier for an attacker to target a particular account while usernames give the user the opportunity to further insulate themselves from being discovered on a service and potentially brute-forced or cross-ite attacked. Perhaps less important for a social sharing service and more important for a financial service, but it depends on the user.
- drdaeman 11y agoWhat's the benefit? And, more than this, why do I must provide anyone my mail address? Why do I have to provide it at all? I understand and I'll provide my email address, my JID, my phone number and whatever else I'm willing to provide, if I want someone to contact me. But contact details are technically completely unnecessary to just have an account.
- cmurf 11y agoI agree. We're doing this wrong. Airport "free" WiFi wanting to know my date of birth, and cranky weird crap like that.
- CaptSpify 11y agoAnd im just going to lie anyway. How many people tell the truth on those?
- jessaustin 11y agoI do the same, but how long will it be until that's some sort of TSA violation that will get us on a list?
- striking 11y agoPassword reset. Services need to identify you in another way to authenticate you that isn't your password. If you don't want that, use Mailinator and forget about it. It's insurance against stupid support requests is what it is.
- ams6110 11y agoThey are not necessarily unique over time. There's no guarantee that jrandom@example.com today is the same person it was a year ago or a year hence. Or in the case of services like mailinator, even unique at all.
- MarkMc 11y agoExcept that users are really bad at choosing strong passwords. A significant percentage will even use the same email/password combination accross multiple sites. For a site which contains sensitive financial or medical data, it is better to issue a 'username' that contains random characters. (This is the technique the UK government uses when users log in to pay tax)
- tripzilch 11y agoVisiting my parents for Christmas, I helped my mom set up her new win10 laptop. (and she's real good with computers for someone her age whose job wasn't in IT) Lesson here for anyone wanting to use emails for usernames: Make it really clear that you're asking for the email as an ID, as the username. Otherwise this will incline people to enter the same password as their email because they think they're asked to log in. Even if they know it's important not to re-use passwords over different logins. To make this anecdata N>1, I teach computer stuff to kids (ages 8-12, generally) and they tend to make the same mistake. (working on semi-public computers, I am glad I get to teach them about Private Windows: "if it's not your computer, only enter your password on a window that shows the little mask/sunglasses-guy")
- nalck 11y agoWhile I too would love to see continued development of Persona and Thunderbird by Mozilla, it's important to remember that as open-source projects they're still freely available. I still use both, and see no reason to stop. Development can continue without Mozilla.
- StavrosK 11y agoI used it two weeks ago for a weekend project (shameless plug: https://www.pastery.net/ https://www.pastery.net/, a beautiful pastebin), and it's just not the same. Feature requests go into the void, although the team at Mozilla was kind enough to answer even though it's not their job any more, but you can't really use it for a "serious" site while it's very unsupported.
- dorfsmay 11y agoProject rot is a thing. This is one thing Mozilla has been good at, keep projects alive and create network effect (well known name backup). Another Thunderbird user...
- fuck_google 11y agoYes. Google has demonstrated how trust can be lost quickly by killing or abandoning popular projects. It is the path to the dark side. Hopefully Mozilla can resist taking that path.
- wpietri 11y agoHaving used Persona on my last project, I'd agree. The article brushes aside the "no traction" bit and says, basically, "the idea was awesome". But that's why we test ideas and measure them by results like traction: not all great ideas turn into great products. Persona as deployed was an appealing idea that did not provide a great user experience (or really, a great developer experience). To fill the gap, you need to A) deliver lots of value, or B) target an audience that has some special motivation (e.g., idealism) to use the product. Persona did not do A, and general-audience users definitionally lack B. A site's developers might have that motivation, which is why some people tried Persona out. But if the users don't share the motivation, then to them it's just a low-grade experience. If Mozilla wants to go after the identity market again, they need to do something different. The obvious thing to do would be to leverage their browser market share and make something lower friction than existing systems, rather than Persona's higher friction. But since this is an obvious idea and there are plenty of smart people at Mozilla, I presume there's some good reason they didn't do that in the first place.
- quadrangle 11y agoThe entire point of "Persona" is that it was actually something in the backend called "BrowserID" that was supposed to integrate with the browser instead of running some random JS widget in a page. Well, Mozilla never even finished implementing the first version of that before they declared "no traction"! What nonsense!
