3 ms·

"we're really, really easy to implement" "I want to see us become the de facto auth solution" "We also let you reach many, many more people" "but we're also a r

"we're really, really easy to implement" "I want to see us become the de facto auth solution" "We also let you reach many, many more people" "but we're also a really nice option to put alongside your social login" Assuming by "we" and "us" you mean Mozilla? Or do you also mean the other major browsers? Why did you write it like that? Why not just say "Persona" instead of "we" and "us"? Surely Persona is much bigger than Mozilla or do you not think so? Firstly, that kind of language does not inspire trust. It sounds very much "us" vs "them", instead of addressing the real problem, which is helping users by creating and managing more secure passwords. Secondly, your marketing to users includes: "Many sign-in systems carry your profile data with them; some even share that info with other sites and social networks. We believe you should control how your personal information is shared." You seem to want to attract publishers and yet you show your distrust of them to users. Also, from experience in Public Web Apps, and the fact that it's still not possible for a user to give raw and pure TCP, UDP or POSIX power to Web Apps (and WebSockets and IndexedDB are not at all the same), I don't think the issue is so much that the user has power, as it is that the browser should have power. As it is today, the user is given very little power at all by the browser. Very little trust. Most spec discussions seem to constantly worry about users shooting themselves in the foot, and are prepared to stop at that, rather than finding ways to empower users to give power to web apps.

callahad 14y ago
I work for Mozilla on the Persona team, so it feels natural to say "we" to refer to us and the specific implementation we've built, but I see your point as to the feel of that language. Thanks for calling me out. Persona certainly has a scope beyond Mozilla, and its current state owes much to open collaboration.
- jorangreef 14y ago
  Well done on your efforts and may Mozilla continue to develop into a force for good. At the moment, however, and Persona is a good example of this, the browser approach to innovation is very much top-down with high-level APIs like UndoManager, WebRTC, IndexedDB rather than bottom-up with low-level APIs like UDP, TCP and POSIX which would trust the developer community to do the rest. Browsers are just not very programmable when compared to platforms like mobile and native. For example, if the user would be allowed by the browser to empower a web app with raw POSIX, then that would unleash an explosion of databases running in the browser, orders of magnitude better and faster than IndexedDB. Sadly, this kind of innovation is currently locked up tight inside the various spec committees. For sure, developers can contribute to the mailing lists, but innovation should not be made to go through that kind of process at all in the first place. Innovation on the web needs to be decentralized not centralized. Ideally, Mozilla needs to start making that possible, by providing just the right OS-level APIs and a simple way for users to grant these to Web Apps. It must be 1984 that one can use a browser, but not be allowed to give raw TCP or UDP or POSIX annointing to web apps that one trusts. See Tim Berners-Lee on the subject: http://lists.w3.org/Archives/Public/public-webapps/2012JanMar/0464.html http://lists.w3.org/Archives/Public/public-webapps/2012JanMa...
- codinghorror 14y ago
  I'm not a fan of the way this requires me to set a password for Persona. I'd rather just have one password, my email (gmail) password, and use that.
  - Flimm 14y ago
    That's the plan. Mozilla are just waiting on Gmail to cooperate and implement Persona on their side. In an ideal situation, both your browser (eg: Firefox) and your email provider (eg: Gmail) would support Persona. In that case, you don't have to click on any links to prove your email address, you don't have to create a new password, you don't have to trust Mozilla's servers to store a hashed version of your password correctly. The log-in dialog itself with be part of the browser chrome, training users to trust the browser and not the website, which is a good thing. If your browser or your email provider don't support Persona, then Mozilla have provided fallbacks, which require you to click a link in an email and to create a new Persona-specific password.
    - rfk 14y ago
      In the case of gmail, they're note even waiting. There is active development on a gmail-to-persona proxy so that you can authenticate with just your gmail password: https://github.com/mozilla/browserid-bigtent
deleted 14y ago
[deleted]

callahad 14y ago

I work for Mozilla on the Persona team, so it feels natural to say "we" to refer to us and the specific implementation we've built, but I see your point as to the feel of that language. Thanks for calling me out. Persona certainly has a scope beyond Mozilla, and its current state owes much to open collaboration.

jorangreef 14y ago
Well done on your efforts and may Mozilla continue to develop into a force for good. At the moment, however, and Persona is a good example of this, the browser approach to innovation is very much top-down with high-level APIs like UndoManager, WebRTC, IndexedDB rather than bottom-up with low-level APIs like UDP, TCP and POSIX which would trust the developer community to do the rest. Browsers are just not very programmable when compared to platforms like mobile and native. For example, if the user would be allowed by the browser to empower a web app with raw POSIX, then that would unleash an explosion of databases running in the browser, orders of magnitude better and faster than IndexedDB. Sadly, this kind of innovation is currently locked up tight inside the various spec committees. For sure, developers can contribute to the mailing lists, but innovation should not be made to go through that kind of process at all in the first place. Innovation on the web needs to be decentralized not centralized. Ideally, Mozilla needs to start making that possible, by providing just the right OS-level APIs and a simple way for users to grant these to Web Apps. It must be 1984 that one can use a browser, but not be allowed to give raw TCP or UDP or POSIX annointing to web apps that one trusts. See Tim Berners-Lee on the subject: http://lists.w3.org/Archives/Public/public-webapps/2012JanMar/0464.html http://lists.w3.org/Archives/Public/public-webapps/2012JanMa...
codinghorror 14y ago
I'm not a fan of the way this requires me to set a password for Persona. I'd rather just have one password, my email (gmail) password, and use that.
- Flimm 14y ago
  That's the plan. Mozilla are just waiting on Gmail to cooperate and implement Persona on their side. In an ideal situation, both your browser (eg: Firefox) and your email provider (eg: Gmail) would support Persona. In that case, you don't have to click on any links to prove your email address, you don't have to create a new password, you don't have to trust Mozilla's servers to store a hashed version of your password correctly. The log-in dialog itself with be part of the browser chrome, training users to trust the browser and not the website, which is a good thing. If your browser or your email provider don't support Persona, then Mozilla have provided fallbacks, which require you to click a link in an email and to create a new Persona-specific password.
  - rfk 14y ago
    In the case of gmail, they're note even waiting. There is active development on a gmail-to-persona proxy so that you can authenticate with just your gmail password: https://github.com/mozilla/browserid-bigtent

deleted 14y ago

[deleted]