4 ms·

We use Persona at Microcosm, so you can see it in action on sites such as http://forum.espruino.com/ http://forum.espruino.com/ and http://forum.islington.cc/ h

by buro9 13y ago

We use Persona at Microcosm, so you can see it in action on sites such as http://forum.espruino.com/ http://forum.espruino.com/ and http://forum.islington.cc/ http://forum.islington.cc/ , just click sign-in and you're there. For our use-case Persona is great. I've personally built the "web account" solution several times for different clients and I did not want to build it again. Persona is the lightest drop-in and easiest to implement solution you can imagine, and it works extremely well. We've had a couple of issues, but nothing of significance. Mostly these have been us doing things unexpected, i.e. pre-loading user accounts obtained face-to-face and the case of the user@ part of the email address differing from the Persona provided email address. I personally also wish that persona.js is added to CDNJS to increase the speed by which it's served. What we found through asking, was that people feel very protective of their Google, Twitter, and Facebook accounts. They will sign in with them, but there's a wariness of doing so as they do not want to be spammed, have things posted on their behalf, etc. These fears mostly apply when people first arrive on one of our sites. We wanted a lower friction to that initial sign-in, and we feel that Persona gives us this. We also found that on interest-based communities there is a reticence to associate real-identity to the nerdiest of their interests. This meant that not using Facebook and Google is a good thing in our scenario. One of the things we like about Persona is the user experience. For our product, simplicity and ease are core goals. Persona helps rather than hinders on this front. We really like Persona and hope that it remains under active development for a long-time. We are not of the belief that it's failed, simply that it's a slow-burner and needs some marketing support.

StavrosK 13y ago
I 100% agree with all of this. I think Persona needs some native support in browsers/etc and will succeed. I find it the easiest login system to implement, bar none. I also wrote a post on how you can use it with disposable email addresses: http://www.stavros.io/posts/persona-accounts-disposable-email-addresses/ http://www.stavros.io/posts/persona-accounts-disposable-emai... If disposable email providers (mailinator, 33mail, etc) implement it, you will just be able to log in with your disposable email address everywhere. If the browser implements "remember which address I signed up to this site with", it will be the most transparent login system available.
jspash 13y ago
My first and only experience with Persona is oddly enough, to log into the Islington CC forum (small world) and I found the whole experience oddly disconcerting. Am I logged into Google or Microcosm? Do I have to stay logged into my Google account? What does firefox have to do with my Gmail account? What is Persona and what do they have to do with anything? I had lots of questions and none were answered on the nice minimally designed log in page. All of a sudden I'm sent to Google, but I don't want my work account associated with ANYTHING outside of work. Ok, I'm smart, I can just log out and no link will be created. I log in with my personal G account and everything seems ok. But now I have to log out/in again to get back to work. Why all this trouble? I have a password manager, and it can easily remember another 30 character password. If it gets hacked, the damage is limited to a forum that I occasionally visit. No biggie. But now, everything is linked to everything else and who knows what is happening in the background that I agreed to because I didn't read the small print. Ok, I'm being a bit dramatic. But personally I don't like services to mixed. That's all it comes down to. One last thing, you mention that people didn't like associating real identities etc, but the only way I could log in was by associating my real identity from my Google account.
- buro9 13y ago
  Disconcerting, that's not come up in any of the UX testing or feedback we've received recently. In our earliest version (last summer) we had pushed the "Sign In with Persona" branding but later moved to just saying "Sign in". But that was caught in UX testing and we did change that so that it was clearer (by saying less) that you were signing in to the site you were on (Islington CC). > the only way I could log in was by associating my real identity from my Google account The great thing about Persona is you can use any email you wish to login to something. You can choose to use an email address that is associated with real identity, but just as easily you could've chosen not to. The advantage Persona supplies is that even if you do choose to use an email associated with real identity, Google (or the email provider, e.g. Facebook) will only see a "Sign in to Persona" event, and will not have additional data revealing that you had signed in to Islington CC (in this case). Persona effectively acts as a behavioural data firewall that grants you sign-in with email ability, but without leaking your behaviour activity back to the email issuer. If you have any feedback on how you think we can improve this from our side (the forum software), just email me: david@microcosm.cc I've yet to write FAQ support documentation, and I think you could help provide a lot of the questions around sign-in for me to answer.
blueskin_ 13y ago
>This meant that not using Facebook and Google is a good thing in our scenario. That's why there's this idea of a 'username' paired with a stored salted hash of a 'password'. This allows people to have independent accounts per service.
- e12e 13y ago
  This is true. However, part of the thinking behind persona is that most sites will want to let you reset your password, so they store: salt+password:username:email. Some are being "clever" and use the email as the username -- hopefully paired with a numeric/uuid uid -- so that when you change email providers, you can retain your account. Some might store a phone number for recovery etc. Some require a working email in order to register (to fight spam accounts). Further, in general most sites will log your ip, be able to match that to your username, and so, unless you're using tor, be able to provide enough information to track you across sites anyway.
fotbr 13y ago
Here's why I won't use it if I have any other option: As an example to see if it's still an issue -- I tried clicking your islington.cc "sign-in or register" button. I'm greeted with a popup saying "We are sorry, but currently your browser is not supported. <firefox logo> Persona works with Firefox and other modern browsers". The browser I'm using? Firefox (ESR 24.whatever is current). Closing the pop-up and trying again worked, eventually. This happens about a third of the time I try to use a persona-based sign-in.
- callahad 13y ago
  Wow, that sounds terrible! Could you file a bug, please? And please include the results from https://people.mozilla.org/~fmarier/troubleshoot.html https://people.mozilla.org/~fmarier/troubleshoot.html

