18 ms·

In the spirit of helping out my fellow developers at Mozilla, who I respect a lot, I would like to add one additional cause of failure, in the knowledge that it

by patio11 13y ago

In the spirit of helping out my fellow developers at Mozilla, who I respect a lot, I would like to add one additional cause of failure, in the knowledge that it is a bit bracing but is really important and should inform project selection in the future: Persona fails to solve a problem which either end-users or people who operate websites for profit actually have.

_delirium 13y ago
Perhaps not enough people who operate websites for profit, but there are a reasonable number of us working on PaaS/SaaS products where using Facebook Connect is out of the question because of data-protection laws, which does leave a pain-point around user management. The current gold standard is "roll your own", but Persona is an interesting alternative. Why aren't people using it even in that sphere? One issue is that it's precisely when you need to take advantage of the federated aspect that the win on up-front effort is weakened. By the time you're setting up your own in-house Persona server rather than using Mozilla's, you're probably at the point where it's less effort to just use some crappy off-the-shelf account-management system that comes as a CMS plugin. This might be counteracted if using Persona improved conversion, but that's a chicken-and-egg problem as long as users don't recognize Persona. The other bit imo is that the security downsides of roll-your-own are a bit of an unpriced externality. If you have a password breach, it's bad PR for a bit, but legal liability around it is relatively toothless: data-protection laws seem not to care about mere incompetence in keeping users' data private. Make your users pick passwords with at least 2 digits and 2 non-digit characters and you've "done your part". So rolling your own crappy login system doesn't have as big a downside for you the provider as for your users. The users, for their part, are oblivious to the risk before the fact, and lack serious legal recourse after the fact, so they'll go along with your crappy in-house signup system, and shoulder the risk.
- StavrosK 13y ago
  Are you talking about a login mechanism to a site, or about authenticating yourself to other sites? I don't understand what "roll your own" is referring to.
bad_user 13y ago
For end-users it solves the same problem that Facebook Connect solves - an end-user doesn't have to remember a username and password for each account he has. And when creating an account on a website with Persona, the email is already verified if that user already has a Persona account, so the user doesn't have to go though the email verification process again. This lowers friction and increases conversions.
- kleiba 13y ago
  For end-users it solves the same problem that Facebook Connect solves - an end-user doesn't have to remember a username and password for each account he has. Let's not forget that for a vast amount of people, this just means remembering a single username+password.
- saurik 13y ago
  Facebook Connect offers other advantages to Persona that have nothing to do directly with login: you get a profile picture, a name, and a gender. You get this same information from other value-added login providers, such as Google. This dramatically cuts down on the complexity of a sign-in process for both the user and the website. You additionally have fairly rapid access to a social ecosystem (which I realize not everyone wants; I have personally never taken advantage of this on my site), and can start doing things like "friends of yours did this thing". This means that Facebook Connect is something a website might use even if they consider login to be a non-problem (and I think patio11's point is that login is largely a non-problem). Even just for login, though: Persona doesn't solve this problem as well as Facebook Connect (from either the perspective of the site administrator or the user) as it assumes email addresses are canonical and unchanging, which is not true for normal users (who tend to change email addresses occasionally to get rid of spam or old contacts they no longer like; they also often get their email addresses only temporarily from schools, employers, and network providers). Please understand: I have had the same email address since the late 90s, and likely most people reading HN care about canonical identifiers, realize the security issues involved with losing their email accounts, and often have business reasons to not lose access to old contacts--we are not "normal people". With Facebook Connect the user normally cares more about their account (people change Facebook accounts much less often than email addresses), and when their email address changes they can update it on Facebook without bothering the site they are using. (I run a site that uses only external login providers, either Facebook or Google, and the users who log in using Google often contact me saying they changed their email address and now can't log in to my site anymore as they had to make a new Google account. I frankly only offer Google because some people hate the very idea of Facebook.) This undermines one of the major advantages of using third-party authentication providers. For site administrators, it means you still need some way to identify and authorize accounts separate from Persona (so as to know the user contacting you, who no longer had access to their old email address, is really the user they claim to be), and for the user it means they still have to find all the websites they have previously logged into in order to correct their email address, and they must do so manually and painfully (potentially talking to a customer support representative). If all Persona did was "email verification" that might actually be kind of awesome, and then have that tied to an existing login system (maybe one involving a username and a password) provided by the site (or even by a third-party), but it ends up being sufficiently intrusive to the flow that it just doesn't feel right to use it and another login mechanism, which means that these killer "email changed, don't have access to old e-mail address" issues become entrenched. That also isn't how Persona was marketing itself, so no one seems to think to use it that way (leading to the "it doesn't seem to better solve a problem I really have" issue). (I have written more about this subject in the past, with at least a small amount more detail on some of the other problems that can arise with relation to email accounts provided for temporary use, such as by the aforementioned schools, employers, and network providers; the short version, though, is that email addresses often get reassigned, which makes the entire idea of using an email address as the basis of what is supposed to be a widespread secure login mechanism insane. OpenID has tons of its own adoption issues, but at least it required providers to never reuse their identifiers between different people, and provided a simple way to allow that to be possible... I mean, even Yahoo and Hotmail expire and recycle accounts, so this is a serious problem.) https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4605507 https://news.ycombinator.com/item?id=4605507