- nickbauman 11y agoHaving native code handle something in the browser instead of a thin, easily verifiable javascript widget seems the opposite of a more secure solution.
- nly 11y agoNo, because javascript puts the server in control of the code being run on the client. It renders the whole thing vulnerable to nasty attacks like spoofing and MITM.
- 11y ago
- doctorpangloss 11y agoFacebook Anonymous Login is definitely a step in the right direction to address those concerns. And yet it's hardly adopted anywhere. I think you're underestimating the importance of Facebook information towards making viable free content. The basic, accurate information you receive from the FB SDK really helps salespeople identify qualified leads for trial-to-paid conversions; the info also can be used to tell you what other websites people visit or software they use. This really helps make sales and improve your software in a way that seems generally net positive for consumers and producers.
- scrollaway 11y agoAnd the moment Facebook decides to shut down? Or worse, the moment they start abusing their position as your identity provider?
- SwellJoe 11y ago"I think you're underestimating the importance of Facebook information towards making viable free content. The basic, accurate information you receive from the FB SDK really helps salespeople identify qualified leads for trial-to-paid conversions; the info also can be used to tell you what other websites people visit or software they use." I generally consider this kind of information warehousing and sharing unethical. While I understand the business case for it, and I understand that facebook has permission from their users because of the ToS agreement, I don't want to inflict it on my customers (who are often Open Source and Free software nerds who take their security somewhat seriously). I am a facebook user, but I don't like what facebook does to privacy. Google, same story. So, I view participating in those login systems as low-grade evil, as it contributes to the incredible stockpile of data facebook and Google have about all of us. I don't make a big deal about it, and I use sites that require it, but I don't have to like it. And, if there were a way for me to provide a similarly nice user experience to my customers without invading their privacy in any way, I would do so.
- deno 11y agoFacebook’s “Anonymous Login” doesn’t protect you in any way from Facebook, it’s for hiding information Facebook owns about your life from other websites. So it doesn’t help with this: >The basic, accurate information you receive from the FB SDK really helps salespeople identify qualified leads for trial-to-paid conversions; the info also can be used to tell you what other websites people visit or software they use. This really helps make sales and improve your software in a way that seems generally net positive for consumers and producers. but does nothing at all to protect your privacy. > And yet it's hardly adopted anywhere. That’s because it’s Public Relations. Just like their TOR gateway. Just like Zuckerberg’s LLC “charity.” Just like everything else they do[1]. “Steps in the right direction” is the signature move of modern corporate PR. [1] http://thehill.com/policy/cybersecurity/258060-advocate-accuses-facebook-of-secretly-lobbying-for-cyber-bill http://thehill.com/policy/cybersecurity/258060-advocate-accu...
- rsync 11y ago"the annoyance that is "Sign up with a username, email address, and password"." I know of an easy way to remove 33% of that ... Email addresses are globally unique, and everyone already knows theirs ... email + password seems like a simple, well accepted and workable solution. Right ?
- the8472 11y ago> but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". For me those big fat "sign in with google/facebook" buttons are an annoyance when it takes several clicks to get the old-fashioned account management. Some sites don't even have an option to not use a 3rd-party identity. Not everyone has google/facebook.
- ry_ry 11y agoAnd more importantly, signing in with fb is simply handing over our personal details. I use gmail, I have no problem trading my info for goods and services - I know what they're realistically worth and judge accordingly. But for Fred's Arbitrary Website? Go fuck yourself Fred, I'll hand over exactly as much information as I like.
- striking 11y agoTo be fair, Fred's Arbitrary Website probably only captures your email address, if that. OAuth2 permissions and the like. But I agree, some users would rather cut out the middleman than be chained to the social network du jour.
- sleepydog 11y agoReally, Facebook/Google get the sweeter end of the deal. They'll know that you use Fred's arbitrary website. They will know when you use it, how often you it, and how long you use it each time. They'll add your new usage patterns to the database they've been building about you for the past decade. They'll correlate your behavior with other users of Fred's arbitrary website.