by buro9 13y ago

StavrosK 13y ago

I 100% agree with all of this. I think Persona needs some native support in browsers/etc and will succeed. I find it the easiest login system to implement, bar none. I also wrote a post on how you can use it with disposable email addresses: http://www.stavros.io/posts/persona-accounts-disposable-email-addresses/ http://www.stavros.io/posts/persona-accounts-disposable-emai... If disposable email providers (mailinator, 33mail, etc) implement it, you will just be able to log in with your disposable email address everywhere. If the browser implements "remember which address I signed up to this site with", it will be the most transparent login system available.

jspash 13y ago

My first and only experience with Persona is oddly enough, to log into the Islington CC forum (small world) and I found the whole experience oddly disconcerting. Am I logged into Google or Microcosm? Do I have to stay logged into my Google account? What does firefox have to do with my Gmail account? What is Persona and what do they have to do with anything? I had lots of questions and none were answered on the nice minimally designed log in page. All of a sudden I'm sent to Google, but I don't want my work account associated with ANYTHING outside of work. Ok, I'm smart, I can just log out and no link will be created. I log in with my personal G account and everything seems ok. But now I have to log out/in again to get back to work. Why all this trouble? I have a password manager, and it can easily remember another 30 character password. If it gets hacked, the damage is limited to a forum that I occasionally visit. No biggie. But now, everything is linked to everything else and who knows what is happening in the background that I agreed to because I didn't read the small print. Ok, I'm being a bit dramatic. But personally I don't like services to mixed. That's all it comes down to. One last thing, you mention that people didn't like associating real identities etc, but the only way I could log in was by associating my real identity from my Google account.

buro9 13y ago
Disconcerting, that's not come up in any of the UX testing or feedback we've received recently. In our earliest version (last summer) we had pushed the "Sign In with Persona" branding but later moved to just saying "Sign in". But that was caught in UX testing and we did change that so that it was clearer (by saying less) that you were signing in to the site you were on (Islington CC). > the only way I could log in was by associating my real identity from my Google account The great thing about Persona is you can use any email you wish to login to something. You can choose to use an email address that is associated with real identity, but just as easily you could've chosen not to. The advantage Persona supplies is that even if you do choose to use an email associated with real identity, Google (or the email provider, e.g. Facebook) will only see a "Sign in to Persona" event, and will not have additional data revealing that you had signed in to Islington CC (in this case). Persona effectively acts as a behavioural data firewall that grants you sign-in with email ability, but without leaking your behaviour activity back to the email issuer. If you have any feedback on how you think we can improve this from our side (the forum software), just email me: david@microcosm.cc I've yet to write FAQ support documentation, and I think you could help provide a lot of the questions around sign-in for me to answer.

blueskin_ 13y ago

>This meant that not using Facebook and Google is a good thing in our scenario. That's why there's this idea of a 'username' paired with a stored salted hash of a 'password'. This allows people to have independent accounts per service.

e12e 13y ago
This is true. However, part of the thinking behind persona is that most sites will want to let you reset your password, so they store: salt+password:username:email. Some are being "clever" and use the email as the username -- hopefully paired with a numeric/uuid uid -- so that when you change email providers, you can retain your account. Some might store a phone number for recovery etc. Some require a working email in order to register (to fight spam accounts). Further, in general most sites will log your ip, be able to match that to your username, and so, unless you're using tor, be able to provide enough information to track you across sites anyway.

fotbr 13y ago

Here's why I won't use it if I have any other option: As an example to see if it's still an issue -- I tried clicking your islington.cc "sign-in or register" button. I'm greeted with a popup saying "We are sorry, but currently your browser is not supported. <firefox logo> Persona works with Firefox and other modern browsers". The browser I'm using? Firefox (ESR 24.whatever is current). Closing the pop-up and trying again worked, eventually. This happens about a third of the time I try to use a persona-based sign-in.

callahad 13y ago
Wow, that sounds terrible! Could you file a bug, please? And please include the results from https://people.mozilla.org/~fmarier/troubleshoot.html https://people.mozilla.org/~fmarier/troubleshoot.html