return0 13y ago
Maybe you don't but me and many other developers have it.
edanm 13y ago
Spot on. Developers/tech savvy people have hundreds of passwords for all their services. The serious ones use Keepass or similar to store the passwords, and don't have a problem. The "normal" computer user does not have hundreds of passwords. They have a few. And they give them all the same password, or similar enough. They don't have a problem remembering them, because they're simple, easy-to-remember passwords (e.g. that can be cracked). Is this a good situation? No. But people don't know it. And implementing a whole new system to solve a problem that most people don't know about is simply not going to help.
workhere-io 13y ago
Persona fails to solve a problem which either end-users or people who operate websites for profit actually have. I disagree. The end user benefits from being able to quickly sign up to a service without having to validate his/her email address. The developers benefit from not having to store passwords.
- zanny 13y ago
  The point is that the developers that would give Persona visibility in the broader market are the kind that don't care to invest the time to make an (albeit usually insecure) password database. Big sites aren't using Persona and apparently that is why Mozilla sees it as a failure.
- tel 13y ago
  And Facebook connect already provides that.
  - workhere-io 13y ago
    Sure, but Facebook has a number of problems as a general-purpose login mechanism: A. Not everyone has an FB account. B. Those that do don't always trust that logging in with FB won't mean that the website they're logging in to will spam their wall.
    - e12e 13y ago
      C Self-hosting it would be problematic, if/when using FB isn't an option
  - quadrangle 13y ago
    And Persona says: "how can we get Facebook connect without requiring Facebook and without any privacy problems?"
    - DannyBee 13y ago
      But sites apparently don't care about this enough to want it, and users apparently don't care enough to demand it. So how does it solve a problem these sites actually have? Some small percentage of end users have this problem (the ones demanding a solution to privacy problems), but the rest don't think it's a problem, apparently. (Surveys up the wazoo that show that people care about whatever mean nothing when people don't actually change their behavior)
Pacabel 13y ago
This is just another symptom of what I think is a prolonged stagnation at Mozilla. I suspect they've lost touch with the needs of their users a lot of the time. Firefox hasn't been in a good place lately. Most of the changes since Firefox 4 haven't been to the users' benefit. It's like these changes have been more about imitating Chrome, regardless of whether or not this is good for Firefox's users. Yet Chrome is still superior where it really matters, such as performance and resource usage. If Firefox users are just going to get a Chrome-like experience these days, but not as good as that offered by actual Chrome, then they might as well just move to Chrome. And I think that's exactly what we've seen, and why Firefox' usage numbers are dropping. We see the same with Firefox Mobile. It really isn't superior to the alternative browsers in any way. In many ways it's significantly inferior. There's really nothing to pull users to it. Thunderbird was perhaps their second most useful product, after Firefox. Yet they've basically given up on it now. I know I've migrated to another email client, and many others have chosen to do the same, too, now that Thunderbird doesn't really improve over time. Even then, the changes we've seen lately have been more harmful than good. The UI is less usable now than it was in earlier release, for instance. Firefox OS is another example. It really doesn't offer anything tangible over Android, iOS, or the many other mobile OSes that already exist and already widely available on many devices. In fact, it offers a very limited development environment compared to the alternatives, which surely doesn't help its case. The only reasons I've heard to use it are ideological, about Mozilla somehow being "more open" or something of that sort. That's just not enough to gain real traction, I'm afraid. And Persona is yet another example. It just doesn't meet the needs of its potential users. Rust is perhaps the only interesting thing I've seen coming out of Mozilla lately. But it has taken a long time to get to where it is, and I'm not sure if it still has the momentum to have the impact that it might have had were a stable version available a year or two ago. Go, and even C++11, can now provide a lot of its benefits today, if not much earlier. I think there's been a lot of wheel-spinning at Mozilla lately, in terms of their offerings. Their successful products are being ignored or actively made worse, while their new offerings don't actually benefit a wide audience, or offer an insufficient amount of benefit. I'm not going to pretend to know how to fix these problems, but focusing on product that users actually want, and giving these users the functionality they want, may be a good start.
- 13y ago
acdha 13y ago
I could not disagree more. Most people hate having to manage passwords across many sites and using a password manager doesn't help enough. Email validation is a speed bump but a necessary one for many sites. It sounds like Persona will move in the right direction of being a really simple way to confirm an email address without other privacy implications. That seems like a great deal to me over having to maintain and de-dupe huge lists of passwords in every device / browser you use.
jdlshore 13y ago
Sorry, this isn't true. As someone who operates a website for profit [1], Persona solved a huge problem for me: not having to waste time on implementing, maintaining, and securing an authentication management solution. That's huge. [1] http://www.letscodejavascript.com http://www.letscodejavascript.com is profitable enough to support me full-time.

