4 ms·

This is pretty cool, I might try it one day if I build a site that needs login. But this is a lot different than Persona, right? Portier is passwordless login

This is pretty cool, I might try it one day if I build a site that needs login. But this is a lot different than Persona, right? Portier is passwordless login via email (with special handling for Gmail), whereas Persona is another of those "Log in via" buttons (simply speaking)?

onli 10y ago
I'd see it a bit differently, even if in practice you are right, at least the moment Persona added an account system. But also persona had the core idea that you get authenticated by proving that you control the email address entered, see https://developer.mozilla.org/en-US/Persona/FAQ#How_does_Persona_verify_a_user%27s_association_with_an_address https://developer.mozilla.org/en-US/Persona/FAQ#How_does_Per.... On top of that there was the browserid API. Portier is passwordless login via email, with optional special handling right now only for Gmail, yes.
- k__ 10y ago
  So how is the workflow? 1. Click "Login with Portier" 2. Enter email 3. Click on link in email 4. Be logged in ?
  - kosinus 10y ago
    Pretty much! 1 and 2 are typically a form on the site using Portier (relying party). There's also less emphasis on branding; as a user you will rarely see Portier mentioned.
  - onli 10y ago
    Pretty much, yes. However, ideally you would not "Login with Portier", you would simply "Login". There is no need to mention the infrastructure used (and in our current modules, we simply generate a plain Login-Form without any branding). You also do not have to click on the link, you can enter the code which is in the email. Useful when mixing clients. And finally, when using a email provider with special support (currently: Gmail) you don't click on the email and also don't get one. You just login via Google-Sign-In and get then redirected to the site you are trying to login to. I hope we can support more providers (and custom domains soon). Not having to go into the emails is pretty nice. Edit: Also see https://github.com/portier/portier.github.io/blob/master/Design.md https://github.com/portier/portier.github.io/blob/master/Des... for a more technical view on what happens here.
    - wofo 10y ago
      This is awesome! You automatically get sign in with Google and (in the future) other providers!
      - callahad 10y ago
        Exactly! And you can run one instance for all your projects, regardless of language, instead of having to set up Django-All-Auth for one and Ruby OmniAuth for another. Plus, if we can succeed at the federated discovery protocol part, users gain the ability to host their own authentication endpoint that Portier will automatically delegate to.
    - deleted 10y ago
      [deleted]
    - zimbatm 10y ago
      Would be it be possible to support a `.well-known/portier` to support arbitrary SSO?
      - deleted 10y ago
        [deleted]
      - callahad 10y ago
        Yep, though hopefully we'll be able to avoid reinventing wheels and instead re-use something like WebFinger / WebFist and... something... from OpenID Connect. My immediate concern between now and the end of the Persona shutdown is getting the Gmail + fallback loop stable, audited, and easy to deploy. After that it should be trivial to integrate a federated, email-driven discovery protocol. Just haven't had time to give that proper consideration, yet.
  - deleted 10y ago
    [deleted]
fiatjaf 10y ago
No. They work pretty much the same, except Portier is stateless, and Personal needed you to create an account before use, which was unnecessary. Persona also had special handling for Gmail. Portier will probably add more "special handling" cases in the near future.
- onli 10y ago
  > Portier will probably add more "special handling" cases in the near future. We certainly currently intent to.
- WorldMaker 10y ago
  Persona only required you to create an account if your email provider didn't support it (or your custom domain doesn't delegate it) or they didn't have special handling for your email provider. There was a bunch of confusion about this early on because a lot of potential early adopters were generally geeks like us who have our own email domains and didn't automatically fall into the special handling (which Persona supported Gmail and Yahoo, which remain the two largest email domains).
  - callahad 10y ago
    Technically, you always created an account when you used Persona. Sometimes with a password, sometimes without. Sometimes old passwords would come back to haunt you if your domain added and then removed support for BrowserID. Sometimes you would accidentally set up two accounts, because you added a new address to the Persona UI in the wrong order. Sometimes addresses would mysteriously bounce between Persona accounts, because we updated the address/account association on each use. Sometimes you needed a password and sometimes you didn't for the same address, because we supported un-decentralizing Persona on a per-website basis. ...the account story in Persona was way more complicated than it should have been, mainly stemming from the notion that per-login email confirmation loops were too onerous to be viable, and from the idea that users wouldn't succeed with Persona unless it remembered and displayed all of their email addresses in a consistent, persisted account chooser.

