3 ms·

>> type in email, login to yahoo... Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being

>> type in email, login to yahoo... Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman? Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

ozten 14y ago
> Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman? Nope. Architectures like OpenID "phone home" and report your movement across the web. Persona was explicitly designed to be privacy preserving. > Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then? Yes, if an attacker has your yahoo email address and password, they can log in as you. BUT, you can take advantage of two factor auth from Yahoo as well as other security features they provide, to keep yourself safe.
badida 14y ago
No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona. However, if you use the "login with Yahoo" button (or Google or Facebook), then yes, they can track all of your activity. To your second point: great question! No, the attacker cannot. We still protect your other email addresses with a Persona password.
- badida 14y ago
  Oh wait, I misread your point. Yes, the attacker can log into all Persona web sites if they know your Yahoo password. But that's the way the cookie crumbles with federated identity. It's the same thing if you pick a Yahoo email address as your recovery email. Pick your identity providers wisely!
- human_error 14y ago
  > Yahoo only knows that you're using your Yahoo identity with Persona But Yahoo still knows that I'm on that website.
  - ozten 14y ago
    How?
city41 14y ago
Email accounts are almost everyone's achilles. Even without Persona, the attacker could still go around to websites and request password resets if they have access to your email.
megaman821 14y ago
Isn't the second question equivalent to what we have now? If an attacker knows my Yahoo password, can he potentially reset all the passwords of sites I registered with using my Yahoo email address and login to them.
- ozten 14y ago
  Great point. Previously discussed on HN, but this story paints the picture of the world we're already living in http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...

ozten 14y ago

> Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman? Nope. Architectures like OpenID "phone home" and report your movement across the web. Persona was explicitly designed to be privacy preserving. > Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then? Yes, if an attacker has your yahoo email address and password, they can log in as you. BUT, you can take advantage of two factor auth from Yahoo as well as other security features they provide, to keep yourself safe.

badida 14y ago

No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona. However, if you use the "login with Yahoo" button (or Google or Facebook), then yes, they can track all of your activity. To your second point: great question! No, the attacker cannot. We still protect your other email addresses with a Persona password.

badida 14y ago
Oh wait, I misread your point. Yes, the attacker can log into all Persona web sites if they know your Yahoo password. But that's the way the cookie crumbles with federated identity. It's the same thing if you pick a Yahoo email address as your recovery email. Pick your identity providers wisely!
human_error 14y ago
> Yahoo only knows that you're using your Yahoo identity with Persona But Yahoo still knows that I'm on that website.
- ozten 14y ago
  How?

city41 14y ago

Email accounts are almost everyone's achilles. Even without Persona, the attacker could still go around to websites and request password resets if they have access to your email.

megaman821 14y ago

Isn't the second question equivalent to what we have now? If an attacker knows my Yahoo password, can he potentially reset all the passwords of sites I registered with using my Yahoo email address and login to them.

ozten 14y ago
Great point. Previously discussed on HN, but this story paints the picture of the world we're already living in http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...