by patio11 13y ago

_delirium 13y ago

Perhaps not enough people who operate websites for profit, but there are a reasonable number of us working on PaaS/SaaS products where using Facebook Connect is out of the question because of data-protection laws, which does leave a pain-point around user management. The current gold standard is "roll your own", but Persona is an interesting alternative. Why aren't people using it even in that sphere? One issue is that it's precisely when you need to take advantage of the federated aspect that the win on up-front effort is weakened. By the time you're setting up your own in-house Persona server rather than using Mozilla's, you're probably at the point where it's less effort to just use some crappy off-the-shelf account-management system that comes as a CMS plugin. This might be counteracted if using Persona improved conversion, but that's a chicken-and-egg problem as long as users don't recognize Persona. The other bit imo is that the security downsides of roll-your-own are a bit of an unpriced externality. If you have a password breach, it's bad PR for a bit, but legal liability around it is relatively toothless: data-protection laws seem not to care about mere incompetence in keeping users' data private. Make your users pick passwords with at least 2 digits and 2 non-digit characters and you've "done your part". So rolling your own crappy login system doesn't have as big a downside for you the provider as for your users. The users, for their part, are oblivious to the risk before the fact, and lack serious legal recourse after the fact, so they'll go along with your crappy in-house signup system, and shoulder the risk.