- idunno246 11y agoThey already get that from Facebook like buttons on every single page
- waspleg 11y agoWhy do you require a sign in/sign up in the first place? My ad blocking is configured to disable all that crap and I don't make accounts unless I really want whatever is behind it (which is exceedingly rare). On the other hand, I'm the only one I know personally who does not have a Facecrook account and when I tell people they're the product they just stare at me with doll eyes. shrug
- quanticle 11y agoAn account of some sort is the only way for a website to store state about you, most notably for authentication/permissions. Do you have a better way of, for example, identifying whether I should be allowed to see a private Github repository or not?
- SwellJoe 11y agoMy website has: - Shopping cart for selling our software and support products. - Forums for discussing our software. Email notifications are available for users who want to follow threads. - Ticket tracker for reporting bugs and making support requests about our software. Email notifications are, once again, available for users to follow threads. - License manager, so that people who have bought our software can get the keys to download the software. How would you suggest we accomplish those tasks without having a sign-in, at all?
- wtbob 11y ago> I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Why not just 'log in with email address'? The user provides his email address; you send him an email with a URL of the form http://www.invalid/path/to/resource?access_token=aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw http://www.invalid/path/to/resource?access_token=aSBkb25lIGF... (where aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw is a cryptographically-authenticated account identifier). When he follows the URL, you can set a cookie if you want him to be automatically logged in next time he visits your site, or not if you don't. Extending this to be one-time only (to prevent replay by an email provider) is an exercise for the reader.
- agentdrtran 11y agoMedium does this, but I'm not a fan because it takes longer than just using a username/password generated with LastPass.
- sz4kerto 11y agoHowever, this method can't really be used everywhere -- not all emails are encrypted up to the point where the recipient reads them.
- wtbob 11y ago> However, this method can't really be used everywhere — not all emails are encrypted up to the point where the recipient reads them. Neither are password-reset emails… This is no more or less secure than sending password-reset emails; any additional security intended to protect in the case of password resets can be applied to login as well (e.g. SMS or landline contact, knowledge of shared secrets of varying security).
- debaserab2 11y agoThis is essentially the same thing as having your password emailed to you and is insecure for all the same reasons. Youre putting the responsibility of security on the email provider, which you can't control.
- 21echoes 11y ago> And, I didn't even know it was an option until it stopped being an option. Not to take away from your overall point, but you can still very much use persona: https://developer.mozilla.org/en-US/Persona https://developer.mozilla.org/en-US/Persona (linked from https://login.persona.org/ https://login.persona.org/ )
- SwellJoe 11y agoCool. I'll give it a shot. There is a Drupal module for it (I run Drupal on my current primary site, for now), though it only has 38 active installs, which is somewhat worrying.
- iheartmemcache 11y agoFrom what I read (very very briefly), the spec is similar to what OpenID was, in that anyone who runs a web server can become an authentication provider. Ideally there'd be a distributed-hash-table type web-of-trust so its semi-centralized (i.e. somewhat like PGP or BGP routing tables where you peer with people you trust). Now that 1st party browser certificates are available so you get that Trusty-Green-Lock(tm) on all browsers, geeks can theoretically run their own identity service based on some sort of combination of these technologies. (Ideally with the long term outcome solving the "Why Johnny can't have Crypto" problem, maybe using a cell phone app as an RSA SecurID type dongle.) This also has the benefit of letting you authenticate against your bud John's Identity Server, rather than Go-fuck-yourself-Fred's (you'd need token negotiation in there somehow though). Someone smarter than me (DJB where are you?) should piece this together, release it as open source for the end-user, and fund it via expensive Exchange module integration.
- grandalf 11y agoI found Persona to have some pretty bad UX. I do not want to have to log in again when I close a browser window.
- Sir_Substance 11y agoHoly shit, are you me? >Now, here's the sad thing, for me: I didn't even know Persona existed until its demise was being discussed on HN and reddit. Persona is exactly what I want for my users and my sites; and for my own use of the web. That's the biggest standout for me as well. I've been /looking/ for a technology like this. Not looking very hard, it must be said. Ok, maybe it's more accurate to say I've been saying for years someone should make this without ever googling to see if someone had. But how is it that in 3-4 /years/ of me discussing this with other developers every time we bring up account systems, no one has said "oh yeah, persona does that!". Did Mozilla not advertise this at all? The lack of mindshare is staggering.
- fjbarrett 11y agoHow does logging in with Twitter compare to Google and Facebook? Same experience?