3 ms·

I rejected Persona out of hand at the time[1] for the design gaffe of using HTTPS at the root of a corporate website[2] (worse, via a DNS apex A record[3]) as t

I rejected Persona out of hand at the time[1] for the design gaffe of using HTTPS at the root of a corporate website[2] (worse, via a DNS apex A record[3]) as the identity-provider infrastructure discovery mechanism. I haven't reviewed the protocol since maybe a year ago, but my view then was that system administrators within enterprises could only adopt Persona as identity providers if federated discovery was via records in the DNS, as the lords of protocol design intended, preferably SRV records at that. Not the only barrier to adoption, perhaps, but definitely one of them. No-one substantial was likely going to use anything but the Fallback server, and there is no commercial reason to choose that rather than social-media-SSO where you'll enjoy the marketing bonus of reaching their outbound feed. [1] https://news.ycombinator.com/item?id=5447097 https://news.ycombinator.com/item?id=5447097 [2] a !! blunder because marketing won't let you in many organisations. also because most sites won't even have a port 443 https listener, let alone a valid certificate, on the apex A record. all this indicative of lack of real-world experience by the designers. [3] a !!!! blunder see e.g. https://devcenter.heroku.com/articles/apex-domains https://devcenter.heroku.com/articles/apex-domains

StavrosK 13y ago
DNS is a good option, but you'd need DNSSEC, which not many people have.
- inopinatus 13y ago
  Persona is already using DNS for resolution, just very badly. I just went looking. There's a whole thread over here: https://github.com/mozilla/persona/issues/1523 https://github.com/mozilla/persona/issues/1523 & https://groups.google.com/forum/#!msg/mozilla.dev.identity/dP44TDzBnhI/3MijAKI1oR8J https://groups.google.com/forum/#!msg/mozilla.dev.identity/d... where the developers effectively shitcanned the idea of using SRV records because they fear DNSSEC. Hilariously ignoring the huge elephant in the room viz. that they were already relying on DNS to resolve endpoints. The verification, the trust, comes from TLS with a valid cert, and that doesn't change, however you located the https listener in the first place. Even better, though, if you did use DNSSEC you can validate a self-signed cert via DANE/TLSA rather than having to buy one from CrappyCA. And that would make the ISPs very happy.
  - StavrosK 13y ago
    As I explained in issue 1523, the above is misunderstanding Persona and conflating various issues, and is wrong. Pretty much the only way Persona uses DNS is to perform an A lookup to get the user's domain, which could be SRV (or have an SRV fallback instead). The issues above talk about delegation, which is a whole other matter.
    - inopinatus 13y ago
      No, that is exactly what I'm saying. It should be an SRV lookup to find the support document. This solves a lot of problems. No misunderstanding here. You may actually be in total agreement with me.
      - StavrosK 13y ago
        I am in agreement with you, but the misunderstanding is about DNSSEC, etc. The only reason SRV records are not used for that is probably that nobody suggested it (it's a good idea, you should probably open an issue).

StavrosK 13y ago

DNS is a good option, but you'd need DNSSEC, which not many people have.

inopinatus 13y ago
Persona is already using DNS for resolution, just very badly. I just went looking. There's a whole thread over here: https://github.com/mozilla/persona/issues/1523 https://github.com/mozilla/persona/issues/1523 & https://groups.google.com/forum/#!msg/mozilla.dev.identity/dP44TDzBnhI/3MijAKI1oR8J https://groups.google.com/forum/#!msg/mozilla.dev.identity/d... where the developers effectively shitcanned the idea of using SRV records because they fear DNSSEC. Hilariously ignoring the huge elephant in the room viz. that they were already relying on DNS to resolve endpoints. The verification, the trust, comes from TLS with a valid cert, and that doesn't change, however you located the https listener in the first place. Even better, though, if you did use DNSSEC you can validate a self-signed cert via DANE/TLSA rather than having to buy one from CrappyCA. And that would make the ISPs very happy.
- StavrosK 13y ago
  As I explained in issue 1523, the above is misunderstanding Persona and conflating various issues, and is wrong. Pretty much the only way Persona uses DNS is to perform an A lookup to get the user's domain, which could be SRV (or have an SRV fallback instead). The issues above talk about delegation, which is a whole other matter.
  - inopinatus 13y ago
    No, that is exactly what I'm saying. It should be an SRV lookup to find the support document. This solves a lot of problems. No misunderstanding here. You may actually be in total agreement with me.
    - StavrosK 13y ago
      I am in agreement with you, but the misunderstanding is about DNSSEC, etc. The only reason SRV records are not used for that is probably that nobody suggested it (it's a good idea, you should probably open an issue).