StavrosK 13y ago
Are you talking about a login mechanism to a site, or about authenticating yourself to other sites? I don't understand what "roll your own" is referring to.

bad_user 13y ago

For end-users it solves the same problem that Facebook Connect solves - an end-user doesn't have to remember a username and password for each account he has. And when creating an account on a website with Persona, the email is already verified if that user already has a Persona account, so the user doesn't have to go though the email verification process again. This lowers friction and increases conversions.

kleiba 13y ago
For end-users it solves the same problem that Facebook Connect solves - an end-user doesn't have to remember a username and password for each account he has. Let's not forget that for a vast amount of people, this just means remembering a single username+password.
saurik 13y ago
Facebook Connect offers other advantages to Persona that have nothing to do directly with login: you get a profile picture, a name, and a gender. You get this same information from other value-added login providers, such as Google. This dramatically cuts down on the complexity of a sign-in process for both the user and the website. You additionally have fairly rapid access to a social ecosystem (which I realize not everyone wants; I have personally never taken advantage of this on my site), and can start doing things like "friends of yours did this thing". This means that Facebook Connect is something a website might use even if they consider login to be a non-problem (and I think patio11's point is that login is largely a non-problem). Even just for login, though: Persona doesn't solve this problem as well as Facebook Connect (from either the perspective of the site administrator or the user) as it assumes email addresses are canonical and unchanging, which is not true for normal users (who tend to change email addresses occasionally to get rid of spam or old contacts they no longer like; they also often get their email addresses only temporarily from schools, employers, and network providers). Please understand: I have had the same email address since the late 90s, and likely most people reading HN care about canonical identifiers, realize the security issues involved with losing their email accounts, and often have business reasons to not lose access to old contacts--we are not "normal people". With Facebook Connect the user normally cares more about their account (people change Facebook accounts much less often than email addresses), and when their email address changes they can update it on Facebook without bothering the site they are using. (I run a site that uses only external login providers, either Facebook or Google, and the users who log in using Google often contact me saying they changed their email address and now can't log in to my site anymore as they had to make a new Google account. I frankly only offer Google because some people hate the very idea of Facebook.) This undermines one of the major advantages of using third-party authentication providers. For site administrators, it means you still need some way to identify and authorize accounts separate from Persona (so as to know the user contacting you, who no longer had access to their old email address, is really the user they claim to be), and for the user it means they still have to find all the websites they have previously logged into in order to correct their email address, and they must do so manually and painfully (potentially talking to a customer support representative). If all Persona did was "email verification" that might actually be kind of awesome, and then have that tied to an existing login system (maybe one involving a username and a password) provided by the site (or even by a third-party), but it ends up being sufficiently intrusive to the flow that it just doesn't feel right to use it and another login mechanism, which means that these killer "email changed, don't have access to old e-mail address" issues become entrenched. That also isn't how Persona was marketing itself, so no one seems to think to use it that way (leading to the "it doesn't seem to better solve a problem I really have" issue). (I have written more about this subject in the past, with at least a small amount more detail on some of the other problems that can arise with relation to email accounts provided for temporary use, such as by the aforementioned schools, employers, and network providers; the short version, though, is that email addresses often get reassigned, which makes the entire idea of using an email address as the basis of what is supposed to be a widespread secure login mechanism insane. OpenID has tons of its own adoption issues, but at least it required providers to never reuse their identifiers between different people, and provided a simple way to allow that to be possible... I mean, even Yahoo and Hotmail expire and recycle accounts, so this is a serious problem.) https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4605507 https://news.ycombinator.com/item?id=4605507

return0 13y ago

Maybe you don't but me and many other developers have it.

edanm 13y ago

Spot on. Developers/tech savvy people have hundreds of passwords for all their services. The serious ones use Keepass or similar to store the passwords, and don't have a problem. The "normal" computer user does not have hundreds of passwords. They have a few. And they give them all the same password, or similar enough. They don't have a problem remembering them, because they're simple, easy-to-remember passwords (e.g. that can be cracked). Is this a good situation? No. But people don't know it. And implementing a whole new system to solve a problem that most people don't know about is simply not going to help.

workhere-io 13y ago

Persona fails to solve a problem which either end-users or people who operate websites for profit actually have. I disagree. The end user benefits from being able to quickly sign up to a service without having to validate his/her email address. The developers benefit from not having to store passwords.

