4 ms·

Login management should be built into the browsers instead. Imagine a UI where you go to log in and instead of a text/email field for login and a password field

Login management should be built into the browsers instead. Imagine a UI where you go to log in and instead of a text/email field for login and a password field you get a drop down with a list of your personas that you’ve created with the option of adding a new one. Under the hood it would use a public/private key pair to authenticate you with the site. Browsers could implement a service that backs up your personas and syncs them across your devices. Ideally the syncing should be cross browser too and allow me to use my own servers for this if I choose.

oDot 6y ago
https://en.wikipedia.org/wiki/Mozilla_Persona https://en.wikipedia.org/wiki/Mozilla_Persona
wakamoleguy 6y ago
That sounds very much like the goals of Mozilla's Persona service. While it required a separate service and some JavaScript, the idea was that it could be supported natively by browsers in the long run. Unfortunately, it was shut down in 2016 due to lack of interest. (Coincidentally, I just spent this past week hacking on its source code.)
- 8organicbits 6y ago
  I wonder if it just wasnt the right time and if the project could be revived in a couple years. It seems like a great direction.
- IgorPartola 6y ago
  Yes that’s pretty much what I was thinking of. It’s unfortunate Mozilla couldn’t keep it going. I wonder if a browser extension could make this work as a way to pave the way forward. Or if like LastPass could add such functionality.
- fouc 6y ago
  I'd imagine Apple would have more success with this type of service due to the vertical integration. And they are kinda going in this direction..
jmull 6y ago
Don't browsers essentially do this already? You're suggesting some different backend details, but the UX you describe is already in place.
- IgorPartola 6y ago
  Browsers save your passwords which is not the same thing as managing your personas or using asymmetric encryption for authentication.
PretzelFisch 6y ago
I don't like this idea, it makes using a public/cafe computer impossible. It would also force me to have a work browser and personal browser on all my devices. I am also not a fan of google chrome trying to log me into every site with my google profile.
- wakamoleguy 6y ago
  It isn't necessarily any worse for public/cafe computers. Just like any login system, the UI should have the ability to remember you or not. With the browser acting as your user agent, it can manage multiple contexts (work, personal) and let you choose which is sent to each site, without the need for separate browsers for each. As an added tangent, consider that browsers are one of the few places where we can do things like "temporarily log me out of everything" (Incognito Mode / Private Browsing). They have some level of sophistication in session management already.
dsteinman 6y ago
> Login management should be built into the browsers instead. I would go even further than this, and say that a cryptocurrency might be among the best ways to build a universal login system. Imagine an Ethereum-like coin where the wallet is the username, and you spend the coins while authenticating, gaining privileges, and the blockchain stores your public info like a username and avatar that you can bring to any website.
- IgorPartola 6y ago
  I don’t want every login to become a part of the public ledger. Do you? Also, crypto currencies are a good solution for one thing only: electronic currencies. Outside of that they are a poorer solution compared to what’s available now. Every time.
  - whatl3y 6y ago
    > crypto currencies are a good solution for one thing only: electronic currencies. What is a better solution than building a tamper proof workflow in the blockchain? Examples include: 1. I sign a contract and the notary signs and uploads a copy to the blockchain to validate the contract contents, that it was signed and by whom, and when. 2. An auditor validates a piece of evidence a client provides that proves its in compliance with a particular control in some regulatory framework. The auditor uploads a SHA256 hash of the evidence in a transaction memo to the blockchain to validate against later in peer review, a lawsuit, etc. Edit: My examples here refer to a valid use case of a blockchain and not cryptocurrencies which is what you mention, but based on context of this discussion it looks like we all actually mean blockchain and not necessarily cryptocurrency.
    - IgorPartola 6y ago
      Those are useful examples of a blockchain. But when I log into GMail I (a) do not want this fact to be a part of a public ledger and (b) I don’t need this to be trustless. The latter is an important point: I already trust GMail with a ton of my data including the ability to reset my credentials. There is little value gained and a lot of simplicity lost in adding a blockchain to the mix. Blockchains have several uses but to date they are narrow. Everywhere outside of their core use cases (essentially contracts or keeping track of tokens of value) they are a hindrance. Blockchains are also hugely inefficient by design (if they were they’d be easy to crack or to perform a 51% attack on), so when you are communicating with a single third party which you trust to provide a service to you, you absolutely do not need a blockchain. We have seen time and time again people trying to throw this solution at all the problems from DNS to buying groceries and yet the only solutions still worth talking about remain cryptocurrencies. Turns out well defined client/server APIs and databases actually do work about as well as anything else. In the spirit of discussion, what could you do if you involve a blockchain in logging into GMail that you absolutely cannot do without it? If the answer is nothing, then there is zero reason to go down that path.

