4 ms·

For end-users it solves the same problem that Facebook Connect solves - an end-user doesn't have to remember a username and password for each account he has. An

For end-users it solves the same problem that Facebook Connect solves - an end-user doesn't have to remember a username and password for each account he has. And when creating an account on a website with Persona, the email is already verified if that user already has a Persona account, so the user doesn't have to go though the email verification process again. This lowers friction and increases conversions.

kleiba 13y ago
For end-users it solves the same problem that Facebook Connect solves - an end-user doesn't have to remember a username and password for each account he has. Let's not forget that for a vast amount of people, this just means remembering a single username+password.
saurik 13y ago
Facebook Connect offers other advantages to Persona that have nothing to do directly with login: you get a profile picture, a name, and a gender. You get this same information from other value-added login providers, such as Google. This dramatically cuts down on the complexity of a sign-in process for both the user and the website. You additionally have fairly rapid access to a social ecosystem (which I realize not everyone wants; I have personally never taken advantage of this on my site), and can start doing things like "friends of yours did this thing". This means that Facebook Connect is something a website might use even if they consider login to be a non-problem (and I think patio11's point is that login is largely a non-problem). Even just for login, though: Persona doesn't solve this problem as well as Facebook Connect (from either the perspective of the site administrator or the user) as it assumes email addresses are canonical and unchanging, which is not true for normal users (who tend to change email addresses occasionally to get rid of spam or old contacts they no longer like; they also often get their email addresses only temporarily from schools, employers, and network providers). Please understand: I have had the same email address since the late 90s, and likely most people reading HN care about canonical identifiers, realize the security issues involved with losing their email accounts, and often have business reasons to not lose access to old contacts--we are not "normal people". With Facebook Connect the user normally cares more about their account (people change Facebook accounts much less often than email addresses), and when their email address changes they can update it on Facebook without bothering the site they are using. (I run a site that uses only external login providers, either Facebook or Google, and the users who log in using Google often contact me saying they changed their email address and now can't log in to my site anymore as they had to make a new Google account. I frankly only offer Google because some people hate the very idea of Facebook.) This undermines one of the major advantages of using third-party authentication providers. For site administrators, it means you still need some way to identify and authorize accounts separate from Persona (so as to know the user contacting you, who no longer had access to their old email address, is really the user they claim to be), and for the user it means they still have to find all the websites they have previously logged into in order to correct their email address, and they must do so manually and painfully (potentially talking to a customer support representative). If all Persona did was "email verification" that might actually be kind of awesome, and then have that tied to an existing login system (maybe one involving a username and a password) provided by the site (or even by a third-party), but it ends up being sufficiently intrusive to the flow that it just doesn't feel right to use it and another login mechanism, which means that these killer "email changed, don't have access to old e-mail address" issues become entrenched. That also isn't how Persona was marketing itself, so no one seems to think to use it that way (leading to the "it doesn't seem to better solve a problem I really have" issue). (I have written more about this subject in the past, with at least a small amount more detail on some of the other problems that can arise with relation to email accounts provided for temporary use, such as by the aforementioned schools, employers, and network providers; the short version, though, is that email addresses often get reassigned, which makes the entire idea of using an email address as the basis of what is supposed to be a widespread secure login mechanism insane. OpenID has tons of its own adoption issues, but at least it required providers to never reuse their identifiers between different people, and provided a simple way to allow that to be possible... I mean, even Yahoo and Hotmail expire and recycle accounts, so this is a serious problem.) https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4605507 https://news.ycombinator.com/item?id=4605507
- StavrosK 13y ago
  That's inaccurate. You can just have a "change your email" account setting, as usual. Persona has nothing to do with that.
  - saurik 13y ago
    OK, then a answer this question: how does the user log in to change their email address? They can't use Persona, as they already deleted their old email address. (And if you try to tell me this doesn't happen, you are wrong: this happens constantly; again, I run a site with tens of millions of users and rely on third-party login providers: I am not making these issues up. Most users don't use your site constantly, and only realize they are locked out long after they've moved on from their old email address. In fact, it would never even occur to them that this is a problem, as they are used to sites using passwords for login, which even when emails are used as the username continue to work after they delete their account.) The easy solutions I can come up with to this problem negate all the benefits of Persona past "email verification without sending an email", which is a non-problem for most people, and not how Persona is marketing itself (in particular, you can't rely on it as a login provider: you need a password or something instead). It is ludicrously irritating to have to deal with these issues manually; at least Google (which also causes this problem) offers other benefits (names, genders, profile pictures, and with G+ a list of friends to easily add social features). The other options you have are ludicrous "account recovery" flows, such as Facebook's "get five of your most trusted friends to vouch for you" mechanism, which shouldn't be needed for this all-too-common case.
    - StavrosK 13y ago
      Sure, if you delete your email address before you've changed it on the site, you're screwed, but how do you log in with Facebook/Twitter/Google after you've deleted your Facebook/Twitter/Google account? You aren't just screwed, but there's no way to change login accounts at all, even if you go around to all of your sites beforehand. Persona is better than the other centralized login systems in this respect, and is second only to username/password. Username/password can identify you after you've changed whatever you like, but it's not centralized, so we're comparing apples to oranges.