zanny 13y ago
The point is that the developers that would give Persona visibility in the broader market are the kind that don't care to invest the time to make an (albeit usually insecure) password database. Big sites aren't using Persona and apparently that is why Mozilla sees it as a failure.
tel 13y ago
And Facebook connect already provides that.
- workhere-io 13y ago
  Sure, but Facebook has a number of problems as a general-purpose login mechanism: A. Not everyone has an FB account. B. Those that do don't always trust that logging in with FB won't mean that the website they're logging in to will spam their wall.
  - e12e 13y ago
    C Self-hosting it would be problematic, if/when using FB isn't an option
- quadrangle 13y ago
  And Persona says: "how can we get Facebook connect without requiring Facebook and without any privacy problems?"
  - DannyBee 13y ago
    But sites apparently don't care about this enough to want it, and users apparently don't care enough to demand it. So how does it solve a problem these sites actually have? Some small percentage of end users have this problem (the ones demanding a solution to privacy problems), but the rest don't think it's a problem, apparently. (Surveys up the wazoo that show that people care about whatever mean nothing when people don't actually change their behavior)

Pacabel 13y ago

This is just another symptom of what I think is a prolonged stagnation at Mozilla. I suspect they've lost touch with the needs of their users a lot of the time. Firefox hasn't been in a good place lately. Most of the changes since Firefox 4 haven't been to the users' benefit. It's like these changes have been more about imitating Chrome, regardless of whether or not this is good for Firefox's users. Yet Chrome is still superior where it really matters, such as performance and resource usage. If Firefox users are just going to get a Chrome-like experience these days, but not as good as that offered by actual Chrome, then they might as well just move to Chrome. And I think that's exactly what we've seen, and why Firefox' usage numbers are dropping. We see the same with Firefox Mobile. It really isn't superior to the alternative browsers in any way. In many ways it's significantly inferior. There's really nothing to pull users to it. Thunderbird was perhaps their second most useful product, after Firefox. Yet they've basically given up on it now. I know I've migrated to another email client, and many others have chosen to do the same, too, now that Thunderbird doesn't really improve over time. Even then, the changes we've seen lately have been more harmful than good. The UI is less usable now than it was in earlier release, for instance. Firefox OS is another example. It really doesn't offer anything tangible over Android, iOS, or the many other mobile OSes that already exist and already widely available on many devices. In fact, it offers a very limited development environment compared to the alternatives, which surely doesn't help its case. The only reasons I've heard to use it are ideological, about Mozilla somehow being "more open" or something of that sort. That's just not enough to gain real traction, I'm afraid. And Persona is yet another example. It just doesn't meet the needs of its potential users. Rust is perhaps the only interesting thing I've seen coming out of Mozilla lately. But it has taken a long time to get to where it is, and I'm not sure if it still has the momentum to have the impact that it might have had were a stable version available a year or two ago. Go, and even C++11, can now provide a lot of its benefits today, if not much earlier. I think there's been a lot of wheel-spinning at Mozilla lately, in terms of their offerings. Their successful products are being ignored or actively made worse, while their new offerings don't actually benefit a wide audience, or offer an insufficient amount of benefit. I'm not going to pretend to know how to fix these problems, but focusing on product that users actually want, and giving these users the functionality they want, may be a good start.

13y ago

acdha 13y ago

I could not disagree more. Most people hate having to manage passwords across many sites and using a password manager doesn't help enough. Email validation is a speed bump but a necessary one for many sites. It sounds like Persona will move in the right direction of being a really simple way to confirm an email address without other privacy implications. That seems like a great deal to me over having to maintain and de-dupe huge lists of passwords in every device / browser you use.

jdlshore 13y ago

Sorry, this isn't true. As someone who operates a website for profit [1], Persona solved a huge problem for me: not having to waste time on implementing, maintaining, and securing an authentication management solution. That's huge. [1] http://www.letscodejavascript.com http://www.letscodejavascript.com is profitable enough to support me full-time.