5 ms·
After reading the text twice and watching both videos i still have no clue what it actually does and how it solves the problem. I'm a few pages of skimming into
by Too 14y ago
After reading the text twice and watching both videos i still have no clue what it actually does and how it solves the problem. I'm a few pages of skimming into the documentation now but there's no overview of what it actually does in the background.
Just a load of buzzwords and awesomeness!1 of how this will revolutionize my account management and how easy the API is.
Is it a password manager, a biometric system or some kind of account provider?
- beefsack 14y agoIt's quite clever, essentially it's a system where your email address is your unique identifier, and you authenticate by clicking on a link sent to your email account. The developer reference has much more information: https://developer.mozilla.org/en-US/docs/persona https://developer.mozilla.org/en-US/docs/persona
- Evbn 14y agoIsn't this basically the same as OpenID?
- slajax 14y agoMy understanding is that it is designed to be a distributed variation to oAuth where you authenticate against an email address instead of a specific social account.
- callahad 14y agoIt's decentralized public-key based authentication, wrapped up in an extremely user- and dev-friendly package. Francois Marier did a good job of explaining it at Kiwi PyCon 2012: https://www.youtube.com/watch?v=iZBTc7iEkQY https://www.youtube.com/watch?v=iZBTc7iEkQY (Think OpenID, but easier to use, easier to implement, and with better privacy protection.) In brief: instead of a username and password at login, you get a user's email address and cryptographically signed assertion proving their ownership of that address. The assertions are ephemeral and scoped to your site, so once you verify it, you can set a session cookie and throw away the assertion. No more password column in your database, yet you still retain a direct relationship with your users. Here's the underlying spec (working on getting it updated for Beta 1, but the principles are all there) https://github.com/mozilla/id-specs/blob/prod/browserid/index.md https://github.com/mozilla/id-specs/blob/prod/browserid/inde...
- htmltablesrules 14y ago>No more password column in your database... Who has liability when a user of mine says their account got hacked? The email provider? My site? Mozilla? If one of my users has $100 go missing from their account, then they are going to expect me to replace it, not the email provider, not mozilla. I don't like the idea of shifting security to a outside platform, because I still retain all the liability when things go bad, and they always will (key loggers, spyware...) Sites that deal with financial transactions will be reluctant to adopt this for sure.
- weaksauce 14y agoFor financial items you could use two factor authentication. Or if your service has something that can be done with a lower set of privileges you could use persona there and fall back to "more secure" methods for anything with financial effects or account changes. The use case seems to be more for sites like twitter, hacker news, reddit, etc...
- stickfigure 14y agoSites that deal with financial transactions are almost always 5-10 years behind on the adoption curve; of course they will be reluctant to use Persona. And that's not unreasonable.
- mixedbit 14y agoHow can any website protect a user against key loggers, spyware or any other form of a compromised client machine? If the client machine is compromised, any login method is broken.
- anon1685 14y agoAs mentioned above, two factor authentication.
- mixedbit 14y agoNot really. All 2 factor authentication schemes that I've seen give no protection against a compromised client machine. In theory you could probably device a scheme that would require the use of two independent devices to perform any sensitive action and that would guarantee that if only one of the devices is compromised, the attacker would have no way to perform any action in a name of the user. But I'm afraid any such scheme would be a complete failure from a usability perspective.
- mmahemoff 14y agoThe original name, "Browser ID", made it clearer. Basically, your browser knows your identity, so it can automatically authenticate you with any supporting website. You never have to set up an account with the website and you never have to enter a password. That's my understanding of it anyway.
- kumar303 14y agoin 5 years many people using the web will have no idea what you're talking about when you say "browser" :)
- Zash 14y agoIt's like PKIX but with JSON.