5 ms·

So what happens when my Person account gets compromised? I'll stick to my many accounts / many passwords approach, I think.

kn8 13y ago
Use 2 factor auth to mitigate that? To me that seems safer than having 100s of different accounts with no support for 2 auth.
- lotsofcows 13y ago
  2FA is a nice add one but not a panacea. Any account will be compromised - it's only a matter of time. When that happens, it's best (as recent articles in Wired, Ars Technica and others demonstrate) to have a broad account "ecosystem".
  - kn8 13y ago
    Hm, interesting. I see your point. What about Facebook/Google/Twitter Sign In buttons - do you think Persona is an improvement over those?
    - jol 13y ago
      technically - yes, it frees me from being part of (google/fb/twitter... whatever network is trendy now) and still sign in, practically,at the present moment, no - only geeks know about it Edit/update: if compromised, you loose all linked accounts, however, with google/fb/.... it is the same, but this is less leaky to 3rd party, if this comes as default login, then we would have only a dozen of logins (persona/email, + important accounts, e.g. banking something similar... ), not ~100 of them, thus resetting 100 passwords is just 1 action
icebraining 13y ago
What happens when your email account gets compromised and the attacker uses the "forgot my password" feature on each site? If you say you use multiple email accounts, then you can also use multiple Persona accounts. In fact, support for multiple accounts is part of the plan.
- lotsofcows 13y ago
  Like any sensible person, all my security question answers are of the "Correct Horse Battery Staple" type. I don't see how introducing a single untrusted third party, many accounts or otherwise, is better than using a couple of trusted third parties such as gmail and hotmail.
  - icebraining 13y ago
    The goal of Persona is that you should be able to use Hotmail and Gmail as your trusted identity provider; the current system is just a stopgap until there's more support from providers.
zobzu 13y ago
you can have multiple personna accounts if you want to separate accounts assertions. i actually don't think this argument holds water. it's the same with any auth system. you can use 2FA, etc. in the end if someone compromise your laptop you're screwed, they get all the passwords/assertions anyway. They can't make assertions from the server side.
1stop 13y ago
What happens if someone picks my lock. I think I'll stick with my 20 doors with 20 locks.

kn8 13y ago

Use 2 factor auth to mitigate that? To me that seems safer than having 100s of different accounts with no support for 2 auth.

lotsofcows 13y ago
2FA is a nice add one but not a panacea. Any account will be compromised - it's only a matter of time. When that happens, it's best (as recent articles in Wired, Ars Technica and others demonstrate) to have a broad account "ecosystem".
- kn8 13y ago
  Hm, interesting. I see your point. What about Facebook/Google/Twitter Sign In buttons - do you think Persona is an improvement over those?
  - jol 13y ago
    technically - yes, it frees me from being part of (google/fb/twitter... whatever network is trendy now) and still sign in, practically,at the present moment, no - only geeks know about it Edit/update: if compromised, you loose all linked accounts, however, with google/fb/.... it is the same, but this is less leaky to 3rd party, if this comes as default login, then we would have only a dozen of logins (persona/email, + important accounts, e.g. banking something similar... ), not ~100 of them, thus resetting 100 passwords is just 1 action

icebraining 13y ago

What happens when your email account gets compromised and the attacker uses the "forgot my password" feature on each site? If you say you use multiple email accounts, then you can also use multiple Persona accounts. In fact, support for multiple accounts is part of the plan.

lotsofcows 13y ago
Like any sensible person, all my security question answers are of the "Correct Horse Battery Staple" type. I don't see how introducing a single untrusted third party, many accounts or otherwise, is better than using a couple of trusted third parties such as gmail and hotmail.
- icebraining 13y ago
  The goal of Persona is that you should be able to use Hotmail and Gmail as your trusted identity provider; the current system is just a stopgap until there's more support from providers.

zobzu 13y ago

you can have multiple personna accounts if you want to separate accounts assertions. i actually don't think this argument holds water. it's the same with any auth system. you can use 2FA, etc. in the end if someone compromise your laptop you're screwed, they get all the passwords/assertions anyway. They can't make assertions from the server side.

1stop 13y ago

What happens if someone picks my lock. I think I'll stick with my 20 doors with 20 locks.