oDot 6y ago

https://en.wikipedia.org/wiki/Mozilla_Persona https://en.wikipedia.org/wiki/Mozilla_Persona

wakamoleguy 6y ago

That sounds very much like the goals of Mozilla's Persona service. While it required a separate service and some JavaScript, the idea was that it could be supported natively by browsers in the long run. Unfortunately, it was shut down in 2016 due to lack of interest. (Coincidentally, I just spent this past week hacking on its source code.)

8organicbits 6y ago
I wonder if it just wasnt the right time and if the project could be revived in a couple years. It seems like a great direction.
IgorPartola 6y ago
Yes that’s pretty much what I was thinking of. It’s unfortunate Mozilla couldn’t keep it going. I wonder if a browser extension could make this work as a way to pave the way forward. Or if like LastPass could add such functionality.
fouc 6y ago
I'd imagine Apple would have more success with this type of service due to the vertical integration. And they are kinda going in this direction..

jmull 6y ago

Don't browsers essentially do this already? You're suggesting some different backend details, but the UX you describe is already in place.

IgorPartola 6y ago
Browsers save your passwords which is not the same thing as managing your personas or using asymmetric encryption for authentication.

PretzelFisch 6y ago

I don't like this idea, it makes using a public/cafe computer impossible. It would also force me to have a work browser and personal browser on all my devices. I am also not a fan of google chrome trying to log me into every site with my google profile.

wakamoleguy 6y ago
It isn't necessarily any worse for public/cafe computers. Just like any login system, the UI should have the ability to remember you or not. With the browser acting as your user agent, it can manage multiple contexts (work, personal) and let you choose which is sent to each site, without the need for separate browsers for each. As an added tangent, consider that browsers are one of the few places where we can do things like "temporarily log me out of everything" (Incognito Mode / Private Browsing). They have some level of sophistication in session management already.

dsteinman 6y ago

> Login management should be built into the browsers instead. I would go even further than this, and say that a cryptocurrency might be among the best ways to build a universal login system. Imagine an Ethereum-like coin where the wallet is the username, and you spend the coins while authenticating, gaining privileges, and the blockchain stores your public info like a username and avatar that you can bring to any website.

IgorPartola 6y ago
I don’t want every login to become a part of the public ledger. Do you? Also, crypto currencies are a good solution for one thing only: electronic currencies. Outside of that they are a poorer solution compared to what’s available now. Every time.
- whatl3y 6y ago
  > crypto currencies are a good solution for one thing only: electronic currencies. What is a better solution than building a tamper proof workflow in the blockchain? Examples include: 1. I sign a contract and the notary signs and uploads a copy to the blockchain to validate the contract contents, that it was signed and by whom, and when. 2. An auditor validates a piece of evidence a client provides that proves its in compliance with a particular control in some regulatory framework. The auditor uploads a SHA256 hash of the evidence in a transaction memo to the blockchain to validate against later in peer review, a lawsuit, etc. Edit: My examples here refer to a valid use case of a blockchain and not cryptocurrencies which is what you mention, but based on context of this discussion it looks like we all actually mean blockchain and not necessarily cryptocurrency.
  - IgorPartola 6y ago
    Those are useful examples of a blockchain. But when I log into GMail I (a) do not want this fact to be a part of a public ledger and (b) I don’t need this to be trustless. The latter is an important point: I already trust GMail with a ton of my data including the ability to reset my credentials. There is little value gained and a lot of simplicity lost in adding a blockchain to the mix. Blockchains have several uses but to date they are narrow. Everywhere outside of their core use cases (essentially contracts or keeping track of tokens of value) they are a hindrance. Blockchains are also hugely inefficient by design (if they were they’d be easy to crack or to perform a 51% attack on), so when you are communicating with a single third party which you trust to provide a service to you, you absolutely do not need a blockchain. We have seen time and time again people trying to throw this solution at all the problems from DNS to buying groceries and yet the only solutions still worth talking about remain cryptocurrencies. Turns out well defined client/server APIs and databases actually do work about as well as anything else. In the spirit of discussion, what could you do if you involve a blockchain in logging into GMail that you absolutely cannot do without it? If the answer is nothing, then there is zero reason to go down that path.