onli 10y ago

I'd see it a bit differently, even if in practice you are right, at least the moment Persona added an account system. But also persona had the core idea that you get authenticated by proving that you control the email address entered, see https://developer.mozilla.org/en-US/Persona/FAQ#How_does_Persona_verify_a_user%27s_association_with_an_address https://developer.mozilla.org/en-US/Persona/FAQ#How_does_Per.... On top of that there was the browserid API. Portier is passwordless login via email, with optional special handling right now only for Gmail, yes.

k__ 10y ago
So how is the workflow? 1. Click "Login with Portier" 2. Enter email 3. Click on link in email 4. Be logged in ?
- kosinus 10y ago
  Pretty much! 1 and 2 are typically a form on the site using Portier (relying party). There's also less emphasis on branding; as a user you will rarely see Portier mentioned.
- onli 10y ago
  Pretty much, yes. However, ideally you would not "Login with Portier", you would simply "Login". There is no need to mention the infrastructure used (and in our current modules, we simply generate a plain Login-Form without any branding). You also do not have to click on the link, you can enter the code which is in the email. Useful when mixing clients. And finally, when using a email provider with special support (currently: Gmail) you don't click on the email and also don't get one. You just login via Google-Sign-In and get then redirected to the site you are trying to login to. I hope we can support more providers (and custom domains soon). Not having to go into the emails is pretty nice. Edit: Also see https://github.com/portier/portier.github.io/blob/master/Design.md https://github.com/portier/portier.github.io/blob/master/Des... for a more technical view on what happens here.
  - wofo 10y ago
    This is awesome! You automatically get sign in with Google and (in the future) other providers!
    - callahad 10y ago
      Exactly! And you can run one instance for all your projects, regardless of language, instead of having to set up Django-All-Auth for one and Ruby OmniAuth for another. Plus, if we can succeed at the federated discovery protocol part, users gain the ability to host their own authentication endpoint that Portier will automatically delegate to.
  - deleted 10y ago
    [deleted]
  - zimbatm 10y ago
    Would be it be possible to support a `.well-known/portier` to support arbitrary SSO?
    - deleted 10y ago
      [deleted]
    - callahad 10y ago
      Yep, though hopefully we'll be able to avoid reinventing wheels and instead re-use something like WebFinger / WebFist and... something... from OpenID Connect. My immediate concern between now and the end of the Persona shutdown is getting the Gmail + fallback loop stable, audited, and easy to deploy. After that it should be trivial to integrate a federated, email-driven discovery protocol. Just haven't had time to give that proper consideration, yet.
- deleted 10y ago
  [deleted]

fiatjaf 10y ago

No. They work pretty much the same, except Portier is stateless, and Personal needed you to create an account before use, which was unnecessary. Persona also had special handling for Gmail. Portier will probably add more "special handling" cases in the near future.

onli 10y ago
> Portier will probably add more "special handling" cases in the near future. We certainly currently intent to.
WorldMaker 10y ago
Persona only required you to create an account if your email provider didn't support it (or your custom domain doesn't delegate it) or they didn't have special handling for your email provider. There was a bunch of confusion about this early on because a lot of potential early adopters were generally geeks like us who have our own email domains and didn't automatically fall into the special handling (which Persona supported Gmail and Yahoo, which remain the two largest email domains).
- callahad 10y ago
  Technically, you always created an account when you used Persona. Sometimes with a password, sometimes without. Sometimes old passwords would come back to haunt you if your domain added and then removed support for BrowserID. Sometimes you would accidentally set up two accounts, because you added a new address to the Persona UI in the wrong order. Sometimes addresses would mysteriously bounce between Persona accounts, because we updated the address/account association on each use. Sometimes you needed a password and sometimes you didn't for the same address, because we supported un-decentralizing Persona on a per-website basis. ...the account story in Persona was way more complicated than it should have been, mainly stemming from the notion that per-login email confirmation loops were too onerous to be viable, and from the idea that users wouldn't succeed with Persona unless it remembered and displayed all of their email addresses in a consistent, persisted account chooser.