4 ms·
Persona is a neat idea, but there's a better one: get rid of password logins altogether. I should just be able to enter my email on ANY site, and they'll send m
by odbol 11y ago
Persona is a neat idea, but there's a better one: get rid of password logins altogether. I should just be able to enter my email on ANY site, and they'll send me an email with a login button. I click the login button in the email, and am automatically logged into the site for as long as necessary.
It's exactly as secure as the "Forgot my password" reset nonsense, but streamlined to be way easier on the user. Then you only need one password: the one to your email. This removes the need for Persona to "add support" for different email providers. Your provider doesn't matter, just the fact that you can receive emails!
I'd really wish more sites would just do this anyway. For instance, every time I get an analytics daily report from Fabric.io, I click the link in the email, and it asks me to login. WHY ARE YOU ASKING ME TO LOGIN, WHEN I JUST CLICKED AN EMAIL YOU SENT ME? It's obviously me!
- tim333 11y agoYeah but if you do that what happens if you want to use the site again the following week? Do you have to do the check your email thing every time which could get annoying or leave them logged in for ever with cookies which could be a security issue. Not saying it's necessarily a bad idea but I wonder how well it would work in practice compared with the normal stuff.
- Flimm 11y agoIf you have an identity server, a website and a browser that all support Persona, (and you've already been through the process once), Persona would work much better than that. You don't have to memorise a new password and you don't have to click on a verification email. You just land on a new site, click log in with Persona, choose your email address, and TADA! you're in. And the beauty of it is that your email provider doesn't even know which sites you're logging in to.