4 ms·

I tried logging in -- persona sent me email of confirmation, when clicked it redirected to ebookglue which alerted 'login attempt failed'. you might want to loo

I tried logging in -- persona sent me email of confirmation, when clicked it redirected to ebookglue which alerted 'login attempt failed'. you might want to look into that.

shantanubala 14y ago
I'm sorry about the trouble with Persona -- many people have been reporting issues, and it's unfortunately not been as stable as I would have wanted it to be. I'm looking into whether it's my own implementation (though I followed all the recommended best practices quite closely), or an issue with Persona itself. EDIT: It's a known issue with Persona and third party cookies: https://github.com/mozilla/browserid/issues/1352 https://github.com/mozilla/browserid/issues/1352 Unfortunately, this is a situation where a lot of people on HN probably disable third party cookies (though perhaps a larger percentage of HN readers already have Persona accounts?). Anyway, I'm looking into rolling out my own authentication with email/password soon.
- rogerbinns 14y ago
  I'd like to try it without logging in at all. The first question everyone will have is if it works on their own site or a site they are familiar with and to see the results. Having to create accounts/login just impedes that process.
  - shantanubala 14y ago
    I understand -- there's a bit of a problem when trying to prevent abuse, though, and relying on the Persona identity provider makes it easier to prevent abusive behavior upfront, especially since the conversions themselves consume a lot of resources. I'm still working out the optimal solution, but thanks for the feedback!
    - rogerbinns 14y ago
      In what way does Persona prevent abuse? All you validate is email receipt which can be trivially fudged using mailinator. It is far better to deal with this sort of thing at the "transaction" level - eg use a captcha or similar for the second and subsequent conversions from a particular IP address.
      - shantanubala 14y ago
        It's just a rough barrier before I set up something a little better, though I already have logging at the transaction level set up. Even using Mailinator requires a little bit of work, so I figured Persona was a good starting point -- I'll look into adding a "try it out" area on the home page that doesn't require you to sign up though.

I tried logging in -- persona sent me email of confirmation, when clicked it redirected to ebookglue which alerted 'login attempt failed'. you might want to look into that.

shantanubala 14y ago

I'm sorry about the trouble with Persona -- many people have been reporting issues, and it's unfortunately not been as stable as I would have wanted it to be. I'm looking into whether it's my own implementation (though I followed all the recommended best practices quite closely), or an issue with Persona itself. EDIT: It's a known issue with Persona and third party cookies: https://github.com/mozilla/browserid/issues/1352 https://github.com/mozilla/browserid/issues/1352 Unfortunately, this is a situation where a lot of people on HN probably disable third party cookies (though perhaps a larger percentage of HN readers already have Persona accounts?). Anyway, I'm looking into rolling out my own authentication with email/password soon.

rogerbinns 14y ago
I'd like to try it without logging in at all. The first question everyone will have is if it works on their own site or a site they are familiar with and to see the results. Having to create accounts/login just impedes that process.
- shantanubala 14y ago
  I understand -- there's a bit of a problem when trying to prevent abuse, though, and relying on the Persona identity provider makes it easier to prevent abusive behavior upfront, especially since the conversions themselves consume a lot of resources. I'm still working out the optimal solution, but thanks for the feedback!
  - rogerbinns 14y ago
    In what way does Persona prevent abuse? All you validate is email receipt which can be trivially fudged using mailinator. It is far better to deal with this sort of thing at the "transaction" level - eg use a captcha or similar for the second and subsequent conversions from a particular IP address.
    - shantanubala 14y ago
      It's just a rough barrier before I set up something a little better, though I already have logging at the transaction level set up. Even using Mailinator requires a little bit of work, so I figured Persona was a good starting point -- I'll look into adding a "try it out" area on the home page that doesn't require you to sign up though.