4 ms·

I still have a funny feeling about the robustness of Persona. For instance - let's say one of my emails gets hacked, my crappy Yahoo email. Does that give the

I still have a funny feeling about the robustness of Persona. For instance - let's say one of my emails gets hacked, my crappy Yahoo email. Does that give them access to my other Persona accounts? Would I (or anyone else) be able to know if the account is compromised? Normally you change your password and that's the end of it, but I'm not sure what happens with Persona. What if my kid brother uses my computer - wouldn't he have access to any site that allows Persona logins? How do you lock it down?

StavrosK 14y ago
> Does that give them access to my other Persona accounts? No, it gives them access to whatever site you registered with your Yahoo! account. (EDIT: If you use the temporary bridge they implement, they could get access to your other accounts if they got access to the bridge. This won't happen if your email provider supports Persona natively). > Would I (or anyone else) be able to know if the account is compromised? Yahoo! probably would, and could tell you. > Normally you change your password and that's the end of it, but I'm not sure what happens with Persona. You change your password and that's the end of it. > What if my kid brother uses my computer - wouldn't he have access to any site that allows Persona logins? How do you lock it down? Just log out of your email provider. Really, Persona is just a way to make your email provider your authenticator. It's "Facebook Connect" for your email provider. Security-wise, if your email gets hacked, what happens is what would happen anyway, since almost every site can request a password reset by emailing you. The attacker has access to that anyway. Persona removes the hassle of remembering one password per account by letting the site ask your email provider if they know you.
- lubujackson 14y ago
  Ah, thanks for those answers.
  - StavrosK 14y ago
    You are very welcome!
- jessaustin 14y ago
  Just log out of your email provider. Really? Is this enough? Elsewhere in this discussion, mention is made of delegating to a different Persona provider. How will your browser (which, near as I can tell, is directing traffic for this protocol, either natively or through an extension) know that clicking "log out" on an email app should make it stop using certs associated with a different Persona app? Even if it were the same provider, perhaps under a different subdomain, this link between email app and everything else seems pretty tenuous. I think there should be an obvious switch to throw in the browser. Perhaps I'm really misunderstanding things; please advise.
  - StavrosK 14y ago
    It's the same as Facebook Connect. Logging out of Facebook doesn't log you out of all the connected sites, but it does prevent you from logging in to others, which is what the GP was asking.
    - jessaustin 14y ago
      That is not my interpretation of the original question, but thanks for clarifying. This discussion points to a potential for a sort of confusion we've seen before. It used to be a big user education problem to get all users to press the "log out" button when they were done using a site, especially on "public" computers. To some people maybe this is still a problem? (Actually, before that it was a bit of a struggle getting sites to implement "log out" functionality, and we just had session cookies multiplying everywhere.) If my browser has stored Persona certs associated with various sites but gives me no visual indication of that, it's very possible that I might become confused about where and whether I'm logged in. The various sites to which I'm logged in might have different requirements for auto-logout, etc. It seems that Persona is trying to ignore these issues a bit by saying "this is just for low-value authentication", but fixing the problem seems possible. Incorporating Persona functionality into the browser should allow better security notifications than are possible just through HTML/JS/CSS from individual sites. The user should have the option to easily throw away certs (i.e. without clicking through a bunch of "Settings" dialogs), and should have the information she needs to know when to do that.

StavrosK 14y ago

> Does that give them access to my other Persona accounts? No, it gives them access to whatever site you registered with your Yahoo! account. (EDIT: If you use the temporary bridge they implement, they could get access to your other accounts if they got access to the bridge. This won't happen if your email provider supports Persona natively). > Would I (or anyone else) be able to know if the account is compromised? Yahoo! probably would, and could tell you. > Normally you change your password and that's the end of it, but I'm not sure what happens with Persona. You change your password and that's the end of it. > What if my kid brother uses my computer - wouldn't he have access to any site that allows Persona logins? How do you lock it down? Just log out of your email provider. Really, Persona is just a way to make your email provider your authenticator. It's "Facebook Connect" for your email provider. Security-wise, if your email gets hacked, what happens is what would happen anyway, since almost every site can request a password reset by emailing you. The attacker has access to that anyway. Persona removes the hassle of remembering one password per account by letting the site ask your email provider if they know you.

lubujackson 14y ago
Ah, thanks for those answers.
- StavrosK 14y ago
  You are very welcome!
jessaustin 14y ago
Just log out of your email provider. Really? Is this enough? Elsewhere in this discussion, mention is made of delegating to a different Persona provider. How will your browser (which, near as I can tell, is directing traffic for this protocol, either natively or through an extension) know that clicking "log out" on an email app should make it stop using certs associated with a different Persona app? Even if it were the same provider, perhaps under a different subdomain, this link between email app and everything else seems pretty tenuous. I think there should be an obvious switch to throw in the browser. Perhaps I'm really misunderstanding things; please advise.
- StavrosK 14y ago
  It's the same as Facebook Connect. Logging out of Facebook doesn't log you out of all the connected sites, but it does prevent you from logging in to others, which is what the GP was asking.
  - jessaustin 14y ago
    That is not my interpretation of the original question, but thanks for clarifying. This discussion points to a potential for a sort of confusion we've seen before. It used to be a big user education problem to get all users to press the "log out" button when they were done using a site, especially on "public" computers. To some people maybe this is still a problem? (Actually, before that it was a bit of a struggle getting sites to implement "log out" functionality, and we just had session cookies multiplying everywhere.) If my browser has stored Persona certs associated with various sites but gives me no visual indication of that, it's very possible that I might become confused about where and whether I'm logged in. The various sites to which I'm logged in might have different requirements for auto-logout, etc. It seems that Persona is trying to ignore these issues a bit by saying "this is just for low-value authentication", but fixing the problem seems possible. Incorporating Persona functionality into the browser should allow better security notifications than are possible just through HTML/JS/CSS from individual sites. The user should have the option to easily throw away certs (i.e. without clicking through a bunch of "Settings" dialogs), and should have the information she needs to know when to do that.