4 ms·

I don't understand how this is an advantage over just using email address as username with a password, like many sites do already. Can someone please explain th

I don't understand how this is an advantage over just using email address as username with a password, like many sites do already. Can someone please explain the benefit? [Edit: message to user Anonymous09, who replied to me below - you appear to have been hellbanned since the past three weeks. Thought you ought to know.]

whatshisface 14y ago
If I knew your email, I could make an account on a website in your name without you knowing.
- yjyft846jh 14y ago
  I don't see how that would cause a problem. If the website ever sent an email to me, I would know about it and just be able to do password recovery and delete the account. If the website never sends an email, it's of no inconvenience to me. In that case is this not just functionally equivalent to sending a validation email upon account creation, as many sites do already?
- gcr 14y ago
  Why? If you know his email, then the website's confirmation link will still go to his inbox. If you know his email and password, then Persona wouldn't help anyway.
Anonymous09 14y ago
From what I understand, the idea is that you sign in with any Persona provider. For example, let's say gmail, hotmail, yahoo, ycombinator, microsoft, all have user e-mail addresses and they set themselves up as a provider (anyone can do this). This means, I go and create ABCforum.com and it has a login with Persona button. My users can now login using their gmail, hotmail, yahoo, ycombinator, microsoft, etc e-mail addresses. So the difference. 1 (Without Persona). You create an account on ABCforum.com with my-name@gmail.com as your username, and make up a random password. This is another account you always have to remember, and the password can be viewed by the developer behind ABCforum.com since it's stored in their database (which could also be hacked in the future). You get a verification e-mail sent to you, so ABCforum.com can confirm you own that e-mail. 2 (With Persona). You click login with Persona, and enter your gmail e-mail and password, which Google verifies belongs to you. There's no creating an account. The provider (in this case Google Gmail) is confirming your e-mail and password, and not the site you're signing into (ABCforum.com).
badida 14y ago
Every time you create an account at a new site, you're opening up a way to get hacked. Because, like most humans, you probably reuse passwords, or at least have password similarities. And many web sites tend not to have the resources to properly secure their user database. So, accounts on every new site you visit is both inconvenient and slowly degrades your security. You could switch to centralized identity silos, logging in with Facebook or Google everywhere you go. Now you've got the problem that these big companies are tracking your every move, enforcing "real-name" policies forcing you to unify all of your web activity into one account, etc. Persona is the best of both worlds: convenience and reduced security exposure, plus your choice of identity wherever you go with much better privacy.
- yjyft846jh 14y ago
  Very clear explanation, thanks!

whatshisface 14y ago

If I knew your email, I could make an account on a website in your name without you knowing.

yjyft846jh 14y ago
I don't see how that would cause a problem. If the website ever sent an email to me, I would know about it and just be able to do password recovery and delete the account. If the website never sends an email, it's of no inconvenience to me. In that case is this not just functionally equivalent to sending a validation email upon account creation, as many sites do already?
gcr 14y ago
Why? If you know his email, then the website's confirmation link will still go to his inbox. If you know his email and password, then Persona wouldn't help anyway.

Anonymous09 14y ago

From what I understand, the idea is that you sign in with any Persona provider. For example, let's say gmail, hotmail, yahoo, ycombinator, microsoft, all have user e-mail addresses and they set themselves up as a provider (anyone can do this). This means, I go and create ABCforum.com and it has a login with Persona button. My users can now login using their gmail, hotmail, yahoo, ycombinator, microsoft, etc e-mail addresses. So the difference. 1 (Without Persona). You create an account on ABCforum.com with my-name@gmail.com as your username, and make up a random password. This is another account you always have to remember, and the password can be viewed by the developer behind ABCforum.com since it's stored in their database (which could also be hacked in the future). You get a verification e-mail sent to you, so ABCforum.com can confirm you own that e-mail. 2 (With Persona). You click login with Persona, and enter your gmail e-mail and password, which Google verifies belongs to you. There's no creating an account. The provider (in this case Google Gmail) is confirming your e-mail and password, and not the site you're signing into (ABCforum.com).

badida 14y ago

Every time you create an account at a new site, you're opening up a way to get hacked. Because, like most humans, you probably reuse passwords, or at least have password similarities. And many web sites tend not to have the resources to properly secure their user database. So, accounts on every new site you visit is both inconvenient and slowly degrades your security. You could switch to centralized identity silos, logging in with Facebook or Google everywhere you go. Now you've got the problem that these big companies are tracking your every move, enforcing "real-name" policies forcing you to unify all of your web activity into one account, etc. Persona is the best of both worlds: convenience and reduced security exposure, plus your choice of identity wherever you go with much better privacy.

yjyft846jh 14y ago
Very clear explanation, thanks!