kleiba 13y ago

For end-users it solves the same problem that Facebook Connect solves - an end-user doesn't have to remember a username and password for each account he has. Let's not forget that for a vast amount of people, this just means remembering a single username+password.

saurik 13y ago

Facebook Connect offers other advantages to Persona that have nothing to do directly with login: you get a profile picture, a name, and a gender. You get this same information from other value-added login providers, such as Google. This dramatically cuts down on the complexity of a sign-in process for both the user and the website. You additionally have fairly rapid access to a social ecosystem (which I realize not everyone wants; I have personally never taken advantage of this on my site), and can start doing things like "friends of yours did this thing". This means that Facebook Connect is something a website might use even if they consider login to be a non-problem (and I think patio11's point is that login is largely a non-problem). Even just for login, though: Persona doesn't solve this problem as well as Facebook Connect (from either the perspective of the site administrator or the user) as it assumes email addresses are canonical and unchanging, which is not true for normal users (who tend to change email addresses occasionally to get rid of spam or old contacts they no longer like; they also often get their email addresses only temporarily from schools, employers, and network providers). Please understand: I have had the same email address since the late 90s, and likely most people reading HN care about canonical identifiers, realize the security issues involved with losing their email accounts, and often have business reasons to not lose access to old contacts--we are not "normal people". With Facebook Connect the user normally cares more about their account (people change Facebook accounts much less often than email addresses), and when their email address changes they can update it on Facebook without bothering the site they are using. (I run a site that uses only external login providers, either Facebook or Google, and the users who log in using Google often contact me saying they changed their email address and now can't log in to my site anymore as they had to make a new Google account. I frankly only offer Google because some people hate the very idea of Facebook.) This undermines one of the major advantages of using third-party authentication providers. For site administrators, it means you still need some way to identify and authorize accounts separate from Persona (so as to know the user contacting you, who no longer had access to their old email address, is really the user they claim to be), and for the user it means they still have to find all the websites they have previously logged into in order to correct their email address, and they must do so manually and painfully (potentially talking to a customer support representative). If all Persona did was "email verification" that might actually be kind of awesome, and then have that tied to an existing login system (maybe one involving a username and a password) provided by the site (or even by a third-party), but it ends up being sufficiently intrusive to the flow that it just doesn't feel right to use it and another login mechanism, which means that these killer "email changed, don't have access to old e-mail address" issues become entrenched. That also isn't how Persona was marketing itself, so no one seems to think to use it that way (leading to the "it doesn't seem to better solve a problem I really have" issue). (I have written more about this subject in the past, with at least a small amount more detail on some of the other problems that can arise with relation to email accounts provided for temporary use, such as by the aforementioned schools, employers, and network providers; the short version, though, is that email addresses often get reassigned, which makes the entire idea of using an email address as the basis of what is supposed to be a widespread secure login mechanism insane. OpenID has tons of its own adoption issues, but at least it required providers to never reuse their identifiers between different people, and provided a simple way to allow that to be possible... I mean, even Yahoo and Hotmail expire and recycle accounts, so this is a serious problem.) https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4605507 https://news.ycombinator.com/item?id=4605507

StavrosK 13y ago
That's inaccurate. You can just have a "change your email" account setting, as usual. Persona has nothing to do with that.
- saurik 13y ago
  OK, then a answer this question: how does the user log in to change their email address? They can't use Persona, as they already deleted their old email address. (And if you try to tell me this doesn't happen, you are wrong: this happens constantly; again, I run a site with tens of millions of users and rely on third-party login providers: I am not making these issues up. Most users don't use your site constantly, and only realize they are locked out long after they've moved on from their old email address. In fact, it would never even occur to them that this is a problem, as they are used to sites using passwords for login, which even when emails are used as the username continue to work after they delete their account.) The easy solutions I can come up with to this problem negate all the benefits of Persona past "email verification without sending an email", which is a non-problem for most people, and not how Persona is marketing itself (in particular, you can't rely on it as a login provider: you need a password or something instead). It is ludicrously irritating to have to deal with these issues manually; at least Google (which also causes this problem) offers other benefits (names, genders, profile pictures, and with G+ a list of friends to easily add social features). The other options you have are ludicrous "account recovery" flows, such as Facebook's "get five of your most trusted friends to vouch for you" mechanism, which shouldn't be needed for this all-too-common case.
  - StavrosK 13y ago
    Sure, if you delete your email address before you've changed it on the site, you're screwed, but how do you log in with Facebook/Twitter/Google after you've deleted your Facebook/Twitter/Google account? You aren't just screwed, but there's no way to change login accounts at all, even if you go around to all of your sites beforehand. Persona is better than the other centralized login systems in this respect, and is second only to username/password. Username/password can identify you after you've changed whatever you like, but it's not centralized, so we're comparing apples to oranges.