5 ms·

From https://developer.mozilla.org/en/BrowserID/ https://developer.mozilla.org/en/BrowserID/ "Website operators still get a verified email address for their us

From https://developer.mozilla.org/en/BrowserID/ https://developer.mozilla.org/en/BrowserID/ "Website operators still get a verified email address for their users, and users only have to remember a single password. BrowserID is also intuitive, since email addresses are commonly understood to be associated with identities." Mozilla is really stressing the "email address/single password" concept. If they really mean "email address/separate dedicated Persona password" then they should make this clear.

callahad 14y ago
The language around the number of passwords you need is really hard to get right. If you have suggestions, please let me know. In a world where every email provider supports Persona natively, Persona truly is a "no new passwords" authentication system, since it delegates to your provider. If your email address isn't supported, Persona asks you to create a single new password at login.persona.org. You can then add many other unsupported addresses, without needing more passwords. So it's an "at most one new password" system.
- uvtc 14y ago
  Simply always refer to the Persona password as "Persona password". > In a world where every email provider supports Persona natively, Persona truly is a "no new passwords" authentication system, since it delegates to your provider. I don't know what this means. I won't give Persona my gmail/yahoo-mail email password.
  - callahad 14y ago
    Yeah, it's confusing. If your email provider is supported, your browser talks directly to your email provider, without Mozilla in the middle. We don't want your passwords, honest! :) You can try out the supported email provider workflow by signing up for a dummy account at eyedee.me, and then using that account to sign in at, say, 123done.org.
    - jackalope 14y ago
      Wait, if this system works with a dummy account, then a valid email address isn't necessary at all. Any domain can set up an identity provider to support user@domain. Why drag email providers into the discussion, then? It confuses everyone.
      - stickfigure 14y ago
        It confuses you because you are a technologist. For 99.99% of the world, user@domain == email address. "Sign in with your email address" gets the point across. "Sign in with your user identity at a controlling DNS authority" may be more accurate, but will actually confuse everyone.

callahad 14y ago

The language around the number of passwords you need is really hard to get right. If you have suggestions, please let me know. In a world where every email provider supports Persona natively, Persona truly is a "no new passwords" authentication system, since it delegates to your provider. If your email address isn't supported, Persona asks you to create a single new password at login.persona.org. You can then add many other unsupported addresses, without needing more passwords. So it's an "at most one new password" system.

uvtc 14y ago
Simply always refer to the Persona password as "Persona password". > In a world where every email provider supports Persona natively, Persona truly is a "no new passwords" authentication system, since it delegates to your provider. I don't know what this means. I won't give Persona my gmail/yahoo-mail email password.
- callahad 14y ago
  Yeah, it's confusing. If your email provider is supported, your browser talks directly to your email provider, without Mozilla in the middle. We don't want your passwords, honest! :) You can try out the supported email provider workflow by signing up for a dummy account at eyedee.me, and then using that account to sign in at, say, 123done.org.
  - jackalope 14y ago
    Wait, if this system works with a dummy account, then a valid email address isn't necessary at all. Any domain can set up an identity provider to support user@domain. Why drag email providers into the discussion, then? It confuses everyone.
    - stickfigure 14y ago
      It confuses you because you are a technologist. For 99.99% of the world, user@domain == email address. "Sign in with your email address" gets the point across. "Sign in with your user identity at a controlling DNS authority" may be more accurate, but will actually confuse everyone.